Privacy Policy

KS Travels ("KS Travels", "we", "us") provides corporate cab and employee transportation services across Delhi NCR and outstation routes in India. We are a GST-registered and MSME-registered enterprise.

This policy explains what personal data we collect, why, who we share it with, how long we keep it and what you can ask us to do with it. It covers our website, our corporate transport services, our driver mobile app and our employee mobile app.

For the purposes of the Digital Personal Data Protection Act, 2023, KS Travels is the Data Fiduciary for the personal data described here, and you are the Data Principal. This policy is also our published privacy policy for the purposes of the Information Technology Act, 2000 and the rules made under it.

We collect only what a specific purpose needs. Grouped by where it reaches us:

We do not run advertising trackers, we do not build behavioural profiles, and we do not buy personal data from third parties.

• To respond to your enquiry and prepare a quotation.
• To provide the transport service you or your employer has contracted — assigning vehicles and drivers, planning routes and stops, and running trips.
• To keep people safe: live tracking of vehicles on duty, SOS handling, late-drop alerts, and driver verification.
• To tell you what is happening — route started, cab approaching, trip completed — by push notification, email or WhatsApp.
• To bill correctly and meet our tax obligations: GST invoices, trip logs supporting each line, and payment records.
• To pay drivers and partner vehicle owners.
• To handle complaints, safety incidents and service quality reviews.
• To keep our systems secure and investigate misuse.
• To send service updates and offers by email, where you have subscribed. Every such email carries a one-click unsubscribe.

We rely on your consent where you give it (enquiry forms, newsletter, reviews, app location permissions), on the performance of a contract for service delivery and billing, and on legal obligation for tax and statutory records.

Location is the most sensitive routine data we handle, so we set it out separately.

• Driver app: location is collected only while a driver is signed in and on duty, including in the background, because a corporate route must remain trackable when the driver's screen is off. Android and iOS both ask for this permission explicitly and it can be withdrawn in device settings at any time — the app will then be unable to support live tracking.
• It is used to show the vehicle on the live map in our operations dashboard, in the client dashboard and in the employee app; to estimate arrival times; to detect a stalled or delayed vehicle; and to record when a stop was reached.
• Employee app: we store the home pickup point you or your employer sets, so the route can include your stop. We do not track an employee's personal phone location.
• We do not track drivers when they are off duty, and we do not sell or share location data for advertising or analytics.

We do not sell personal data. We share it only where the service requires it:

We keep personal data for as long as the purpose needs, and for as long as the law requires. In practice:

We apply reasonable security safeguards appropriate to the sensitivity of the data we hold, in line with the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. In summary:

• Data is encrypted in transit.
• Access is restricted to authorised personnel on a need-to-know basis, and is controlled by role.
• Credentials are never stored in a form that we or anyone else can read back.
• Identity and financial details submitted for partner onboarding are subject to additional access restrictions.
• Our systems are monitored, access is logged, and we review our controls periodically.
• Our staff and drivers are bound by confidentiality obligations.

We deliberately do not publish the details of our security configuration. If you are a customer whose procurement or information-security team needs specifics, we will share them with you directly under a confidentiality agreement — write to us at the address below.

No system can be guaranteed secure. If a personal data breach occurs, we will notify the affected individuals and the Data Protection Board of India in the manner and timelines the DPDP Act requires. If you believe you have found a security weakness in our website or apps, please report it privately to info@kstravels.co.in rather than disclosing it publicly, and we will look into it.

Our systems and data are hosted in India. Some of the service providers listed above — in particular the AI chatbot provider, the maps provider and the push-notification service — operate globally, so limited data may be processed on servers outside India when those features are used.

Such transfers are made only to the extent the feature requires, under contractual terms with those providers, and are permitted under Section 16 of the Digital Personal Data Protection Act, 2023. We do not transfer personal data to any territory restricted by the Central Government.

Under the Digital Personal Data Protection Act, 2023, you can ask us to:

• Tell you what personal data of yours we hold and who we have shared it with.
• Correct or complete anything that is inaccurate or out of date.
• Erase personal data we no longer need for the purpose it was collected for, or where you withdraw the consent it rests on.
• Withdraw consent you previously gave — for the newsletter, for a published review, or for app location access. Withdrawing consent does not undo processing already done, and some withdrawals will stop us being able to provide the service.
• Nominate someone to exercise these rights on your behalf if you are unable to.
• Raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied with our answer.

To exercise any of these, email info@kstravels.co.in from the address or phone number we hold for you, or write to our corporate office. We will respond within 30 days. If you are an employee travelling under your company's contract, some requests may need to go through your employer, and we will tell you if that is the case.

If you have a concern about how we have handled your personal data, please raise it with our Grievance Officer, appointed under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000:

Please include enough detail for us to identify your records — the name, phone number or email address you deal with us under, and what you are asking for. If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India.

We do not use advertising or cross-site tracking cookies. What we do store on your device is functional:

• A session token for staff and client administrators who log in to the dashboard. It is held in your browser's session storage and is cleared when you close the tab.
• Small preference values that keep the site working as you move between pages.

You can clear this at any time through your browser settings. Doing so will sign you out of the dashboard.

Our services are sold to businesses and are not directed at children. We do not knowingly collect personal data of anyone under 18 through our website or apps. Where a corporate contract involves transporting a minor, that arrangement is made with the employer and the parent or guardian, and the data is handled as part of that contract.

We update this page when our services or systems change. The "last updated" date at the top always reflects the current version. Where a change materially affects how we use your data, we will tell you directly — by email to subscribers and account holders, or by notice in the apps.