Last updated: 9 August 2026
This policy explains what personal data Her Bucket List collects when you enquire about or book a trip, why we collect it, who we share it with, and the choices you have. It applies to herbucketlist.in and to every booking made through us.
Her Bucket List is operated by ADD registered entity name, a company registered in India with CIN ADD CIN and registered office at ADD registered address, Jaipur, Rajasthan, ADD PIN. For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below.
1. What we collect
Information you give us
- Enquiry details: name, phone number, email address, the trip you are interested in and anything you write in the message box.
- Booking details: full name as printed on your government ID, date of birth, gender, nationality, passport number and expiry, residential address and emergency contact details.
- Health and dietary information you choose to share so we can plan safely, such as altitude-related conditions, mobility limits, allergies or food preferences. You are never required to give a diagnosis, only what affects the trip.
- Payment information processed by our payment gateway. We receive a transaction reference and the last four digits of the instrument. We do not store full card numbers or UPI credentials.
Information collected automatically
- IP address, browser type, device type, pages visited and referring URL, through server logs and analytics.
- Cookies and similar technologies, as described in section 7.
2. Why we use it
- To answer your enquiry and send you trip information you asked for.
- To make bookings on your behalf with hotels, homestays, transport operators, airlines, cruise operators and permit authorities.
- To meet mandatory identity and registration requirements, including Form C filings for foreign nationals, inner line permits and hotel guest registers.
- To reach you or your emergency contact during a trip.
- To process payments and issue invoices, and to meet tax and accounting obligations.
- To send trip-related operational messages, such as departure reminders and packing lists.
- To send marketing about future departures, only where you have opted in. You can withdraw at any time.
3. Legal basis
We process personal data on the basis of the consent you give when you submit a form or confirm a booking, and for the legitimate uses recognised under the Digital Personal Data Protection Act, 2023, including performing the service you asked for and complying with Indian law. Sensitive personal data as defined under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 is processed only with your consent and only for the purposes above.
4. Who we share it with
We share only what a supplier needs to deliver your trip. We do not sell personal data to anyone.
- Accommodation and transport providers in India and abroad, who need your name and ID details to register you as a guest or passenger.
- Airlines, embassies, consulates and visa processing agencies, where the trip requires it.
- Payment gateways and banks for processing and refunds.
- Insurance providers, where you buy a policy through a partner we introduce.
- Technology providers such as our website host, email and CRM tools, under contracts that restrict their use of the data.
- Government or law enforcement authorities, where we are legally required to disclose.
5. Transfers outside India
For international trips, your details are shared with suppliers in the destination country so they can confirm your booking. Some of our technology providers also store data on servers outside India. We transfer personal data outside India only as permitted under the Digital Personal Data Protection Act, 2023 and only to the extent needed to deliver your trip.
6. How long we keep it
- Enquiries that do not become bookings: 24 months from your last contact with us.
- Booking and payment records: 8 years from the end of the relevant financial year, to meet Indian tax and company law requirements.
- Marketing consent records: until you withdraw consent, plus a record of the withdrawal.
After these periods, data is deleted or anonymised.
7. Cookies
We use strictly necessary cookies to make the site work, and analytics cookies to understand which pages people use. Analytics cookies are set only where you accept them. You can clear or block cookies in your browser settings, though parts of the site may then behave unpredictably.
8. Your rights
Under the Digital Personal Data Protection Act, 2023 you can:
- Ask what personal data we hold about you and how we have used it.
- Ask us to correct or complete inaccurate data.
- Ask us to erase data we no longer need, subject to legal retention periods.
- Withdraw consent at any time, including for marketing.
- Nominate another person to exercise these rights on your behalf if you are unable to.
- Raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied.
To exercise any of these, write to our Grievance Officer below. We respond within 30 days.
9. Security
The site is served over HTTPS. Access to booking data is limited to staff who need it, protected by individual accounts and multi-factor authentication. Payment data is handled entirely by a PCI-DSS compliant gateway. No system is perfectly secure, and if a personal data breach occurs we will notify affected travellers and the Data Protection Board of India as required.
10. Children
Our trips are sold to women aged 18 and above and the site is not directed at children. We do not knowingly collect personal data from anyone under 18 except where a minor is a named participant on a family or custom booking, in which case we collect it from a parent or guardian with their consent.
11. Grievance Officer
In line with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023:
- Name: ADD officer name
- Designation: Grievance Officer, Her Bucket List
- Email: privacy@herbucketlist.in
- Phone: ADD number
- Address: ADD registered address, Jaipur, Rajasthan
12. Changes to this policy
If we change how we handle personal data we will update this page and change the date at the top. Where the change is significant, we will email travellers with an active booking.