Nimini Travels & Payments
Effective Date: 11 November 2026
THIS DATA PRIVACY AND INFORMATION SECURITY GOVERNANCE POLICY (HEREINAFTER THE "PRIVACY CHARTER") CONSTITUTES A BINDING, STATUTORY PROTOCOL PROMULGATED BY NIMINI TRAVELS & PAYMENTS (HEREINAFTER REFERRED TO AS "THE ENTERPRISE", "DATA FIDUCIARY", "WE", "US", OR "FACILITATOR"). THIS CHARTER DELINEATES THE SYSTEMIC AMBIT, PROTOCOLS, STATUTORY MANDATES, AND LEGAL BASES GOVERNING THE COLLECTION, INGESTION, PROCESSING, TRANSMISSION, AUDITING, RETENTION, AND ARCHIVAL OF PERSONALLY IDENTIFIABLE INFORMATION (PII), SENSITIVE FINANCIAL METRICS, BIOMETRIC ARTIFACTS, AND COLLATERAL TELE-DATA GENERATED BY CLIENTS, PATRONS, REQUISITIONERS, OR USERS ("DATA PRINCIPALS" OR "YOU") UTILIZING OUR DIGITAL DOMAINS, PHYSICAL ESTABLISHMENT, OR TELECOMMUNICATION CORRIDORS.
1. Statutory Foundation and Regulatory Adherence
This Privacy Charter is codified in strict alignment with, and subject to, the substantive governance mandates of the Republic of India, including:
- The Digital Personal Data Protection Act (DPDPA), 2023, and its subordinate statutory rules.
- The Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
- Anti-Money Laundering (AML) directives, Master Directions, and Know Your Customer (KYC) norms issued by the Reserve Bank of India (RBI).
- The Foreign Exchange Management Act (FEMA), 1999, and compliance covenants governing authorized partnerships with Thomas Cook (India) Limited.
- The Prevention of Money Laundering Act (PMLA), 2002, and directives of the Financial Intelligence Unit – India (FIU-IND).
2. Typology and Taxonomy of Ingested Data
The Data Fiduciary ingests, records, and stores discrete classifications of data strictly conditioned upon the nature of the requisitioned operational or fiscal facilitation:
- Sovereign Nominative and Demographical Data: Full appellation, maiden nomenclature, date of birth, gender, marital designation, residential coordinates, telephone identifiers, electronic mail addresses, and proof-of-address collateral.
- Travel and Consular Documentation: Machine-Readable Passport (MRP) dossiers, biometric passport scans, diplomatic visa vignettes, border transit stamps, immigration histories, frequent-flyer identifiers, dietary requirements, and medical certificates necessitated by carrier fitness-to-fly protocols.
- Financial and Remittance Tele-Data: Banking account denominations, Indian Financial System Codes (IFSC), Permanent Account Numbers (PAN), transaction reference traces, debit/credit card tokenization indices, and specific Indo-Nepal beneficiary allocations.
- Biometric and Identity Verification Inputs: Aadhaar biometric telemetry, fingerprints ingested solely for transient real-time transmission through UIDAI/AEPS gateways, masked identity tokens, and photographic self-attestations.
- Metadata and Digital Telemetry: Internet Protocol (IP) designations, browser architecture footprints, time-stamp logs, referer headers, localized session cookies, and encrypted WhatsApp tele-messaging transmission archives.
3. Purpose Limitation and Bases for Processing
Data ingestion is undertaken exclusively pursuant to explicit consent, contractual necessity, or sovereign statutory compliance, limited strictly to:
- Issuance, ticket generation, booking validation, and administrative management of aviation, ground transit, lodging, and leisure reservations.
- Strict KYC verification, customer identification, and transaction auditing mandated prior to the execution of domestic remittances, Indo-Nepal cross-border funds transfers, and authorized Thomas Cook forex transactions.
- Authentication and routing of biometric cash withdrawal instructions via Aadhaar-Enabled Payment Systems (AEPS) and interoperable bill clearing houses.
- Regulatory compliance reporting, fraud deterrence, risk-mitigation audits, and administrative liaising with commercial airlines, lodging operators, and acquiring financial entities.
4. Mandatory Third-Party Disclosures and Data Transference
The Data Principal expressly acknowledges and accords unreserved authorization for the structured transmission of relevant data subsets to external entities, functioning as independent Data Processors or separate Fiduciaries:
- Operating Common Carriers and Consolidators: Commercial airline consortia, Global Distribution Systems (GDS like Amadeus, Sabre), intercity coach operators, and hospitality management chains.
- Authorized Financial Institutions and Settlement Conduits: Scheduled commercial banks, authorized remittance clearance hubs (NEFT/RTGS/IMPS), Thomas Cook (India) Limited, acquiring gateways, and licensed fintech aggregators.
- Sovereign Diplomatic and Regulatory Directorates: Foreign embassies, high commissions, consular services, immigration border control authorities, the Reserve Bank of India, statutory law enforcement bodies, and judicial tribunals acting under lawful subpoenas.
The Data Fiduciary explicitly renounces the commercial barter, trade, monetization, or unauthorized dissemination of customer databases to speculative third-party marketing brokers.
5. Ephemeral Biometric Processing Disclaimer
The Enterprise neither archives nor creates permanent repositories of raw biometric variables (such as fingerprints or iris scans) captured via AEPS biometric terminals. All biometric assets are captured via STQC-certified, encrypted peripheral sensors and transmitted as instantaneous, cryptographically hashed authentication packets directly to the National Payments Corporation of India (NPCI) and the Unique Identification Authority of India (UIDAI). Post-handshake verification, said biometric metrics are systematically expunged from localized terminals.
6. Information Security Architecture and Custodial Safeguards
The Data Fiduciary maintains strict physical, organizational, and technological security controls, comprising:
- Secure Sockets Layer (SSL) and Transport Layer Security (TLS) cryptographic protocols across digital transmission portals.
- Restricted physical access controls governing the Global City commercial establishment, restricting file cabinets, physical registers, and hardware portals to vetted personnel.
- Strict internal authorization matrices ensuring employee access to PAN, passport dossiers, or financial logs operates on a strict need-to-know administrative paradigm.
- Routine electronic cache purging, hardware firewall protections, and strict prohibition of persistent storage of card CVV/CVC codes or banking secret factors.
7. Statutory Data Retention and Archival Horizons
In compliance with Section 12 of the Prevention of Money Laundering Act (PMLA) and RBI Master Directions:
- All transaction documentation, KYC credentials, identification records, and electronic transit logs connected with financial remittances, cash disbursements, and foreign currency liquidations shall be immutably preserved for a statutory horizon of not less than five (5) to ten (10) years following transactional execution.
- Travel records, booking vouchers, and passenger requisitions are retained for the duration mandated to discharge contractual liabilities, resolve accounting audits, and satisfy statutory tax assessments before permanent cryptographic destruction or de-identification.
8. Prerogatives and Limitations of Data Principals
Subject to statutory restrictions, ongoing anti-money laundering investigations, and regulatory audit mandates, the Data Principal possesses the prerogative to:
- Requisition confirmation of processing and access a summary of data maintained by the Enterprise.
- Requisition the correction or updating of demonstrably inaccurate, obsolete, or incomplete personal data.
- Seek withdrawal of non-statutory consent. Where consent is revoked regarding data indispensable for transaction processing (e.g., passport details for international bookings or PAN for remittances), the Enterprise shall summarily cease service execution without liability for consequential loss or non-fulfillment.
- Exercise rights of grievance redressal via our designated compliance liaison.
9. Digital Tracking, Telemetry, and WhatsApp Infrastructure
- Digital visitors accessing the Enterprise's web domain are informed that basic functional session cookies may be utilized for server load stabilization and layout optimization.
- Requisitioners utilizing WhatsApp for direct inquiries acknowledge that data transmitted over Meta-owned architecture is concurrently subject to Meta Platforms, Inc.'s end-to-end encryption frameworks and proprietary terms. The Enterprise exercises no sovereign control over metadata logged within external telecom corridors.
10. Exclusive Forum Selection and Applicable Jurisprudence
- The construction, statutory validity, interpretation, performance, and enforcement of this Privacy Charter shall be governed strictly and exclusively by the substantive statutory laws of the Republic of India.
- All disputes, claims, regulatory complaints, grievances, judicial proceedings, or litigations arising out of or directly/indirectly relating to data handling, privacy compliance, information security, or regulatory disclosures of Nimini Travels & Payments shall be strictly and exclusively subject to Mumbai jurisdiction.
11. Data Protection Officer and Grievance Redressal Conduit
Pursuant to the IT Act, 2000, and the DPDPA, 2023, Data Principals may direct documented statutory inquiries, correction requests, or privacy concerns to the designated grievance nodal authority:
- Entity Name: Nimini Travels & Payments
- Operational Facility: Shop No. 10, Poonam Avenue, Near Axis Bank, Agarwal 1st Circle, Global City, Virar (West), Vasai-Virar, District Palghar, Maharashtra – 401303, India
- Attn / Nodal Liaison: Compliance & Privacy Operations Desk
- Official Tele-Conduit / WhatsApp: +91 91681 43000
- Electronic Dispatch: niminitravels@gmail.com
- Operational Intake Schedule: Monday through Saturday, 09:00 hours to 19:30 hours IST (Excluding Sundays and Declared National Holidays)