1. Who we are

This Privacy Policy explains how Oz Travel Shoppe Pty Ltd trading as Gurkhas Travel (we, us, our) collects, uses, stores and discloses personal information when you use our website, mobile site, mobile application, call centre, office, social media pages, email, SMS, WhatsApp or other booking channels (Platform).

2. Scope of this policy

This policy applies to personal information handled by us in connection with Australian-dollar bookings, payments processed through NAB or another Australian merchant facility, and services supplied by or through Oz Travel Shoppe Pty Ltd. If a booking is paid in INR or processed through Cashfree for OZ Infotech Private Limited, the OZ Infotech privacy policy may apply instead or in addition.

This policy does not replace the privacy policies of airlines, hotels, tour operators, travel insurers, payment gateways, global distribution systems, immigration/visa providers or other third-party suppliers. Those third parties may collect and handle your information under their own policies.

3. What personal information we collect

4. How we collect information

• Directly from you when you search, enquire, register, book, pay, request support, submit documents or communicate with us.

• From a person booking on your behalf, including family members, employers, group organisers, travel agents or authorised representatives.

• From airlines, hotels, tour operators, consolidators, GDS providers, payment processors, fraud-prevention providers, insurers, visa providers and other suppliers.

• Automatically through cookies, pixels, log files, analytics tools and similar technologies when you use our Platform.

• From public sources and government or regulatory sources where relevant to fraud prevention, legal compliance, sanctions screening or dispute handling.

5. If you provide information about another person

If you give us personal information about another traveller, you confirm that you have authority to do so, have told that person about this policy, and have obtained any consent required for us and our suppliers to collect, use, disclose and transfer their information for travel booking and related purposes. For children, you confirm that you are a parent, guardian or authorised adult, or have the consent of one.

6. Why we use your information

7. Legal basis and consent

We collect, use and disclose personal information where reasonably necessary for our functions and activities as a travel agency and OTA, where you have consented, where required or authorised by law, where necessary to perform or manage a booking, or where otherwise permitted by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Sensitive information will only be collected where you consent, where required or authorised by law, or where another exception applies. Special assistance, health, dietary, accessibility and similar travel information may need to be shared with airlines, hotels, tour operators or other suppliers to fulfil the booking.

8. Who we disclose information to

• Airlines, hotels, accommodation providers, tour operators, cruise operators, car hire companies, transfer providers, attraction providers and other travel suppliers.

• Global distribution systems, ticketing consolidators, booking engines, channel managers, bed banks and travel technology providers.

• Payment gateways, banks, card schemes, NAB merchant services, fraud-screening providers, chargeback processors, debt collection agencies and accounting providers.

• Visa, immigration, border, health, insurance and assistance providers where relevant to your booking.

• OZ Infotech Private Limited and other group or affiliated entities where required to support cross-border bookings, customer service, technology, reconciliation or dispute handling.

• IT hosting, cloud, CRM, analytics, marketing, communication, call recording, document storage and cybersecurity service providers.

• Regulators, courts, tribunals, law enforcement agencies, government authorities, airports, airlines and dispute resolution bodies where required or reasonably necessary.

• Professional advisers including lawyers, auditors, insurers, accountants and consultants.

9. Overseas disclosure

Travel bookings usually require personal information to be sent overseas, including to airlines, hotels, tour operators, visa/immigration providers, travel technology providers and support teams in the countries you travel to, transit through or where the supplier operates. We may also disclose personal information to service providers or related entities in India and other countries.

Where the Australian Privacy Principles apply, we will take reasonable steps to protect personal information disclosed overseas unless an exception applies, such as where you consent to the disclosure after being informed that the overseas recipient may not be accountable under Australian privacy law, or where the disclosure is otherwise permitted by law.

10. Cookies, pixels and online tracking

We may use cookies, pixels, tags, SDKs and similar technologies to operate the Platform, remember preferences, maintain sessions, measure performance, detect fraud, improve search results, analyse traffic and deliver or measure advertising. You can control some cookies through your browser or device settings, but disabling cookies may affect Platform functionality.

Where third-party advertising or analytics tools collect personal information, those providers may also handle information under their own privacy policies. We should publish a separate Cookie Notice listing key cookie categories and providers before the OTA launch.

11. Direct marketing and communications

We may send service messages about bookings, payments, travel alerts, schedule changes, refunds, account security and support. These are not marketing messages and may be necessary to provide services.

We may send marketing communications where permitted by law and your preferences. Each commercial electronic marketing message should identify the sender and include a functional unsubscribe mechanism. You can opt out of marketing at any time, but we may still send service-related communications.

12. Security

We will take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Measures may include access controls, encryption in transit, payment tokenisation or third-party payment processing, staff access restrictions, logging, vendor due diligence, backups, incident response and staff training.

No online platform or transmission method is completely secure. You must keep your account credentials confidential and notify us immediately if you suspect unauthorised use of your account or booking information.

13. Data breach response

If we suspect a data breach, we will assess the incident and take remedial action. Where the Notifiable Data Breaches scheme applies and there are reasonable grounds to believe an eligible data breach has occurred, we will notify affected individuals and the Office of the Australian Information Commissioner as required by law.

14. Retention

We keep personal information for as long as reasonably required for the purposes described in this policy, including to complete bookings, provide support, comply with tax, accounting and legal obligations, handle disputes, prevent fraud and maintain business records. We may de-identify, aggregate or securely delete information when it is no longer required, subject to legal retention requirements.

15. Access and correction

You may request access to personal information we hold about you or ask us to correct inaccurate, out-of-date, incomplete, irrelevant or misleading information. We may need to verify your identity before responding. We may refuse access or correction where permitted by law, but will explain our reasons where required.

16. Complaints

If you have a privacy concern, contact us first using the privacy contact details above. Please include your name, contact details, booking reference and a description of the concern. We will acknowledge and investigate your complaint within a reasonable time. If you are not satisfied, you may be able to complain to the Office of the Australian Information Commissioner.

17. Third-party sites and supplier platforms

Our Platform may link to airline, hotel, insurance, payment, visa, social media or other third-party websites and apps. We are not responsible for the privacy practices of those third parties. You should read their privacy policies before providing information to them.

18. Changes to this policy

We may update this policy from time to time. The updated version will be posted on our website or app with the effective date. Material changes may also be notified by email, app notice or another reasonable method.

19. Website/app implementation checklist

• Add this policy in the website footer, app menu, checkout page, account sign-up page and document-upload flow.

• Add separate consent checkboxes for privacy policy acceptance, marketing opt-in and sensitive/special assistance information where appropriate.

• Add a Cookie Notice and cookie preference tool if using advertising pixels, analytics, retargeting or behavioural tracking.

• Publish a privacy contact and internal escalation process for privacy complaints and data access/correction requests.

• Confirm vendor list: payment gateways, booking engine, GDS, analytics, CRM, email/SMS/WhatsApp provider, cloud hosting, fraud tool and call recording provider.

• Prepare data breach response workflow and supplier incident notification clauses.

• Check whether Oz Travel Shoppe Pty Ltd is an APP entity based on turnover or other coverage triggers; if uncertain, comply voluntarily as a best practice.