Become a Host
    • Your Cart
    • Your cart is empty
    • Your Cart
    • Your cart is empty

PRIVACY POLICY

Version 1.1
Last Updated: [21 July 2026]

This Privacy Policy ("Policy"), owned and operated by Chomps Innovation Labs LLP (hereinafter referred to as the "Company", "We", "Us", or "Our") govern the processing of Personal Data and information. The Platform acts as a technology based intermediary marketplace that enables independent third-party hosts to list, promote and offer travel related services including but not limited to tours, transportation, accommodations and Experiences.

This Policy applies to all persons who access, browse, register on, transact through, or otherwise use our website, mobile application, products, services, or any associated platforms, features, content, or whether existing now or introduced in the future by the Company (collectively referred to as the "Platform"). Such individuals shall be referred to as "User", "You", or "Your".

User privacy is of utmost importance to Us. We follow systematic and stringent procedures to protect the security of the Personal Data stored by Us. The information that Users share is stored in secure servers with encryption and can be accessed only for authorized purposes. All Personal Data is shared on a need-to-know basis only. By undertaking User initiated actions such as checking boxes, submitting forms, registering for an account-based relationship, or using any feature of the Platform, You shall be providing consent to the use of Your Personal Data in terms of this Policy.

Your use or access of the Platform shall confirm Your understanding, acknowledgement and acceptance of this Policy. By using Our Platform, You expressly consent to the Platform’s use of Your Personal Data in accordance with this Policy. If You do not agree with this Policy, You must discontinue using the Platform.

DEFINITIONS AND INTERPRETATIONS

In this Policy, unless the context otherwise requires, words importing the singular shall include the plural and vice versa, references to any gender shall include all genders, headings are for convenience only and shall not affect interpretation, references to clauses shall mean clauses of these Policy unless otherwise specified and any reference to Applicable Laws shall include any amendment, modification or re-enactment thereof and the following expressions shall have the meanings assigned to them below:

“Applicable Law(s)” means all laws, rules, regulations, notifications, circulars, orders, judgments and other binding instruments issued by any governmental, statutory or regulatory authority in India, as may be in force and amended from time to time, that apply to the Company, the Platform, the hosts or the Users;

“Experience(s)” means any activity, service, programme, event or offering listed, made available or facilitated through the Platform and provided by a Host including adventure activities, wellness retreats, cultural and heritage experiences, wildlife and nature experiences, educational programmes, volunteering programmes and any other category of experience introduced from time to time.

“Personal Data” as per Applicable Laws, means any data about an individual who is identifiable by or in relation to such data and generally includes information such as name, contact information, financial identifiers, online identifiers, device information, and any other data classified as Personal Data as per Applicable Laws.

The data collected or received could include Your name, address, signatures, date of birth, copies of identity cards (ID), contact details including electronic mail ID and phone number, address, previous names, maiden names, domicile, origin, citizenship, nationality, residence, passport, any legal or other identifiers like Permanent Account Number (PAN) )/ Aadhaar/ National ID/ Social Security Number/ or its equivalent, photograph and gender, data that identifies (whether directly or indirectly) a particular individual, such as information You provide on any forms, surveys, online applications or

similar online fields, demographic information in aggregated or de-identified form, bank account details, card details, UPI handles, medical health and fitness reports, and any other information to provide Our services to you, information collected when you make or receive payments, data that is collected when You make financial transactions such as amount sent or requested, amount paid for services availed by you, including information about any funding instruments used to complete the transaction, information about visits to the Platform website, website traffic data, location data, weblogs, internet browser, IP address, information collected through tracking technologies, communications with the Platform or any of its representative, any data derived from User data or other sourced data such as behavioural projections, profiling, analytical results, reports (prepared by Us or others) including through any algorithms, analytics, software, automations, log-in IDs, password or PINs in encrypted form, information related to data access, correction, restriction, deletion, porting requests and complaints, CCTV images at Our offices, conversations during meetings / calls/ correspondences with Our staff, behavioural details, browsing actions, patterns and online activity, records of Our communication with You, including electronic mail, telephone conversations, live chat, instant messages and social media communications containing information concerning your grievances, complaints and dispute, any other information or Personal Data that You consent to share.

If you provide Personal Data about someone else (for example, information or data about a spouse or client), or someone provides Personal Data about You, such Personal Data may be used by Us in the manner specified in this Policy. In order to provide Our services securely, enhance customer experience and for purposes of marketing our services, Personal Data about You may be obtained from other sources, who are also bound by confidentiality obligations with Us.

“Traveller” means any natural or legal person who accesses, browses, registers on or otherwise uses GDT Marketplace to discover or book paid Experiences, whether or not they complete a booking.

“User” means any natural or legal person including any Traveller, who accesses, browses, registers on or otherwise uses the Platform, whether or not such person completes a booking or transaction;

APPLICABILITY

This Policy applies to all Users of the Platform, visitors to our website, and customers, service providers, hosts, and other service providers. It also extends to all persons whose data is collected by us, whether directly or indirectly.

This Policy also applies where the Company distributes, refers, integrates, or acts as an agent, reseller or implementation partner in relation to any products or services not directly offered by the Company but made available to You through or in connection with the Platform.

In the event You are using the Platform or Services as an authorised signatory, authorised representative, employee, consultant, director, or other authorised person of a body corporate or non- individual entity, this Policy shall apply to Your Personal Data as well.

Terms and conditions, non-disclosure agreements and any other consents that You may give to or for the benefit of the Company may contain additional privacy-related provisions. This Policy does not limit or supersede any such specific terms or consents

DATA WE COLLECT

We receive Your data through multiple sources, such as when You submit the data to us, make enquiries, or opt for Our services, use the services, transact, engage, use Our Platform, email or call, raise a complaint / grievance, through third parties, from information publicly available and through cookies. The platform collects data for the provision of the services and uses such data to provide the services and in terms of this policy.

We assume that all information provided by You is true, accurate, current, non-misleading, consistent and relevant on the date when it is provided. If any person other than You, submits Your Data to Us, we shall reasonably assume that such person or persons have been authorised by You to submit

such Data to Us, and till further validation or rejection from You, such data shall be processed in terms of this Policy.

USAGE OF DATA

The Company processes Personal Data for purposes reasonably necessary to operate, administer, and improve the services and to manage its relationship with its Users. Such purposes include creating and maintaining User accounts, authenticating identity, providing access to features and functionality, processing payments, communicating service-related information, and providing customer support. Where permitted by Applicable Laws, Personal Data may also be used to communicate information about services, or updates relevant to the User’s engagement with the Company.

We use Personal Data for activities such as the following: (i) to carry out Users instructions (ii) to enable You to use Our website, Platform and online services (iii) to provide additional features of the Platform (iv) to notify changes / additions to Our services, terms and conditions, fees, policies or other information (v) for customer services, including answering questions and responding to feedback and complaints, (vi) to establish contact and manage relationship with You (vii) to improve features and services (viii) to liaise with Our service providers to provide services to Our Users that the User selects to avail (ix) to send offers based on previous services and interests, (x) for surveys and market research of additional services (xi) enabling service delivery (xii) matters incidental, related or necessary to the above. You may control or withdraw access for sharing location through your device settings or application permissions. Disabling such access may however limit or prevent certain features or services from functioning properly. We may share Personal Data with Our subsidiaries / group companies and service providers for the purpose of providing services.

The Platform may share data with selected service providers only to the extent reasonably necessary for them to perform services specifically chosen by Users, while urging such providers to process data in compliance with Applicable Laws. For efficient operations and service delivery, Personal Data may also be shared with trusted third parties, affiliates, and service providers, including subsidiaries, payment gateways/processors, delivery partners, cloud hosting providers, analytics providers, hosts, experience providers, business collaborators, sponsors, and other third parties, solely for the purposes for which the data was collected and in accordance with this policy. Additionally, certain third-party service providers may collect non-personally identifiable information regarding Your interactions with the Platform, its features, and services through cookies and similar technologies to deliver tailored advertisements related to products and services. No personally identifiable information, such as Your name, email address, phone number, physical address, or other personal details, is collected or shared for this purpose. You may prevent such anonymous data sharing at any time by disabling or blocking cookies through Your browser settings, although any information previously collected through existing cookies may continue to be stored by the Platform.

The Platform may also share Your data with third-party selected hosts, for the purpose of arranging and facilitating the services requested by You. By agreeing to this Policy, the User expressly consents to such disclosure of data to the extent necessary for the performance of the requested services and acknowledges that such third parties may process the data to complete the provision of services selected by the User. We do not sell, distribute or lease Personal Data to any third parties. We do not use or disclose Personal Data other than in terms of this Policy.

Personal Data may be transferred to, stored, and processed in jurisdictions outside India by third- party service providers engaged by the Company, including cloud hosting and infrastructure providers; analytics and technology service providers; and payment processors and financial service providers. Such transfers shall be carried out in compliance with the Applicable Laws. By using the Platform and providing Your Personal Data, You consent to such cross-border transfers, subject to Applicable Laws.

Additionally, the Platform may, without Your further consent, disclose data to third parties when We, in good faith, believe that such disclosure is reasonably required (i) by law, (ii) by any statutory, regulatory or judicial body (iii) for any other reason that the User consents to (iv) for complying with the Applicable Laws.

The Company may use automated processing, including algorithms and analytics tools, to personalise user experience, improve recommendations, and optimise Platform functionality. The Company ensures that such processing is conducted in a fair, transparent, and lawful manner in accordance with Applicable Laws. Users may opt out of personalised recommendations through account settings or manage such processing through cookie preferences and consent mechanisms. Such processing may include:

(a) analysis of browsing behaviour, search queries, and interaction patterns; (b) evaluation of past bookings, preferences, and engagement history; (c) ranking or displaying content, hosts, or Experiences based on relevance.

DATA RETENTION

We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required under Applicable Law. Data may be retained for a minimum period of one (1) year from the date of processing unless required for a longer period as per the Applicable Laws. The Personal Data we collect will be securely stored with us or with our service providers for the purposes mentioned above beyond the expiry of transactional or account based relationship with You only if required: (a) to comply with any contractual, legal or regulatory obligations to which we are subject (b) for establishment, exercise or defense of legal claims and dispute resolutions (c) audit, compliance, fraud detection norms, legal or regulatory inquiries, security incident investigation or law enforcement requirements (d) as specified in this Policy (e) in accordance with specific consents.

Notwithstanding the generality of the foregoing, Your Personal Data shall be retained or deleted by the Platform in strict compliance with the Applicable Laws from time to time, with appropriate notice to You in case deletion is statutorily mandated.

DATA SECURITY

The Company has stringent security measures to protect the loss, misuse, unauthorized use and alteration of the information provided by Users to the Platform through physical, technological and organizational safeguards.

If You have questions regarding the security of Your Personal Data, You can contact us at [•].

Unless otherwise necessitated by any specific law or regulation, Your Personal Data is stored in India by the Company in secure servers with encryption. We undertake appropriate measures to control access to our computer resources and periodically review the logs to detect any unauthorized access. The Company also has security measures in place to prevent and report, if necessary, any loss of Personal Data and remediation to prevent recurrence.

While the Company endeavours to maintain robust security standards and continuously review and improve its data protection practices, You acknowledge and agree that no method of electronic transmission, storage, or processing of data over the internet or through digital systems can be guaranteed to be completely secure or error-free.

Accordingly, the Company does not promise absolute security of Personal Data, and Users acknowledge that transmission of information to or through the Platform is undertaken at their own risk, to the extent permitted under Applicable Laws.

In the event of any security breach of Personal Data, the Platform shall intimate the occurrence of such breach individually to each of its affected Users and relevant bodies, without delay, as may be required under Applicable Laws.

Do note that You are responsible for maintaining the confidentiality of Your account’s password and for any access to or use of Your account by any other person who has obtained Your password, whether or not such access or use has been authorized by You. You should immediately notify us of any unauthorized use of Your password or account.

USER RIGHTS

In the event You wish to withdraw Your consent to further processing of Your Personal Data, or raise any grievances pertaining to Your Personal Data, You may do so by following the procedure mentioned in this segment. We may continue to retain certain Personal Data in accordance with the segment on retention of information in this Policy. The withdrawal of consent may also impact the provision of all or certain services being provided to You at the time of such request. You may also nominate another individual to exercise Your User rights as per Applicable Laws from time to time.

To access, correct, update or erase Your Personal Data, You may send an e-mail to [•] from your registered e-mail ID or write via post to our registered office address through a signed letter. After successful verification of Your request, the Company shall promptly, but in no later than 30 business days, give effect to Your request. If You are not satisfied with the result of Your communication with Us even after 90 (ninety) days from the date of Your request, You may write to the Data Protection Board of India (“DPB”) through their dedicated online portal or mobile app, as may be made available by the DPB. Please note that once You have requested for deletion of the data associated with Your account, we will not be able to restore Your account or any of its associated data to You.

If the User is a Foreign National (“Foreign National”), it shall be deemed that the Policy has been read and understood by the User prior to provision of Personal Data to the Platform. If any User provides Personal Data pertaining to a Foreign National, it shall be the responsibility of the User to keep such Foreign National informed of the contents of the Policy and take consent for the processing of such Personal Data in terms of this Policy. By providing Personal Data of such Foreign National to the Platform, it shall be deemed that the User has obtained consent of the Foreign National for their Personal Data to be collected, processed and stored in India in terms of this Policy.

COOKIES

Information about your web-based activity is collected using technology known as cookies, which can often be controlled through internet browsers. The Platform uses cookies to uniquely recognize your device and web browser, as well as to improve the performance and quality of our platform and services. In this Policy, the term ‘cookies’ means small data files that a website transfers to your device when you visit it. We may use both session-based cookies (which are deleted automatically when you close your browser) and certain persistent cookies (which stay on your device until you manually remove them or they expire). You can delete persistent cookies by following the directions provided in your browser’s “Help” section. Please note that if you block or disable cookies, certain features of the Platform might not function correctly or may become unavailable.

THIRD-PARTY LINKS

The Platform may contain links, integrations, references, or access to third-party websites, applications, services, advertisements, or external resources that are owned, operated, or controlled by independent third parties.

Please note that once You access or interact with any such third-party website or service, You will be subject to the privacy policies, terms of use, and data handling practices of those third parties. This Policy does not apply to collection of any data directly by the third-party servers or networks and the Platform does not accept any responsibility or liability of data privacy that these third-party servers or networks may have.

DATA PERTAINING TO MINORS

The Platform is not designed for use by minors, nor does it offer any services to minors. We do not knowingly collect, process or store Personal Data of children as defined under Applicable Laws. Users are advised to ensure that no data relating to minors is submitted to the Platform. We do not take any liability or responsibility for inadvertent submission of data pertaining to minors by Our Users.

GRIEVANCE REDRESSAL & DATA RIGHTS REQUESTS

Any complaint, query or grievance arising in connection with this Policy may be raised through the Platform’s grievance redressal mechanism. The grievance officer appointed shall acknowledge and

address such complaints in accordance with the timelines and procedures specified in the Terms and Conditions or as maybe published/communicated by the Platform.

DATA BREACH NOTIFICATION AND INCIDENT RESPONSE

In the event of any Personal Data breach or cyber security incident affecting Personal Data:

(a) The Company shall notify the Indian Computer Emergency Response Team (CERT-In) of such incident within 6 hours of becoming aware of the same, in accordance with applicable directions issued by CERT-In. (b) The Company shall notify affected Users without undue delay, typically within seventy two hours of becoming aware of the breach. (c) The Company may communicate such notifications via email, SMS, in-app notification, or public notice, depending on the nature and severity of the incident. (d) The Company shall take immediate remedial measures to contain, investigate, and mitigate the impact of the breach, and to prevent recurrence.

INDEMNITY

You agree to indemnify, defend, and hold harmless the Company from and against any claims, losses, damages, liabilities, and expenses arising out of or in connection with Your breach of this Policy, misuse of the Platform, or violation of any Applicable Laws.

GOVERNING LAW & JURISDICTION

This Policy, including its interpretation, validity, enforcement, and any matters arising out of or in connection with processing of Personal Data under this Policy, shall be governed by and construed in accordance with the laws of India.

Nothing contained herein shall limit the right of the Company to seek injunctive relief, interim relief, or other appropriate remedies where such action may be necessary to protect its rights, interests, intellectual property, confidential information, or compliance obligations.

MISCELLENOUS

In the event of a merger, acquisition, restructuring, or sale of assets, Personal Data may be transferred as part of such transaction. Such transfers shall be undertaken in accordance with Applicable Laws and subject to appropriate safeguards to ensure continued protection of Personal Data. The Company may assign, transfer, novate, or otherwise delegate its rights and obligations under Policy in accordance with Applicable Laws. Users may not assign any of their rights or obligations under this Policy without prior written consent of the Company.

The Company shall not be held liable for any unauthorized access, data breach, loss, or misuse of information that occurs due to factors beyond its reasonable control, including but not limited to cyber- attacks, system vulnerabilities, force majeure events, actions of third parties, or User negligence, provided that the Company has implemented reasonable security measures as required under Applicable Laws.

You acknowledge that that the Policy shall supersede any and all prior or bilateral arrangements, understandings, or non-disclosure agreements between You and the Company to the extent they relate to the handling, usage, or protection of Your data.

If any provision of this Policy is held to be invalid, unlawful, unenforceable, or contrary to Applicable Laws by any competent authority or court of law, such provision shall be severed from this Policy and the remaining provisions shall continue to remain valid and enforceable to the fullest extent permitted under Applicable Laws.

Any provisions of this Policy which by their nature are intended to survive termination of the User’s relationship with the Company, including provisions relating to retention, liability, indemnity, dispute resolution, and compliance obligations, shall survive such termination as per the Applicable Laws.

Except as expressly provided under Applicable Laws, nothing contained in this Policy shall be construed to confer any rights or remedies upon any person or entity other than the User and the Company.

You represent and warrant that the information and Personal Data provided by You is accurate, lawful, and submitted with all necessary rights and consents. You further agree to use the Platform only in compliance with Applicable Laws and not to upload or transmit any unlawful or harmful content. The Company will handle Your Personal Data as per this Policy and Applicable Laws. However, the Platform and services are provided without any warranties.

No failure or delay by the Us in exercising any right, power, or remedy under this Policy shall operate as a waiver thereof, nor shall any single or partial exercise of any such right preclude any further exercise of that or any other right.

This Policy may be made available in multiple languages for User convenience. In the event of any inconsistency or conflict between the English version and any translated version, the English version shall prevail to the extent permitted under Applicable Laws.

UPDATES TO THE POLICY

Our Policy may contain relevant updates from time to time, including necessary version changes. Users are advised to read the Policy periodically. By continuing to use Our services, You shall be accepting changes to the Policy, if any.

If we make any material changes to this Policy, we will post the changes here and may notify You whenever required, by law. Your continued use of the services following the posting of changes to this Policy will constitute Your consent and acceptance of those changes.