Privacy Policy

Effective Date: 24 March 2026 | Last Updated: 24 March 2026

Pitambar Travels Private Limited, a company incorporated under the Companies Act, 2013, having its registered office in Kolkata, West Bengal, India, operating under the brand name "ELLOCAB" (hereinafter referred to as "ELLOCAB", "Company", "we", "us", or "our"), is committed to protecting the privacy and personal data of its users.

This Privacy Policy ("Policy") explains how we collect, use, process, store, disclose, and protect your personal data when you access or use our website at https://ello.cab (the "Website"), any associated mobile application (the "App"), WhatsApp booking interface, or any other digital or offline service channel operated by ELLOCAB (collectively, the "Platform").

This Policy is published in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and other applicable data protection and privacy laws of India.

By accessing or using the Platform, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree with the terms of this Policy, please do not access or use the Platform. This Policy forms an integral part of the Terms and Conditions available at https://ello.cab/terms.

1. Scope of This Policy

This Policy applies to all personal data collected, processed, and stored by ELLOCAB through the following channels:

• The Website (https://ello.cab) and any sub-domains
• The ELLOCAB mobile application (if and when launched)
• The WhatsApp booking interface and chatbot ("Riya")
• Telephone bookings and customer support interactions
• Email, SMS, and other electronic communications
• In-person or offline interactions, including corporate account onboarding
• Third-party platforms or services integrated with or used in connection with the Platform

This Policy applies to all individuals who access or use the Platform, including registered Users, guest Users, corporate account administrators, Chauffeurs (to the extent their data is processed by ELLOCAB), and visitors to the Website.

This Policy does not apply to third-party websites, applications, or services that may be linked to or from the Platform. We encourage you to review the privacy policies of any such third-party services before providing your personal data.

2. Types of Data Collected

2.1 Personal Identification Data
We collect personal identification information that you provide directly, including but not limited to: full name, mobile telephone number, email address, postal address, date of birth, gender, and profile photograph (if voluntarily uploaded).

2.2 Know Your Customer (KYC) Data
For certain services, including corporate bookings, high-value transactions, or regulatory compliance purposes, we may collect identity verification documents such as Aadhaar card (subject to applicable restrictions), PAN card, passport, driving licence, voter ID, or other government-issued identification. Such collection shall be on a need basis and in compliance with applicable law.

2.3 Location and Trip Data
We collect geolocation data including pick-up and drop-off locations, route information, trip distance, trip duration, and real-time GPS coordinates during active trips (where enabled). Location data may be collected through the Website, App, WhatsApp interface, or through the Vehicle's telematics system.

2.4 Payment and Transaction Data
We collect information related to your transactions, including booking amounts, payment method details (last four digits of card number, UPI ID, wallet information), transaction IDs, invoices, and payment history. Full payment card details (card number, CVV, expiry date) are processed and stored exclusively by our third-party payment gateway partners (such as Razorpay or Cashfree) and are not stored on ELLOCAB's servers.

2.5 Device and Technical Data
We automatically collect technical information when you access the Platform, including but not limited to: IP address, browser type and version, operating system, device type and identifier, screen resolution, language preferences, referring and exit pages, access timestamps, clickstream data, and error logs.

2.6 Communication Data
We collect data from your communications with us, including emails, chat messages (including WhatsApp conversations with our booking bot "Riya"), telephone call recordings (where permitted by law and with appropriate disclosure), customer support tickets, feedback, and reviews.

2.7 Vehicle and Telematics Data
Where applicable, we may collect data from Vehicle telematics systems, including GPS location, speed, acceleration, braking patterns, engine diagnostics, and odometer readings. This data is primarily used for operational efficiency, safety monitoring, and service quality improvement.

2.8 Corporate Account Data
For corporate clients, we may collect business entity information including company name, GSTIN, registered address, authorised signatory details, employee travel data, billing information, and contract terms.

2.9 Device Permissions
Where you access our services through a mobile application, we may request certain device-level permissions, including but not limited to: (a) location access (foreground and/or background) for trip tracking and service delivery; (b) camera access for capturing images or documents, where required; (c) contacts access for enabling emergency/SOS features or referrals; and (d) storage or media access for uploading or storing relevant content. All such permissions are requested only where necessary for the functioning of the Platform and are subject to your device settings and explicit consent. You may manage or revoke these permissions at any time through your device settings.

3. How Data Is Collected

3.1 Direct Collection
We collect data directly from you when you: (a) register for an Account; (b) make a Booking; (c) communicate with us via email, telephone, WhatsApp, or chat; (d) fill out forms on the Platform; (e) provide feedback, reviews, or complaints; (f) participate in surveys, promotions, or contests; or (g) interact with our customer support team.

3.2 Automated Collection
We automatically collect certain data through: (a) cookies and similar tracking technologies placed on your device when you access the Platform; (b) web beacons, pixel tags, and clear GIFs embedded in our communications; (c) server logs and analytics tools (such as Google Analytics); and (d) GPS, cellular, and Wi-Fi signals when you use location-enabled features.

3.3 Third-Party Sources
We may receive data about you from third-party sources, including: (a) payment gateway providers (transaction confirmations and fraud alerts); (b) social media platforms (if you log in using social authentication); (c) identity verification service providers; (d) marketing and advertising partners; (e) publicly available databases and government records; and (f) our Transportation Providers and Chauffeurs (trip-related data and incident reports).

4. Purpose of Data Use

We process your personal data for the following purposes:

4.1 Service Delivery and Booking Fulfilment
To process and fulfil Bookings, assign Chauffeurs and Vehicles, communicate trip details, generate invoices, process payments and refunds, and provide real-time trip tracking.

4.2 Customer Support
To respond to your inquiries, complaints, and feedback; to resolve disputes; and to provide technical assistance related to the Platform.

4.3 Safety and Fraud Prevention
To verify user identity; to detect, investigate, and prevent fraudulent transactions, suspicious activity, and abuse of the Platform; to conduct background checks on Chauffeurs; to monitor trip safety; and to comply with regulatory requirements related to safety and security.

4.4 Analytics, Improvement, and Personalisation
To analyse usage patterns and trends; to improve the Platform's functionality, performance, and user experience; to personalise content and recommendations; to develop new features and services; and to conduct internal research and statistical analysis.

4.5 Marketing and Communications
To send promotional communications, offers, newsletters, and updates about our Services (subject to your opt-out preferences); to conduct market research; and to manage loyalty or referral programmes.

4.6 Legal and Regulatory Compliance
To comply with applicable laws, regulations, and legal processes; to respond to lawful requests from government and regulatory authorities; to enforce our Terms and Conditions; to protect our rights, property, and safety; and to establish, exercise, or defend legal claims.

4.7 Corporate Operations
For internal administrative purposes, including audit, accounting, risk management, insurance, business planning, and in connection with any merger, acquisition, reorganisation, or sale of assets.

4.8 Combination of Data
We may combine personal data collected directly from you, automatically through your use of the Platform, and from third-party sources, for purposes including service delivery, analytics, fraud prevention, personalisation, and improvement of our services, in accordance with this Policy.

4.9 Automated Processing and Profiling
ELLOCAB may use automated systems, algorithms, and analytical tools to process personal data for purposes including fraud detection, risk assessment, service personalisation, pricing optimisation, and operational efficiency. Such processing shall be carried out in a fair and reasonable manner and shall not result in decisions producing legal or similarly significant effects on users without appropriate safeguards, in accordance with applicable law.

4.10 Use of Anonymised Data
We may anonymise or de-identify personal data such that it can no longer be associated with an identifiable individual. Such anonymised data may be used for research, analytics, statistical analysis, service improvement, and may be shared with third parties without restriction, in compliance with applicable law.

5. Legal Basis for Processing

In accordance with the Digital Personal Data Protection Act, 2023, we process your personal data on the following legal bases:

(a) Consent: Where you have provided explicit, free, specific, informed, and unambiguous consent for the processing of your personal data for one or more specific purposes. You have the right to withdraw consent at any time, subject to Clause 9 of this Policy.

(b) Legitimate Uses: Where processing is necessary for the performance of a contract to which you are a party (i.e., fulfilment of Bookings under the Terms and Conditions), or for taking steps at your request prior to entering into a contract.

(c) Legal Obligation: Where processing is necessary for compliance with a legal obligation to which ELLOCAB is subject, including tax laws, record-keeping requirements, court orders, and regulatory directives.

(d) Vital Interest: Where processing is necessary to protect the vital interests of the Data Principal or another natural person, such as in emergency or safety situations during a trip.

(e) Public Interest: Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, as required by applicable law.

6. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

6.1 Chauffeurs and Transportation Providers
Your name, pick-up and drop-off locations, mobile number, and trip-specific instructions are shared with the Chauffeur and/or Transportation Provider assigned to your Booking, to the extent necessary for service fulfilment. We take reasonable measures to limit the data shared to what is strictly necessary.

6.2 Payment Gateway Providers
Payment transaction data is shared with our third-party payment processors (such as Razorpay and Cashfree) for the purpose of processing payments, refunds, and chargebacks. These providers operate under their own privacy policies and are subject to PCI-DSS and other applicable security standards.

6.3 Government and Law Enforcement Authorities
We may disclose your personal data to government agencies, law enforcement authorities, regulatory bodies, courts, or tribunals: (a) in response to a legally binding order, subpoena, summons, or warrant; (b) to comply with applicable laws and regulations; (c) to protect the rights, property, or safety of ELLOCAB, our Users, or the public; or (d) to investigate or prevent suspected fraud, illegal activity, or violations of our Terms.

6.4 Insurance Partners
In the event of an accident, incident, or insurance claim, relevant trip data, User information, and incident details may be shared with insurance companies and claims processors to the extent necessary for the investigation and settlement of claims.

6.5 Service Providers and Business Partners
We may engage third-party service providers to perform functions on our behalf, including but not limited to: cloud hosting and data storage (such as AWS, Google Cloud); analytics and marketing services (such as Google Analytics); customer support tools; SMS and email delivery services; and identity verification providers. Such service providers are contractually bound to process your data only on our instructions and in accordance with this Policy. You may opt out of Google Analytics data collection by installing the Google Analytics opt-out browser add-on available at tools.google.com/dlpage/gaoptout. Where the Platform uses location-based mapping services (such as Google Maps or equivalent), location data submitted to such services is transmitted in anonymised form and is not used to identify you personally.

6.6 Corporate Transactions
In the event of a merger, acquisition, reorganisation, bankruptcy, sale of assets, or any other corporate transaction, your personal data may be transferred to the acquiring or surviving entity, subject to the obligations of this Policy and applicable law.

6.7 With Your Consent
We may share your personal data with additional third parties where you have provided your explicit consent for such sharing.

6.8 Emergency and Safety-Related Data Sharing
In the event of an emergency, safety incident, or where a user triggers an SOS feature (if and when made available), ELLOCAB may process and share real-time location data, trip details, and relevant personal information with: (a) emergency contacts designated by the user; (b) law enforcement authorities, regulatory bodies, or emergency response agencies; and (c) nearby responders or third parties reasonably required to provide assistance. Such sharing shall be limited to what is necessary to ensure user safety, respond to emergencies, and comply with applicable legal obligations.

6.9 Advertising and Marketing Partners
We may engage third-party advertising, marketing, and analytics partners (including but not limited to Google, Meta, and similar platforms) to display advertisements, measure campaign effectiveness, and provide personalised marketing communications. These partners may use cookies, pixels, SDKs, and similar tracking technologies to collect information about your interactions with our Platform and other websites or applications, in accordance with their respective privacy policies.

6.10 Third-Party Services Disclaimer
The Platform may integrate with or contain links to third-party services, including payment gateways, service providers, and external platforms. ELLOCAB does not control and shall not be responsible for the privacy practices, policies, or content of such third parties. Your interactions with such third parties shall be governed by their respective privacy policies and terms.

6.11 Independent Data Fiduciaries
Certain third parties engaged by ELLOCAB, including payment processors, insurance providers, and transportation partners, may act as independent data fiduciaries/controllers with respect to the personal data processed by them. ELLOCAB shall not be responsible for the processing of personal data by such entities beyond the scope of its direct control.

7. Data Retention Policy

We retain your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected, as described in this Policy, unless a longer retention period is required or permitted by applicable law.

The following general retention periods apply:

(a) Active Account Data: Retained for the duration of your Account and for a period of three (3) years following Account deletion or deactivation, to address any post-termination disputes or legal requirements.

(b) Booking and Transaction Records: Retained for a minimum of eight (8) years from the date of the transaction, in accordance with applicable tax, accounting, and commercial laws.

(c) Communication Records: Retained for a period of three (3) years from the date of the communication, unless longer retention is required for legal or regulatory purposes.

(d) Payment Data: Transaction records retained as per sub-clause (b) above. Full payment card details are not stored by ELLOCAB and are subject to the retention policies of the respective payment gateway.

(e) Technical and Log Data: Retained for a period of one (1) year from the date of collection, unless longer retention is required for security, fraud investigation, or legal purposes.

Upon expiration of the applicable retention period, personal data shall be securely deleted or anonymised such that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for research, analytics, and statistical purposes.

8. Your Rights as a Data Principal

In accordance with the Digital Personal Data Protection Act, 2023, you have the following rights in relation to your personal data:

8.1 Right to Access
You have the right to obtain confirmation as to whether your personal data is being processed by us and, where that is the case, to request access to a summary of such personal data and the processing activities undertaken.

8.2 Right to Correction
You have the right to request the correction of inaccurate or incomplete personal data. You may update certain information directly through your Account settings or by contacting us.

8.3 Right to Erasure
You have the right to request the erasure of your personal data, subject to applicable legal exceptions. Upon receiving a valid erasure request, we shall erase your personal data within a reasonable timeframe, except to the extent that retention is required for: (a) compliance with a legal obligation; (b) establishment, exercise, or defence of legal claims; (c) archiving purposes in the public interest; or (d) other legitimate and lawful purposes.

8.4 Right to Withdraw Consent
Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. You may withdraw consent by contacting us at the details provided in Clause 16 or through the Platform settings. Please note that withdrawal of consent may result in the inability to provide certain Services to you.

8.5 Right to Nominate
In accordance with the DPDP Act, you have the right to nominate another individual to exercise your rights under this Policy in the event of your death or incapacity.

8.6 Right to Grievance Redressal
You have the right to raise grievances regarding the processing of your personal data with our Grievance Officer (details in Clause 16) and, if unsatisfied with our response, to file a complaint with the Data Protection Board of India.

9. User Responsibilities

9.1 User Responsibility for Account Security
You are responsible for maintaining the confidentiality of your account credentials, including your username, password, and any authentication mechanisms such as OTPs. ELLOCAB shall not be liable for any unauthorised access or use of your account resulting from your failure to safeguard such credentials.

9.2 Accuracy of Information
You represent and warrant that all personal data provided by you is accurate, complete, and up to date. You are responsible for updating or correcting your information as necessary. ELLOCAB shall not be liable for any consequences arising from inaccurate, outdated, or incomplete information provided by you.

9.3 Consent to Communications
By accessing or using the Platform, you consent to receive transactional, service-related, and administrative communications from ELLOCAB via email, SMS, telephone calls, and messaging platforms (including WhatsApp or similar channels). Such communications are necessary for service delivery, customer support, and regulatory compliance. You may opt out of promotional communications where applicable.

10. Cookies Policy

10.1 The Platform uses cookies and similar tracking technologies ("Cookies") to enhance your experience, analyse usage, and deliver targeted content. Cookies are small text files placed on your device by your web browser when you visit the Platform.

10.2 We use the following categories of Cookies:

(a) Essential Cookies: These are strictly necessary for the operation of the Platform and enable core functionality such as session management, security, and accessibility. Disabling these Cookies may impair the functionality of the Platform.

(b) Analytics Cookies: These help us understand how Users interact with the Platform by collecting data on pages visited, time spent, click behaviour, and error occurrences. We use tools such as Google Analytics for this purpose. Analytics data is typically aggregated and anonymised.

(c) Functional Cookies: These enable enhanced functionality and personalisation, such as remembering your preferences, language settings, and recent searches.

(d) Marketing Cookies: These are used to track your browsing activity across websites and deliver targeted advertisements relevant to your interests. We may use third-party advertising networks for this purpose.

10.3 You can control and manage Cookies through your browser settings. Most browsers allow you to refuse, delete, or block Cookies. However, disabling certain Cookies may affect the functionality and user experience of the Platform.

10.4 By continuing to use the Platform after being notified about our use of Cookies, you consent to their placement on your device, subject to your browser settings and preferences.

10.5 You may opt out of interest-based or targeted advertising by adjusting your browser settings, device preferences, or by using third-party opt-out tools provided by advertising networks. Please note that opting out of targeted advertising does not mean you will stop seeing advertisements, but such advertisements may be less relevant to your interests.

10.6 Some web browsers may transmit "Do Not Track" (DNT) signals to websites. The Platform may not respond to such signals. Users may manage their tracking preferences through browser settings or cookie management tools.

11. Data Security Measures

11.1 ELLOCAB implements reasonable technical, administrative, and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:

(a) Encryption of data in transit using SSL/TLS protocols and encryption of sensitive data at rest

(b) Access controls and authentication mechanisms, including role-based access and multi-factor authentication for internal systems

(c) Regular security assessments, vulnerability testing, and penetration testing

(d) Employee training on data protection, confidentiality, and information security best practices

(e) Incident response and breach notification procedures in accordance with applicable law

(f) Physical security measures for servers and data storage facilities

(g) Data minimisation and purpose limitation practices to ensure that only necessary data is collected and retained

11.2 Notwithstanding the foregoing, no method of data transmission over the internet or electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee its absolute security. You acknowledge and accept that any transmission of data is at your own risk.

11.3 In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, ELLOCAB shall notify the Data Protection Board of India in accordance with the timelines and procedures prescribed under the DPDP Act, and shall notify affected Users through appropriate communication channels (including email, SMS, or in-app notifications). Such notification shall include, where feasible, the nature of the breach, the likely consequences, and the measures taken or proposed to mitigate its impact.

12. Cross-Border Data Transfer

12.1 Your personal data is primarily stored and processed in India. However, in the course of our operations, your personal data may be transferred to, and processed in, countries outside India where our service providers, cloud hosting partners, or business affiliates are located.

12.2 Any cross-border transfer of personal data shall be carried out in compliance with the DPDP Act and any rules, regulations, or notifications issued thereunder by the Central Government of India. ELLOCAB shall ensure that adequate safeguards and contractual protections are in place to protect your personal data in the jurisdiction of the recipient.

12.3 ELLOCAB shall not transfer personal data to any country or territory that has been specifically restricted by the Central Government under the DPDP Act or any notification issued thereunder.

12.4 If you access or use the Platform from outside India, you acknowledge and agree that your personal data may be transferred to, stored, and processed in India and other jurisdictions in accordance with this Policy and applicable law.

13. Children's Privacy

13.1 The Platform and Services are not directed at or intended for use by individuals under the age of eighteen (18) years ("Children"). ELLOCAB does not knowingly collect personal data from Children.

13.2 In accordance with the DPDP Act, if we become aware that we have collected personal data from a Child without verifiable consent from the Child's parent or lawful guardian, we shall take immediate steps to delete such data from our records.

13.3 If you are a parent or guardian and believe that your Child has provided personal data to ELLOCAB without your consent, please contact us immediately at the details provided in Clause 16, and we shall endeavour to delete such information promptly.

14. Updates to This Policy

14.1 ELLOCAB reserves the right to update, modify, or replace this Policy at any time and at its sole discretion. Any changes shall be effective upon posting of the revised Policy on the Platform, with the updated "Last Updated" date.

14.2 We may, but are not obligated to, notify you of material changes through email, in-app notification, or a prominent notice on the Platform. It is your responsibility to review this Policy periodically.

14.3 Your continued use of the Platform after the posting of any changes constitutes your acceptance of the revised Policy. If you do not agree with any changes, you must discontinue use of the Platform.

14.4 ELLOCAB may maintain records of previous versions of this Privacy Policy. Such versions may be made available upon request, subject to applicable legal and operational considerations.

15. Grievance Officer

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the details of the Grievance Officer appointed by ELLOCAB are as follows:

Name: Swati Seksaria
Designation: Grievance Officer
Organisation: Pitambar Travels Private Limited (trading as ELLOCAB)
Email: [email protected]
Address: Registered Office, Pitambar Travels Private Limited, Kolkata, West Bengal, India

The Grievance Officer shall acknowledge your grievance within forty-eight (48) hours of receipt and shall endeavour to resolve it within thirty (30) days from the date of receipt, in accordance with applicable law.

If you are not satisfied with the resolution provided by the Grievance Officer, you may file a complaint with the Data Protection Board of India established under the DPDP Act, 2023, or approach the appropriate consumer forum or court of competent jurisdiction.

16. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

Email: [email protected]
Website: https://ello.cab
Registered Entity: Pitambar Travels Private Limited
Registered Office: Kolkata, West Bengal, India

END OF PRIVACY POLICY
Pitambar Travels Private Limited (trading as ELLOCAB) | https://ello.cab | [email protected]