PRIVACY NOTICE – LEONARD B2B PORTAL Leonard Travels Pvt Ltd (trading as Leonard Holidays), Tej House-5, M.G. Road, Pune, Maharashtra 411001 Last updated: 29-Oct-2026 1. WHO WE ARE Leonard Travels Pvt Ltd ("Leonard", "we") runs this portal for travel agencies and corporate clients. We decide why and how personal data in the portal is used, under the Digital Personal Data Protection Act, 2023. 2. WHAT WE COLLECT - Agency and corporate users: name, email, mobile number, login and security records (sign-in times, IP address). - Agency business details: company name, GSTIN, PAN, address, bank details and KYC documents. - Passengers: names, title, date of birth, nationality, passport expiry, special needs, and documents uploaded with a request (for example passport copies), booking and ticket details. - Payments: amounts and payment references. We do not store card numbers; online payments are handled by our payment provider. 3. WHY WE USE IT To verify agencies, to book, issue and service air tickets (voids, refunds, reissues, schedule changes), to invoice and collect payments, to communicate about requests, to keep the portal secure, and to meet legal, tax and airline obligations. 4. WHO WE SHARE IT WITH Only as needed for these purposes: airlines and global distribution systems (such as Sabre) for bookings and tickets; government authorities where the law requires; our payment and verification providers (such as Cashfree) and our hosting provider in India, who act on our instructions. We do not sell personal data. 5. HOW LONG WE KEEP IT Passenger personal details and passport copies are deleted [24] months after the travel date. Invoices, credit notes, receipts and ticket records are kept for [8] years as required by tax law. Agency KYC records are kept while the account is active and as required by law after it ends. 6. SECURITY Access is limited to Leonard staff and the agency or company that made the request. Documents are private, logins use passwords and authenticator codes, and every change is recorded. 7. YOUR RIGHTS You may ask to access, correct or erase your personal data, withdraw consent where we rely on it, or nominate someone to act for you, subject to legal and airline requirements. Agencies should pass on passenger requests to us. 8. CONTACT AND GRIEVANCES Grievance Officer: [name], [email, e.g. privacy@leonardtravels.com], [phone]. We aim to reply within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India. 9. CHANGES We may update this notice; the latest version is always on this page.