Privacy Policy

Shantu Travel Operated by Cashew & Compass Ventures Private Limited

Effective date: 17 June 2026 Contact: privacy@shantutravel.com

Your privacy, respected.

The information you share with us travels no further than it needs to. We collect only what is necessary to deliver your journey safely and well. Photographs taken during your time with us belong to the moment — and to you. Where we wish to share them, we will always ask first.

This policy applies to every person who books, enquires about, or travels with Shantu — regardless of where in the world you are. We apply the same standard of care to everyone.

1. Who We Are

Cashew & Compass Ventures Private Limited, trading as Shantu Travel. 1037c, Kutiya Road, Giridih, 815301, Jharkhand, India.

Privacy contact: privacy@shantutravel.com

We are a small, founder-led travel company. When you write to us about privacy, a person reads it and responds.

2. What We Collect and Why

We collect only what we genuinely need to run your journey safely and well.

Identity and booking information Your full legal name, date of birth, passport number and expiry, nationality, email address, and phone number. We need this to confirm your booking, meet destination visa and entry requirements, satisfy hotel registration obligations under local law, and take care of you while you travel. Where a destination requires additional documentation — such as a visa reference number or arrival card — we will ask for only what that destination specifically requires.

Fitness and insurance information We ask whether you have any medical condition, physical limitation, or allergy that may affect your participation. We do not ask for diagnosis or medical history. If you indicate that you do have relevant considerations, we ask that you discuss these privately with your Shantu guide on the first day of your journey.

Travel insurance is a mandatory booking condition. We collect your insurer's name, policy number, and 24-hour emergency helpline number — nothing more.

Emergency contact details A name, relationship, and phone number for someone we can reach if needed.

Travel and logistics information Flight arrival and departure details so we are ready for you.

Payment information Payments are handled securely by our payment processing provider. We never see or store your card or bank details. We retain a record of transaction amount, date, and reference number for our accounts.

Communications Any messages, enquiry responses, or emails you send us, including responses to our Tastemakers and Shantu Circle invitation forms.

Journey Storyteller content (only if you choose to participate) Photographs and video taken during your journey, and a record of your consent — including its scope, channels, and duration.

Website and analytics data Basic, anonymised information about how our website is used — pages visited, session length, device type. We use this only to improve the site.

We process your data because it is necessary to deliver the journey you have booked, to meet our legal obligations, or because you have given us your consent — which you may withdraw at any time. We do not use automated decision-making or profiling.

3. Who We Share It With

Only those who need it. Only for your journey.

Local ground partners The guides, accommodation providers, and transport operators who deliver your experience on the ground. Accommodation providers receive passport and identity details as required by local hotel registration law — this is a legal obligation in most of our destinations, not a choice. Beyond legal requirements, partners receive only the information they need to look after you.

Our technology providers We work with third-party providers for website hosting, booking management, payment processing, and guest communications. These providers access your data only to the extent necessary to provide their service to us. We do not authorise them to use your data for their own purposes.

Legal and regulatory authorities If we are ever legally required to disclose information — in India, Mexico, the United States, the European Union, or any other jurisdiction in which we operate — we will comply with that obligation.

We do not sell your personal data. We do not share it for advertising purposes. We never have, and we never will.

4. How Long We Keep It

What How long Booking and travel records Up to 7 years after your journey Financial and payment records 7 years Fitness declaration and insurance details Duration of journey, then deleted Journey Storyteller content For as long as your consent remains active Marketing communications Until you unsubscribe Enquiries that did not become bookings 12 months Website analytics 26 months

After these periods, your data is securely deleted or anonymised.

5. Your Rights — Everyone

Wherever you are in the world, you can write to privacy@shantutravel.com to:

  • See the personal data we hold about you

  • Correct anything that is wrong or incomplete

  • Delete your data where we have no legal reason to keep it

  • Withdraw consent for anything you previously agreed to — including Journey Storyteller

  • Receive a copy of your data in a usable format

  • Object to any processing you are uncomfortable with

We will respond within 30 days. We will never treat you differently — in service, price, or experience — for exercising any of these rights.

6. If You Are in the United States

We do not sell your personal information. If you are a California resident, the CCPA gives you the right to know what we collect, request deletion, and correct inaccurate data. Write to privacy@shantutravel.com and we will respond within 45 days.

7. If You Are in Mexico

Tiene derechos sobre sus datos personales conforme a la LFPDPPP — derechos de Acceso, Rectificación, Cancelación y Oposición (derechos ARCO). Para ejercerlos, escríbanos a privacy@shantutravel.com indicando "Solicitud ARCO" en el asunto. Responderemos en un plazo de 20 días hábiles.

You have rights over your personal data under Mexican law (LFPDPPP) — rights of Access, Rectification, Cancellation, and Opposition. Write to privacy@shantutravel.com with the subject "ARCO Request" and we will respond within 20 working days.

8. If You Are in the European Union or United Kingdom

We apply GDPR as our baseline standard for all travellers globally. If you are based in the EU or UK, you additionally have the right to lodge a complaint with your national data protection authority. Find yours at edpb.europa.eu. UK residents may contact the ICO at ico.org.uk.

9. Everyone Else

We apply the same standard to every traveller regardless of nationality. If you have questions about your rights under your local law, write to us and we will do our best to help.

10. International Transfers

We are based in India, and your journey may take place in another country. Your data may therefore be processed in India and in the country of your destination. Wherever it travels, we protect it to the standard described in this policy and apply appropriate safeguards consistent with applicable law.

11. Journey Storyteller

If you chose the Journey Storyteller option at booking, you consented to Shantu Travel using photographs and video from your journey in our brand communications. A record of your consent — including scope, channels, and duration — is held on file.

You may withdraw this consent at any time by writing to privacy@shantutravel.com. We will remove your images from active use within 60 days. The USD 200 contribution applied to your journey is yours to keep — it will never be reclaimed after your journey has taken place.

12. Cookies

We use essential cookies to operate our website and basic analytics to understand how it is used. If you have any questions or concerns about how cookies are used, write to us at privacy@shantutravel.com.

13. Security

We take reasonable steps to protect your personal data against unauthorised access, loss, or disclosure. In the event of a breach likely to affect your rights, we will notify you as required by applicable law.

13. Business Transfers and Restructuring

If Shantu Travel or Cashew & Compass Ventures Private Limited undergoes a corporate restructuring — including the formation of a subsidiary, transfer of the travel business to a new legal entity, merger, acquisition, or sale of all or part of the business — your personal data may be transferred to the successor entity as part of that transaction.

Any successor entity will be required to honour the commitments made in this policy. Where applicable law requires us to notify you of a change in data controller, or to seek your consent before transferring your data, we will do so. Your rights over your data remain unchanged through any such transition.

14. Changes to This Policy

We reserve the right to update or modify this policy at any time to reflect changes in our operations, legal obligations, or applicable law.

For material changes — including changes to the data we collect, how we use it, or who we share it with — we will take reasonable steps to notify active clients before the changes take effect. Where applicable law requires a specific notice period, prior notification, or explicit consent before changes take effect, we will comply with those requirements.

Your continued use of our services after changes take effect constitutes acceptance of the updated policy. The current version is always at shantutravel.com/privacy.

15. Contact

Email: privacy@shantutravel.com Post: Cashew & Compass Ventures Private Limited, 1037c, Kutiya Road, Giridih, 815301, Jharkhand, India.

We are a small team. We read everything ourselves and respond personally.

This policy reflects compliance with the India DPDP Act 2023, Mexico LFPDPPP, US CCPA/CPRA, and the EU General Data Protection Regulation as a universal baseline.