Who handles your information
This notice covers the Aurora Travels website. Aurora is the business deciding how travel enquiries are used; WebRoute Assam provides website development and hosting support. Aurora’s contact is Hrishikesh Medhi, at Fatashil, G.S. Colony, Near Durga Mandir, Guwahati, Assam; auroraworld2015@gmail.com; +91 98546 29761.
Before launch: confirm the legal owner/entity, designated privacy/grievance contact and response procedure. Hrishikesh is the established business contact; this draft does not claim a formal Data Protection Officer appointment.
Information you choose to share
The enquiry form asks for name, email and destination. Phone number, preferred travel date, group size, journey name and message are optional. We use these details to understand your request, respond and discuss a quotation. Optional cookie choices are separate from your enquiry. This website has no newsletter sign-up or marketing-consent programme enabled.
Do not put passport/Aadhaar copies, payment-card details, passwords, medical records or children’s personal details in the message. If booking documents are later needed, Aurora must explain the purpose and arrange an appropriate collection method first.
How the current enquiry flow works
The visible form currently prepares a draft in your own email application. Information remains in the page while you fill it in; the page does not send an enquiry automatically or save form contents to browser storage. Review and send the draft yourself. Once you send it, your email provider and Aurora’s Gmail mailbox process the message.
A server-mail endpoint has also been prepared and tested, but direct sending is not connected to the visible form. It can process the listed enquiry fields for delivery to Aurora, uses a security session and short-lived abuse-control records, and does not intentionally save message bodies in an enquiry database. It must not be activated in the visitor form until delivery, privacy notice and operational arrangements are approved. Hosting and mail-system logs may still contain technical metadata.
Browser storage and technical data
Our consent component stores your choice, notice version and time in this browser for up to 180 days. If you allow preferences, a session-only theme selection may also be stored. No analytics, advertising pixels, embedded maps or third-party fonts are installed by this release. Images and fonts load from this website.
The hosting service can process technical request data such as IP address, browser information, requested address and timestamps for operating and protecting the service. Exact provider log and backup retention periods remain to be confirmed. See the storage inventory for details.
Access, providers and external links
Aurora’s authorised team handles enquiries. WebRoute Assam may access website systems when providing authorised support; it does not need unrestricted access to Aurora’s personal Gmail account. Hosting, backup and email providers process information used by their services. Provider identities, contracts, access permissions and processing locations must be checked before launch.
WhatsApp links include a draft based on the page or tour, its route/duration where available, and the page address. They do not automatically copy your form name, email, phone or message. Nothing is sent as a WhatsApp message until you choose to send it. Opening WhatsApp or Maps also exposes request information to that service. This draft does not promise that all processing stays in India; the supplied hosting information identifies India hosting and Singapore backups, while mail and external services may process elsewhere.
Retention and security
There is no approved fixed retention period for enquiry emails or booking records yet. Aurora must approve a schedule covering its mailbox, any exported records, provider logs and backups, with applicable legal retention exceptions. Browser-choice expiry is not deletion of emails or provider logs. The endpoint’s hashed abuse-control metadata is a separate, short-lived technical record.
HTTPS, restricted deployment directories, validation, session protections and rate limits are implemented for the prepared endpoint. These controls do not guarantee absolute security or establish that all organisational duties are complete. Suspected exposure should be reported to Aurora immediately so the relevant team can investigate and apply required notification procedures.
Your requests and choices
You can ask Aurora about information it holds, request correction or deletion, withdraw consent for the relevant use, or raise a privacy complaint. Use the data request instructions. We may need proportionate verification to avoid disclosing another person’s information. Do not send identity-document scans with an initial request. Necessary legal retention may limit deletion.
You can change optional storage choices at any time through . Turning off browser preferences stops that optional storage; it does not withdraw an enquiry already sent. Contact Aurora to address enquiry processing. Statutory rights and escalation routes apply according to the law in force; the final grievance procedure and response timeframe need approval before launch.
Children and later changes
The general enquiry form is intended for adults aged 18 or over. A parent or guardian should contact Aurora about family travel without putting a child’s personal details in this form. An age acknowledgement is not a verified parental-consent system. No child tracking or targeted-advertising integration is installed. A dedicated, verified process must be established before any service starts collecting children’s personal data.
This review draft was prepared with reference to India’s Digital Personal Data Protection Act, 2023 and notified rules. Commencement is phased. It is not a certification of compliance. Recheck the notice and obtain review when the final business process, providers, tracking or legal requirements change.