Legal
How Mantlex Private Limited (Far Finds) collects, uses, shares and protects your personal data, and the rights you have over it.
Version 1.2 · Effective 30 September 2026
This summary is provided for convenience only. The full Policy below applies.
| Data Fiduciary | Mantlex Private Limited (Far Finds), under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”). You are the “Data Principal”. |
|---|---|
| Data we collect | What is needed to sign in, enquire, book and travel: name, contact details, date of birth, PAN and, for Trips outside India, passport details. Health and dietary information only if you choose to provide it. |
| Purposes | To answer enquiries, book and run your Trip, take payment, meet our tax obligations and assist you in an emergency. Marketing only with your consent. |
| Recipients | The Local Partner operating your Trip and its suppliers (often outside India), and the service providers that run our website, payments, email and messaging. |
| Passport details | Encrypted, opened only for your Trip with every access logged, and erased 90 days after the Trip ends. |
| Sale of data | We do not sell personal data. |
| Your rights | To access, correct, update and erase your data, to withdraw consent, and to complain to our Grievance Officer and then to the Data Protection Board of India. |
1.1 This Privacy Policy explains how Mantlex Private Limited, trading as Far Finds (CIN U46909KA2026PTC228700, registered office Aspire-Coworks, No. 39/7-1, 3rd Floor, 7th Main Road, Opposite Dr. Ambedkar College Ground, Appareddy Palya, Indiranagar, Bengaluru – 560038, Karnataka) (“we”, “us”), collects and uses personal data through farfinds.co, our booking and enquiry pages, WhatsApp, email and phone.
1.2 We are the Data Fiduciary for the personal data described here. Questions and requests go to our Data Protection Officer and Grievance Officer (section 15).
1.3 This notice is available in English. You may ask us for it in any language in the Eighth Schedule to the Constitution of India, and we will provide it.
2.1 “Personal data”, “Data Principal”, “Data Fiduciary”, “Data Processor”, “Consent Manager” and “Board” have the meanings given in the DPDP Act.
2.2 “Traveller Details” means a traveller's full name as in the passport, date of birth, nationality, passport number, issue and expiry dates, and whether the traveller is under 18 on the departure date.
2.3 “Local Partner” means the destination management company that runs a trip on the ground, as described in our Terms and Conditions.
| Category | Examples | When collected |
|---|---|---|
| Account | Name, email address and profile photo from your Google account; mobile number if you sign in by code | When you sign in |
| Contact and profile | Phone, city, date of birth, how and when you would like us to contact you | When you fill in your details or send an enquiry |
| Enquiry and booking | Trip, dates, travellers, rooms, add-ons, notes and special requests | When you enquire or book |
| Traveller Details | As defined in section 2.2, for each traveller | Before a trip outside India |
| Tax | PAN of the person paying | When you book a trip outside India (TCS) |
| Payment | Amount, date, payment reference and status. Card and bank details are handled by our payment provider; we never see or store them | When you pay |
| Health and needs (optional) | Medical conditions, allergies, dietary needs, mobility or access needs, emergency contact | Only if you tell us, for your safety on the trip |
| Consent records | The document and version you agreed to, the exact words, time, IP address, device and browser | Each time you agree to our Terms or this Policy |
| Messages | WhatsApp, email, call notes and enquiry forms | When you contact us |
| Website use | Pages viewed, device, browser, approximate location from your IP address, how you arrived | When you use our website (section 9) |
We do not collect Aadhaar numbers. Please do not send yours.
3.1 Signing in with Google. If you choose “Continue with Google”, Google shares with us only your name, email address and profile photo. We do not ask for, and cannot see, your Gmail, contacts, calendar, Drive or any other Google data. We use these three details only to create and run your Far Finds account and to contact you about your enquiries and trips. We store them with your account (section 7.3), keep them as section 10 describes, share them only as section 7 describes, never sell them and never use them for advertising. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Far Finds' access at any time at myaccount.google.com/permissions, and ask us to erase your account data (section 12).
| Purpose | Data used | Basis under the DPDP Act |
|---|---|---|
| Create and run your account | Account, contact | Your consent (s.6) |
| Answer your enquiry, plan your trip and send your plan and price | Account, contact, enquiry, messages | Your consent (s.6); data you provided for this purpose (s.7(a)) |
| Take and manage your booking, send confirmations, reminders and documents | Account, contact, booking, payment | Your consent (s.6); data you provided for this purpose (s.7(a)) |
| Run your trip: hotels, transport, guides, permits, visa letters | Traveller Details, booking, health and needs | Your consent (s.6) |
| Collect and report TCS and GST; keep accounts | PAN, booking, payment | Compliance with law (s.7) |
| Prove what you agreed to and when | Consent records | Compliance with law; defending legal claims (s.7) |
| Help in a medical emergency or disaster during a trip | Traveller Details, health and needs, emergency contact | Medical emergency and disaster (s.7(f), (g)) |
| Understand how the website is used, to improve it | Website use | As described in section 9 |
| Send news of new trips | Email, phone | Your consent only, which you can withdraw at any time |
We use personal data only for the purposes above. If we want to use it for a new purpose, we will ask you first.
5.1 Our website and accounts are intended for adults. Only a person aged 18 or over may create an account, send an enquiry or make a booking.
5.2 A child under 18 may travel on a booking made by a parent or lawful guardian. By giving us a child's Traveller Details, the parent or guardian gives verifiable consent on the child's behalf, and we may ask for confirmation of that relationship.
5.3 We do not track, monitor the behaviour of, or target advertising at children.
6.1 Traveller Details are collected only for trips outside India, where hotels, airlines, border authorities and permit offices require them.
6.2 They are encrypted when stored, using a key held separately from the database. They are opened only to book and run your trip, and every opening is recorded with who opened them, when and why.
6.3 They are shared only with the Local Partner and suppliers who need them for your trip, and with authorities where the law requires.
6.4 They are erased 90 days after your trip ends, unless we need to keep them longer to deal with an incident, a complaint or a legal claim about that trip, in which case we keep them only until it is resolved.
6.5 If you give us Traveller Details for other people, you confirm that they have agreed.
7.1 We never sell your personal data.
7.2 Local Partners and suppliers. To run your trip we share the details each one needs (usually names, Traveller Details, room and dietary needs) with the Local Partner in your destination and the hotels, transport companies, guides and permit offices it uses. They use the data to provide your trip and are responsible for it under the laws of their own country.
7.3 Our Data Processors. These companies process data on our behalf, under contract, only on our instructions:
| Company | What for | Where the data is held |
|---|---|---|
| Supabase | Database and sign-in | India (Mumbai) |
| Vercel | Website hosting | India (Mumbai), with a worldwide delivery network |
| Sign-in with Google; website analytics (section 9) | Worldwide | |
| Meta (WhatsApp) | Messages and sign-in codes | Worldwide |
| Cashfree | Payments and refunds | India |
| Zoho Books | Invoices, receipts and accounts | India |
| Resend | Booking emails | United States |
7.4 Authorities. We disclose personal data to government, tax, law enforcement or regulatory authorities, or courts, where the law requires it.
7.5 Business transfers. If our business is merged or sold, personal data may pass to the new owner, who must continue to protect it as this Policy describes.
Most of our trips take place outside India, so we must send Traveller Details and booking details to Local Partners and suppliers in the country you are visiting. Some of our Data Processors also store data outside India. We do so as section 16 of the DPDP Act allows, and we will not transfer personal data to any country the Central Government restricts.
9.1 Essential cookies. Our website uses cookies and similar browser storage that are needed for it to work, such as keeping you signed in and remembering a trip you are planning. These cannot be switched off.
9.2 Google Analytics. We use Google Analytics, a web analytics service provided by Google LLC, to understand how visitors use our website so we can improve it. Google Analytics uses cookies (small text files stored in your browser) and similar identifiers to collect information such as the pages you visit, how long you stay, the website that referred you, your device and browser type, and your approximate location. Your IP address is used to estimate your location and is not stored by Google Analytics.
9.3 How Google uses this data. This information is sent to and processed by Google, including on servers outside India. We see it only as totals and reports; we do not use it to identify you, and we have not turned on Google Analytics' advertising features. You can read how Google uses information from websites that use its services at policies.google.com/technologies/partner-sites, and Google's own privacy policy at policies.google.com/privacy.
9.4 Opting out. You can stop Google Analytics collecting data about your visits by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout. You can also block or delete cookies in your browser's settings; our website will still work, though you may need to sign in again.
| Data | How long |
|---|---|
| Traveller Details (passports) | 90 days after the trip ends (section 6.4) |
| Bookings, payments, refunds, invoices and consent records | 8 years after the trip ends or the booking is cancelled, as required by the Companies Act, 2013 and tax laws |
| Account and profile | While your account is open. When you close it, we erase your profile and keep only what the law requires above, linked to an anonymous reference |
| Health and needs | Until the trip ends, then erased with the Traveller Details |
| Enquiries and messages that did not lead to a booking | 3 years after our last contact |
| Website analytics | No more than 14 months |
| Marketing list | Until you unsubscribe |
When a retention period ends, or the purpose is no longer served, we erase the data, and ask our Data Processors to do the same, unless the law requires us to keep it.
11.1 We take reasonable security safeguards, including encryption of Traveller Details, access limited to people who need it, access logs, encrypted connections (HTTPS), and databases held in India.
11.2 In the event of a personal data breach, we will inform the Board and each affected person as the DPDP Act and the rules under it require, explaining what happened, the likely consequences and what we are doing about it.
Under the DPDP Act you have the right to:
12.1 Access: a summary of your personal data we hold, what we do with it, and who we have shared it with (s.11).
12.2 Correct, complete, update and erase: your personal data (s.12). You can correct most details yourself in your account. We will erase data on request unless we must keep it by law (section 10).
12.3 Withdraw consent: at any time, as easily as you gave it (s.6(4)). This does not affect anything done before you withdraw. If you withdraw consent needed for a booking, we may not be able to run that trip, and our Terms and Conditions on cancellation apply.
12.4 Grievance redressal: complain to our Grievance Officer (section 15), and if you are not satisfied, to the Data Protection Board of India (s.13).
12.5 Nominate: another person to exercise your rights if you die or become unable to (s.14).
To use any right, write to contact@farfinds.co from the email address on your account. We may need to confirm your identity. We will reply within 1 (one) month.
Your duties. The DPDP Act also asks you to give us accurate information, not to impersonate anyone, and not to file false or frivolous complaints (s.15).
13.1 Where we rely on consent, we ask for it in plain words, by an unticked box or a clearly labelled button (for example, “Send” on an enquiry, beside a link to this Policy), and we record it (section 3, “Consent records”).
13.2 You may give, manage or withdraw consent directly with us or through a Consent Manager registered with the Board.
14.1 We send messages about your enquiry or booking (replies, plans, confirmations, payment reminders, trip documents and changes) by email, WhatsApp and SMS. These are part of the service.
14.2 We send news of trips and offers only if you have agreed. Every marketing email has an unsubscribe link, and you can reply STOP to WhatsApp or SMS messages. We respect the National Customer Preference Register (Do Not Disturb).
M. Sadhana, Data Protection Officer and Grievance Officer, Mantlex Private Limited, Aspire-Coworks, No. 39/7-1, 3rd Floor, 7th Main Road, Opposite Dr. Ambedkar College Ground, Appareddy Palya, Indiranagar, Bengaluru – 560038, Karnataka. Email: contact@farfinds.co. Phone: +91 81169 09153.
We will acknowledge a grievance within 48 (forty-eight) hours and resolve it within 1 (one) month. If you are not satisfied, you may complain to the Data Protection Board of India.
We may update this Privacy Policy at any time. The latest version will always be published on this website with its effective date. We will tell you about material changes by email or by a notice on this website where appropriate. Your continued use of our website or services after an update takes effect indicates your acceptance of the revised Policy. Where the law requires your fresh consent to a change, we will ask for it.