1. Introduction and Scope

1.1 This Privacy Policy ("Policy") describes how Hydra Travels Inc., operating the hotel booking platform Instareservation.com ("Instareservation", "the Platform", "we", "us", or "our"), collects, uses, discloses, retains, and protects personal information obtained through the website, mobile applications, application programming interfaces, and any related services (collectively, the "Services").

1.2 This Policy applies to travellers, guests, registered users, hotel partners, corporate account holders, and any other individual who accesses or uses the Services (each, a "User" or "you").

1.3 By accessing or using the Services, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal information as described in this Policy. If you do not agree with any part of this Policy, you must discontinue use of the Services.

1.4 This Policy forms an integral part of, and must be read together with, the Terms and Conditions governing use of the Platform. In the event of any conflict between this Policy and the Terms and Conditions on matters of data handling, this Policy shall prevail.

1.5 This Policy does not apply to information collected by any hotel, property owner, airline, car rental provider, payment processor, or other third party through their own websites, applications, or systems, even where such third party is accessed through a link on the Platform.

2. Definitions

2.1 "Personal Information" means any information that identifies, relates to, describes, or is reasonably capable of being associated with, a particular individual, directly or indirectly.

2.2 "Sensitive Personal Information" means Personal Information revealing government identification numbers, payment card details, financial account information, precise geolocation, or biometric identifiers.

2.3 "Processing" means any operation performed on Personal Information, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure, or destruction.

2.4 "Hotel Partner" means any accommodation provider, property manager, or hospitality entity listed for booking on the Platform.

2.5 "Cookies" means small data files placed on a User's device that enable the Platform to recognise the device across sessions.

3. Information We Collect

3.1 We collect Personal Information directly from Users, automatically through use of the Services, and from third parties, as summarised below.

3.2 We do not knowingly collect government identification numbers or payment card numbers in unmasked form on our own servers; such data is captured and tokenised directly by our PCI-DSS compliant payment processing partners.

3.3 Where a User makes a booking for other guests, the User warrants that they have obtained the necessary consent from each such guest to share their Personal Information with the Platform and the relevant Hotel Partner.

3.4 We collect Personal Information through the following channels.

• (a) Direct interactions, including account registration, completion of a Booking, submission of a support enquiry, or participation in a survey or promotion.
• (b) Automated interactions, including Cookies, server logs, and software development kits embedded in the mobile application.
• (c) Third-party sources, including social login providers, travel agents, corporate travel platforms, and publicly available sources used for fraud screening.

3.5 Where a User declines to provide certain mandatory Personal Information, we may be unable to process a Booking or provide the corresponding feature of the Services.

4. How We Use Personal Information

4.1 We Process Personal Information for the following purposes and on the following legal bases.

4.2 We will not use Sensitive Personal Information for marketing purposes under any circumstances.

4.3 Where Processing is based on consent, you may withdraw such consent at any time in the manner described in Section 14, without affecting the lawfulness of Processing carried out prior to withdrawal.

4.4 We may combine information collected across the categories described in Section 3 to build a consolidated view of a User's Account for the purposes described in this Section, including to personalise search results and to detect patterns indicative of fraud.

4.5 We do not use Personal Information for any purpose materially different from those described in this Section without providing prior notice and, where required, obtaining consent.

5. Cookies and Tracking Technologies

5.1 The Platform uses Cookies, web beacons, pixel tags, and similar technologies for the purposes described below.

• (a) Strictly Necessary Cookies, required for core functions such as maintaining a booking session and enabling secure login.
• (b) Performance Cookies, used to analyse Platform usage and diagnose technical issues.
• (c) Functionality Cookies, used to remember User preferences such as language and currency.
• (d) Advertising Cookies, used to deliver targeted advertisements on the Platform and third-party sites, subject to consent.

5.2 Users may manage Cookie preferences through the consent banner presented on first visit and through browser settings. Disabling certain Cookies may impair core functionality, including the ability to complete a booking.

5.3 We use third-party analytics providers, including web analytics and advertising network partners, who may set their own Cookies subject to their respective privacy policies.

6. Disclosure of Information to Third Parties

6.1 We disclose Personal Information to the categories of recipients described below, strictly for the purposes stated.

6.2 We require all third-party recipients to protect Personal Information under contractual obligations consistent with this Policy and to use it only for the purposes for which it was disclosed.

6.3 We do not sell Personal Information to third parties for monetary consideration. Where applicable law defines "sale" or "sharing" to include certain advertising-related disclosures, Users may opt out as described in Section 14.

6.4 We may disclose Personal Information where necessary to protect the rights, property, or safety of Hydra Travels Inc., a Hotel Partner, another User, or the public, including in connection with suspected fraud, security incidents, or threats to personal safety.

6.5 Any disclosure made in response to a governmental or law enforcement request will be limited to what is legally required, and we will, where legally permitted, notify the affected User of such request.

7. Sharing of Information with Hotel Partners

7.1 Upon confirmation of a booking, we transmit the guest name, contact details, stay dates, room preferences, and any special requests to the relevant Hotel Partner to enable fulfilment of the reservation.

7.2 Hotel Partners act as independent data controllers in respect of Personal Information received for stay fulfilment, including for statutory guest registration requirements. Hotel Partners' own privacy practices govern their subsequent use of such information, and Users are encouraged to review the relevant Hotel Partner's privacy policy.

7.3 We are not responsible for the data handling practices of Hotel Partners once Personal Information has been lawfully transmitted for booking fulfilment, except to the extent required by applicable law.

8. International Data Transfers

8.1 As the Platform facilitates bookings across multiple jurisdictions, Personal Information may be transferred to, stored, and Processed in countries other than the User's country of residence, including countries that may not offer an equivalent level of data protection.

8.2 Where such transfers occur, we implement appropriate safeguards, including standard contractual clauses, data processing agreements, and technical security measures, to protect Personal Information consistent with this Policy.

8.3 By using the Services, you acknowledge and consent to the transfer of your Personal Information outside your country of residence for the purposes described in this Policy.

9. Data Retention

9.1 We retain Personal Information only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law, whichever is longer.

9.2 Upon expiry of the applicable retention period, Personal Information is securely deleted, anonymised, or aggregated such that it no longer identifies an individual.

9.3 Retention periods are determined with reference to the following factors.

• (a) The nature and sensitivity of the Personal Information concerned.
• (b) The purpose for which the Personal Information was collected and whether that purpose can be achieved through other means.
• (c) Applicable statutory limitation periods for the bringing of legal claims.
• (d) Mandatory record-keeping obligations under tax, accounting, and hospitality regulation.

9.4 Backup copies of Personal Information may persist for a limited period following deletion from primary systems, due to the technical architecture of backup retention cycles, and are not used for any active Processing purpose.

10. Data Security

10.1 We implement administrative, technical, and physical safeguards designed to protect Personal Information against unauthorised access, alteration, disclosure, or destruction, including the following measures.

• Encryption of data in transit using industry-standard protocols and encryption of payment data at rest.
• Role-based access controls restricting Personal Information to personnel with a legitimate operational need.
• Regular security assessments, vulnerability scanning, and penetration testing.
• Multi-factor authentication for administrative and privileged access to Platform systems.
• Maintenance of incident response procedures for suspected data breaches.

10.2 No method of electronic storage or transmission is completely secure. While we take commercially reasonable steps to protect Personal Information, we cannot guarantee absolute security.

10.3 In the event of a data breach affecting Personal Information, we will notify affected Users and relevant regulatory authorities without undue delay, in accordance with applicable law.

10.4 Users share responsibility for the security of their Personal Information and should adopt reasonable precautions, including the following.

• (a) Using a strong, unique password for their Account and enabling multi-factor authentication where available.
• (b) Not sharing Account credentials with any third party.
• (c) Logging out of the Platform when using a shared or public device.
• (d) Promptly reporting any suspected compromise of their Account through the channels described in Section 37.

11. User Rights

11.1 Subject to applicable law, Users may exercise the following rights in respect of their Personal Information.

11.2 Requests to exercise these rights may be submitted through the contact details in Section 37. We will verify the identity of the requester before acting on any request and will respond within the period prescribed by applicable law, and in any event within thirty (30) days.

11.3 We may decline a request, in whole or in part, where permitted by law, including where the request is manifestly unfounded, excessive, or would adversely affect the rights of another individual.

12. Children's Privacy

12.1 The Services are not directed to individuals under the age of eighteen (18). We do not knowingly collect Personal Information from minors.

12.2 Where a booking includes minors travelling with a parent or legal guardian, the booking User is solely responsible for providing any required information on the minor's behalf and for obtaining appropriate consent.

12.3 If we become aware that we have inadvertently collected Personal Information from a minor without appropriate consent, we will take steps to delete such information promptly.

13. Payment Information and PCI-DSS Compliance

13.1 All online payment transactions are processed through third-party payment gateways that are certified compliant with the Payment Card Industry Data Security Standard (PCI-DSS).

13.2 We do not store complete, unmasked payment card numbers, card verification values, or PIN data on our own servers.

13.3 Users are responsible for ensuring the accuracy of payment information provided and for the security of their own payment devices and credentials.

14. Marketing Communications and Opt-Out

14.1 With appropriate consent or as otherwise permitted by law, we may send Users promotional emails, SMS messages, push notifications, and other marketing communications regarding offers, new features, and related services.

14.2 Users may opt out of marketing communications at any time by using the unsubscribe link in any email, adjusting notification settings within the account, or contacting us using the details in Section 37.

14.3 Opting out of marketing communications does not affect transactional or service-related communications, including booking confirmations, payment receipts, and policy updates, which Users will continue to receive as necessary for the operation of the Services.

15. Third-Party Links and Services

15.1 The Platform may contain links to third-party websites, including Hotel Partner websites, payment processors, and social media platforms. This Policy does not apply to such third-party websites or services.

15.2 We are not responsible for the privacy practices or content of any third-party website. Users are encouraged to review the privacy policy of each third-party website they visit.

16. Grievance Officer and Data Protection Contact

16.1 We have designated a Grievance Officer and, where required by applicable law, a Data Protection Officer, to address concerns regarding the Processing of Personal Information.

16.2 Users may raise a grievance, complaint, or query regarding this Policy in writing to the contact details set out in Section 37. We will acknowledge receipt within five (5) business days and endeavour to resolve the matter within thirty (30) days.

16.3 Users who remain dissatisfied with our response may lodge a complaint with the competent data protection authority in their jurisdiction of residence.

17. Changes to this Policy

17.1 We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other operational reasons.

17.2 Material changes will be notified to Users through the Platform, by email, or through such other means as we consider appropriate, prior to the change taking effect.

17.3 The "Effective Date" at the top of this Policy indicates when it was last revised. Continued use of the Services following a change constitutes acceptance of the revised Policy.

18. Governing Law and Jurisdiction

18.1 This Policy shall be governed by and construed in accordance with the laws of the State of Delaware, United States of America, without regard to its conflict of law principles, except where applicable local data protection law mandates otherwise.

18.2 Any dispute arising out of or in connection with this Policy shall be subject to the dispute resolution mechanism set out in the Terms and Conditions.

19. Legal Bases for Processing — Regional Variations

19.1 Instareservation operates a global booking platform and, accordingly, Processing is carried out under multiple legal frameworks depending on the User's location. The table below summarises the primary framework applicable to Users in key regions. This summary is indicative only and does not limit the rights available to a User under the law of their own jurisdiction.

19.2 Where a conflict arises between this Policy and a mandatory provision of local law applicable to a User, the mandatory local provision shall prevail solely to the extent of the conflict.

20. Automated Decision-Making and Profiling

20.1 We may use automated means to generate personalised search results, pricing displays, and recommendations based on a User's browsing and booking history.

20.2 We may use automated fraud-scoring systems to flag transactions for manual review. Such flagging may result in a request for additional verification or, in limited circumstances, cancellation of a Booking pending review.

20.3 We do not make any decision that produces a legal effect or similarly significant effect concerning a User based solely on automated Processing, without an opportunity for human review upon request.

20.4 Users may request human review of an automated decision that materially affects them by contacting us through the details in Section 37.

21. Data Processing Roles and Sub-Processors

21.1 We act as a data controller in respect of Personal Information Processed for account management, Platform operation, and marketing. We act as a data processor, or equivalent role, in respect of certain Personal Information Processed strictly on behalf of a Hotel Partner or corporate account holder, under separate contractual arrangements.

21.2 We engage the categories of sub-processors summarised below to support delivery of the Services. Sub-processors are contractually bound to Processing instructions and confidentiality obligations no less protective than those in this Policy.

21.3 An up-to-date list of material sub-processor categories is available upon written request to the Grievance Officer.

22. Do-Not-Track Signals

22.1 Certain browsers offer a "Do Not Track" signal. Because no uniform industry standard for recognising such signals currently exists, the Platform does not respond to Do Not Track signals at this time. Users may instead manage tracking through the Cookie consent tool described in Section 5 and through browser-level controls.

23. Security Incident Response

23.1 We maintain a documented incident response procedure that includes the following stages.

• (a) Detection and internal escalation to the security and legal teams upon identification of a suspected incident.
• (b) Containment of the affected systems and preservation of relevant logs for investigation.
• (c) Assessment of the scope, cause, and categories of Personal Information affected.
• (d) Notification to affected Users and competent regulatory authorities, where required by applicable law, without undue delay.
• (e) Remediation of the underlying vulnerability and post-incident review.

23.2 Where notification is required, we will provide affected Users with a description of the incident, the categories of Personal Information involved, and recommended protective steps, to the extent such information is available at the time of notification.

24. Bookings Made by Corporate Accounts and Travel Agents

24.1 Where a Booking is made by a corporate account, travel management company, or travel agent on behalf of a traveller, the entity making the Booking is responsible for informing the traveller of this Policy and for obtaining any consent required to share the traveller's Personal Information with us.

24.2 We may Process Personal Information provided by a corporate account holder in accordance with a separate data processing agreement executed with that corporate account holder, which shall govern to the extent of any inconsistency with this Policy in respect of that account.

25. Testimonials, Publicity, and Social Media

25.1 Where a User voluntarily submits a testimonial, or engages with the Platform's official social media accounts, we may feature such content, together with the User's first name and location, on the Platform or in marketing materials, unless the User objects.

25.2 Users may request removal of a previously published testimonial by contacting us through the details in Section 37.

26. Regional Rights Addendum

(a) European Economic Area and United Kingdom Users

26.1 In addition to the rights described in Section 11, Users in the EEA and UK have the right to lodge a complaint with their local supervisory authority and the right to object to Processing carried out for direct marketing purposes at any time, free of charge.

(b) United States Users

26.2 Depending on their state of residence, Users may have the right to know the categories and specific pieces of Personal Information collected, the right to delete Personal Information, the right to correct inaccurate Personal Information, and the right to opt out of the sale or sharing of Personal Information for cross-context behavioural advertising. Requests may be submitted through the details in Section 37 or through an authorised agent, where permitted by law.

(c) Indian Users

26.3 Users in India may exercise the rights of access, correction, erasure, grievance redressal, and nomination in accordance with the Digital Personal Data Protection Act, by contacting the Grievance Officer identified in Section 37.

27. How to Exercise Your Rights

27.1 To exercise any right described in this Policy, a User should submit a written request specifying the right sought to be exercised, together with sufficient information to verify identity.

27.2 We may request additional information reasonably necessary to confirm identity before processing a request, and may decline a request where identity cannot be verified.

27.3 There is no fee for submitting a request, except where a request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act, as permitted by applicable law.

27.4 A User may authorise a representative to submit a request on their behalf, subject to our verification of the representative's authority.

28. Data Minimisation and Purpose Limitation

28.1 We collect only the Personal Information reasonably necessary to fulfil the purposes described in this Policy and do not require Users to disclose Personal Information beyond what is necessary to complete a Booking or use a specific feature.

28.2 Personal Information collected for one purpose will not be Processed for a materially different, incompatible purpose without notifying the User and, where required, obtaining fresh consent.

28.3 Optional fields on the Platform, such as dietary preferences or accessibility notes, are collected only where voluntarily provided and are used solely to enhance the relevant Booking experience.

29. Accuracy of Information

29.1 Users are responsible for ensuring that Personal Information provided to the Platform is accurate and current. Inaccurate information may result in Booking errors, delayed check-in, or denial of service at the property.

29.2 Users may update Account information at any time through Account settings. Certain historical Booking records may be retained in their original form for audit and legal purposes even after an Account update.

30. Retention upon Legal Hold or Dispute

30.1 Notwithstanding the retention periods described in Section 9, we may retain specific Personal Information beyond the stated period where necessary to comply with a legal hold, respond to a regulatory inquiry, or establish, exercise, or defend a legal claim.

30.2 Information retained under this Section will be limited to what is relevant to the underlying matter and will be deleted upon resolution, subject to any further applicable retention obligation.

31. Aggregated and De-Identified Data

31.1 We may create aggregated or de-identified data derived from Personal Information, which does not identify any individual, for the purposes of analytics, reporting, research, and product development.

31.2 Aggregated and de-identified data is not subject to this Policy, as it does not constitute Personal Information. We maintain technical and administrative safeguards designed to prevent re-identification of such data.

32. Business Transfers

32.1 In the event of a merger, acquisition, reorganisation, bankruptcy, or sale of all or substantially all of our assets, Personal Information may be transferred to the acquiring or surviving entity as part of that transaction.

32.2 Where such a transfer results in a material change to the manner in which Personal Information is Processed, affected Users will be notified in accordance with Section 17 prior to the change taking effect.

33. Browser-Based Opt-Out Signals

33.1 Where technically supported and legally recognised, we honour browser-based opt-out preference signals, including Global Privacy Control, as a valid request to opt out of the sale or sharing of Personal Information for cross-context behavioural advertising, in jurisdictions where such signals are given legal effect.

34. Survival and Severability

34.1 The obligations in this Policy relating to data security, confidentiality, and limitation of use of Personal Information already collected shall survive termination of a User's Account or discontinuation of the Services, for so long as we continue to hold such Personal Information.

34.2 If any provision of this Policy is held to be invalid or unenforceable under applicable law, that provision shall be enforced to the maximum extent permissible, and the remaining provisions shall continue in full force and effect.

35. Entire Agreement

35.1 This Policy, together with the Terms and Conditions and any supplemental notice provided at the point of collection, constitutes the entire understanding between the User and Hydra Travels Inc. regarding the Processing of Personal Information in connection with the Services, and supersedes all prior privacy notices issued in respect of the Platform.

36. Annexure A — Illustrative Processing Register

36.1 The following register illustrates, on a non-exhaustive basis, how specific categories of Personal Information map to Processing purpose and retention treatment, for ease of reference.

37. Contact Information

37.1 Questions, requests, or complaints regarding this Policy or the Processing of Personal Information may be directed to:

• Entity: Hydra Travels Inc., operating Instareservation.com
• Attention: Grievance Officer / Data Protection Officer
• Registered Office: [Insert Registered Office Address]
• Email: privacy@instareservation.com
• Phone: [Insert Contact Number]

37.2 This Policy is available on the Platform at all times and may be downloaded or printed for a User's records.