Privacy Policy

1. Who we are

Elkanio Research Labs LLP ("Elkanio", "we") builds and operates the Elkanio travel technology platform. Our registered office is First Floor, Thrive Space, Seaport-Airport Road, Opp. Kakkanad Water Metro, Kakkanad, Cochin 682037, Kerala, India. For anything in this policy, write to hello@elkanio.com or call +91 94007 47484.

This policy covers two situations: your use of this website (elkanio.com), where Elkanio decides how data is used and is the controller; and the Elkanio platform products (Nucleus, Nova, Orbit, Cluster, Synapse, NDC, Nexus, Compass, Vector, Cortex, Quantum and Pulse), where our customers decide how traveller data is used and Elkanio acts as their processor under a written agreement.

2. Data we collect on this website

• Enquiry and demo forms. Name, company, work email, phone, the topic you choose, your message and, on the event page, what you sell and the code printed on the material you scanned. We use this to answer you and arrange the demo you asked for.
• Direct contact. If you email, call or message us on WhatsApp, we keep the conversation to handle your request. WhatsApp is operated by Meta Platforms under its own privacy terms.
• Analytics. With your consent, Google Analytics 4 collects pages viewed, approximate location derived from a truncated IP address, device and browser type, and interactions such as demo requests. Nothing is stored on your device until you accept the cookie banner. See the Cookie Policy.
• Technical logs. Our hosting provider records requests (IP address, time, page, user agent) for security and to keep the site running. Logs are kept for a short period and not used to identify visitors.

We do not buy data about visitors, and we do not use advertising cookies or sell personal data.

3. Why we use it and on what legal basis

• To respond to you and take steps towards a contract (GDPR Article 6(1)(b); DPDP Act consent or legitimate use for a request you initiated).
• To run and secure the website, our legitimate interest (GDPR Article 6(1)(f)).
• Analytics, only with your consent (GDPR Article 6(1)(a); ePrivacy rules; DPDP Act consent). You can withdraw consent at any time from the Cookie Policy page.
• To keep records required by law, such as tax and company records.

4. Data we process for our customers

When a travel business uses Elkanio products, the platform processes the data its bookings require: traveller names and contact details, passport and visa data where a booking needs them, itineraries and PNRs, preferences such as meals and seats, loyalty balances, and payment status. Card data is handled by PCI-DSS compliant third-party payment gateways and tokenised; Elkanio does not store card numbers.

In this role we act only on the customer's documented instructions, under a data processing agreement that covers confidentiality, security, sub-processors, assistance with data-subject requests, deletion at the end of the contract and audits. Travellers should contact the travel business they booked with to exercise their rights; we will assist that business promptly.

5. Where data is hosted and how it moves

The platform runs in cloud regions in India, Singapore, EU, Dubai. Customer data is stored in the region agreed in the customer's contract and stays there; EU customer data remains within the European Union and Indian customer data within India. Where a transfer outside the storage region is needed, for example to reach an airline or hotel system located elsewhere in order to complete a booking, it is made to fulfil the traveller's booking and is protected by contractual safeguards, including the European Commission's Standard Contractual Clauses where EU data is involved.

Website form and analytics data may be processed by our service providers in India, the European Union and the United States under the same safeguards.

6. Who we share data with

• Service providers working under contract: cloud infrastructure, form handling (Static Forms, which receives website form submissions and emails them to us), email delivery, messaging (email, SMS and WhatsApp Business), payment gateways, and Google Analytics. Each may only process data for the purpose we set.
• Travel suppliers such as airlines, hotels, insurers and operators, as needed to complete bookings made through the platform.
• Authorities where the law requires it.

We do not sell personal data and do not share it for third-party advertising.

7. How long we keep it

• Website enquiries: up to 24 months after our last contact, unless you become a customer, in which case they form part of the customer record.
• Analytics: Google Analytics event data is retained for 14 months and reported in aggregate.
• Platform data: for the period set in the customer's contract and required by booking, tax and aviation regulations, then deleted or anonymised.

8. Security

Data is encrypted in transit and at rest. Access is limited by role and logged. Environments are separated, backups are taken with point-in-time recovery, and changes to supplier mappings made by the platform's supervised agents are recorded in an audit log with rollback. We notify affected customers of a personal data breach without undue delay so they can meet their own obligations.

9. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to processing, to receive a copy in a portable format, to withdraw consent, and to complain to a supervisory authority. Under India's Digital Personal Data Protection Act 2023 you may also nominate another person to exercise your rights and raise a grievance with us. If you are a California resident you have equivalent rights under the CCPA; we do not sell or share personal information as defined there.

To exercise any right, or to reach our grievance officer, email hello@elkanio.com with "Privacy request" in the subject. We respond within the time the applicable law allows and will ask for enough information to confirm your identity.

10. Children

This website is for businesses and is not directed at children. Traveller data relating to minors is processed on the platform only as part of bookings made by adults on their behalf.

11. Changes

We will post any change to this policy on this page with a new effective date. Material changes affecting platform customers are also notified under the contract.