Privacy Policy

GC Overseas ("we", "us", "our") is an air-ticket consolidator and travel agent — an intermediary that books airline seat blocks, not a carrier. We handle your personal data under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000. This notice explains what we collect, why, and the rights you hold as a Data Principal. Questions: info@gcoverseas.com.

1. Personal data we collect and why

We collect only what a specific purpose requires (purpose limitation) and use it only for that stated purpose.

Data category	What it includes	Purpose	Retention
Account data	Name, email, phone, password (stored only as a salted hash)	Create and secure your account; support	Life of account + up to 12 months
Passenger data	Passenger names and, where a fare requires it, passport number, date of birth, nationality	Issue tickets and pass details to the operating airline	Duration of trip; then per financial-record rule below
Payment data	Amounts, invoice/GST records, transaction references (card/UPI details are handled by our processor, not stored by us)	Collect payment; issue tax invoices	72 months (6 years) — GST/tax law
Usage & technical data	IP address, device/browser type, security audit logs	Fraud prevention; protect seat inventory; security	Up to 12 months
KYC data (business partners)	Company documents you upload for verification	Statutory compliance checks	As long as the partner relationship, then per law

2. Legal basis and withdrawing consent

Our processing rests on your consent, and on certain legitimate uses the DPDP Act permits (such as meeting a legal obligation). You may withdraw consent at any time by emailing info@gcoverseas.com. Withdrawal is as easy as giving consent and does not affect processing already done; where a ticket is in progress or the law requires retention, some processing may lawfully continue.

3. How we share data

• Operating airlines and GDS/consolidator systems — to issue and manage your ticket.
• Payment processors — to collect payment securely.
• Regulators, tax authorities and law enforcement — only where the law requires it or a valid legal request is received.

We do not sell your personal data, and we do not share it for third-party advertising.

4. Retention

Financial and GST records are kept for 72 months (6 years), as required by Indian tax law. All other personal data is kept only as long as needed for the purpose it was collected, then deleted or anonymised. You may request deletion of data we are not legally required to keep.

5. Your rights as a Data Principal

Under the DPDP Act you may:

1. Access a summary of the personal data we process about you.
2. Correct, complete or update inaccurate data.
3. Erase data no longer needed for its purpose.
4. Grievance redressal — a prompt response from our Grievance Officer.
5. Nominate another individual to exercise these rights on your behalf in the event of death or incapacity (right to nominate).

To exercise any right, contact info@gcoverseas.com from your registered email.

6. Children's data

We do not knowingly process a child's (under-18) data without verifiable parental or guardian consent. We do not carry out behavioural monitoring or targeted advertising directed at children.

7. Security safeguards

We protect data with encryption in transit and at rest, role-based access controls, malware scanning of uploads, and audit logging. No system is perfectly secure, but we apply reasonable safeguards as required by the DPDP Act and IT Act.

8. Personal data breach

If a personal-data breach occurs, we will act to contain it and notify the Data Protection Board of India and affected Data Principals in the manner and timelines prescribed under the DPDP Act.

9. Cross-border transfers

Data is processed in India. If any transfer outside India is needed to fulfil a booking, it is limited to that purpose and made only to destinations permitted under the DPDP Act.

10. Cookies

We use only cookies necessary to keep you securely signed in (HttpOnly session cookies). We run no third-party advertising or tracking cookies. If analytics cookies are ever introduced, this notice will be updated and consent requested first.

11. Grievance contact and escalation

Grievance Officer: [Grievance Officer name], GC Overseas Email: info@gcoverseas.com · Phone: [phone] Registered office: [Registered office address], [City], India

We acknowledge complaints promptly and resolve them within the timelines the law prescribes. If you are not satisfied with our response, you may escalate to the Data Protection Board of India. Consumer grievances may also be raised via the National Consumer Helpline at consumerhelpline.gov.in. Aviation-specific issues fall under the DGCA.