Data Policy

Categories of personal data we process, the legal basis, and your rights as a data principal.

Last updated: 6 June 2026

This Data Policy explains the categories of personal data OnlyOnTrip processes, the legal basis under the Digital Personal Data Protection Act 2023 ("DPDP Act"), and the controls available to you.

Categories of Personal Data

  • Identity & contact (name, email, phone)
  • Government identifiers (passport for international flights, GST number on request)
  • Transactional (bookings, payments, refunds)
  • Technical (device, IP, cookies, page interactions)

Lawful Basis

We process data on the basis of (a) your consent for marketing communications and optional features, and (b) legitimate use for performing your bookings, complying with law, and detecting fraud.

Cross-Border Transfers

Some Service Providers (foreign airlines, international hotels) are located outside India. We transfer the minimum data needed to fulfil your booking, with contractual safeguards in place.

Grievance Officer

As required by the DPDP Act, our Grievance Officer can be reached at:

Grievance Officer, Journey Express LLP
Shop No. 4, Hyland Park CHS, SV Road, Dahisar East, Mumbai 400068, India
Email: support@onlyontrip.com
Phone: +91 9326940044

We respond to data-subject requests within 30 days.

Data We Collect — At a Glance

OnlyOnTrip collects personal data only to the extent required to provide our travel booking services and comply with Indian law. We do not sell your data to third parties, and we do not use your data for purposes unrelated to travel services without your explicit consent.

Data Categories

  • Account data: Name, email address, phone number used to create and manage your OnlyOnTrip account.
  • Booking data: Passenger details (passport number, date of birth, nationality) required by airlines and immigration for domestic and international travel.
  • Payment data: Transaction ID and payment method — card numbers are handled exclusively by Razorpay and are never stored on OnlyOnTrip servers.
  • Usage data: IP address, browser type, pages visited, and search queries used to improve the platform and prevent fraud.
  • Communication data: Emails and chat messages sent to our support team, retained for 2 years for dispute resolution.

Data Retention

Booking records are retained for 7 years as required by Indian tax and consumer protection law. Account data is retained until account deletion is requested. Usage logs are retained for 90 days. Marketing preferences are retained until you opt out. To request data deletion, email privacy@onlyontrip.com.

Your Data Rights

  • Right to access: You can request a copy of all personal data OnlyOnTrip holds about you. We will provide it within 30 days.
  • Right to correction: If any information we hold is inaccurate, you can update it via your account settings or by contacting support.
  • Right to erasure: You can request deletion of your account and personal data. Certain booking records must be retained for legal and tax compliance.
  • Right to restrict processing: You can withdraw consent for marketing communications at any time via the unsubscribe link in emails or your account settings.
  • Right to portability: You can request your data in a machine-readable format (JSON or CSV) for transfer to another service.

Children's Privacy

OnlyOnTrip's services are intended for adults (18 years and older). We do not knowingly collect personal data from children under 18 years of age. Minors travelling on a booking must be added as passengers by an adult account holder. If a parent or guardian believes their child has submitted personal data without consent, please contact privacy@onlyontrip.com and we will delete that information promptly.

How We Use Your Data for Service Improvement

Aggregated, anonymised usage data helps us understand which routes and destinations are most popular, how users navigate the booking flow, and where users encounter problems. This data never identifies individual users and is used solely to improve the platform — for example, to display the most relevant domestic flight routes on the homepage or to optimise the hotel search experience. We do not sell or share individual usage profiles with advertisers.

Automated Decision-Making

OnlyOnTrip uses automated systems to display personalised flight and hotel results based on your search history and preferences. For example, if you frequently search for flights from Bangalore to Delhi, the platform may show those routes more prominently. These automated recommendations are convenience features — they do not affect pricing and can be overridden at any time by entering different search parameters. No automated decisions with legal or significant effects are made solely by OnlyOnTrip's systems.

Contact Our Data Protection Team

All data-related queries — including subject access requests, correction requests, deletion requests, and complaints — should be addressed to privacy@onlyontrip.com. We aim to respond within 7 business days for general queries and within 30 days for formal data subject requests under the Digital Personal Data Protection Act 2023. If you are not satisfied with our response, you have the right to escalate your complaint to the Data Protection Board of India.

Data Policy | OnlyOnTrip