Last updated: 2026-08-20
This website is run by Hashloom Travel Partner LLP (“Hashloom”, “we”, “us”). We are a travel agency, not an online travel agency: we don't sell you flights, hotels, or packages through this website directly. Instead, this site is a way to start a conversation with us — almost always on WhatsApp — where a person on our team then makes the booking on your behalf, working with the relevant airline, hotel, bus operator, tour operator, insurer, or visa authority.
We have two establishments:
Registered & corporate office
Operations office
Hashloom Travel Partner LLP is the data controller for the purposes of the EU General Data Protection Regulation (GDPR) and the fiduciary/“data fiduciary” for the purposes of India's Digital Personal Data Protection Act, 2023 (DPDP Act), in respect of the personal data described in this policy. Because we operate from Poland, GDPR applies to our processing. Because we also operate from India and serve travellers there, the DPDP Act applies too — this policy tries to address both.
This policy covers two very different things, and we've tried to keep them clearly separate throughout:
Where this policy says the website “collects” something, we mean the site's code actually does it automatically. Where it says you “send us” or “tell us” something, we mean it only happens because you typed it and chose to send it, usually in a WhatsApp chat.
We use Vercel Web Analytics and Vercel Speed Insights (see section 7). These automatically record aggregate information like which pages are viewed and how fast the page performs — not who you are individually. As with any web request, your device's IP address necessarily reaches Vercel's analytics collection endpoint as part of sending that request, even though Vercel's stated purpose for these two tools is aggregate reporting, not building a profile of you.
As you type an airport, city, or destination into the search box, the site queries its own server (/api/places) to suggest matches from a fixed list of airports and cities we ship with the site. This never leaves our own infrastructure and is never sent to a third-party mapping or geocoding service. Our application code does not log or store what you typed; our hosting provider may keep the same short-lived technical request logs (timestamps, IP address) that any web server keeps for security and debugging, as with any website.
The search card on our homepage lets you enter trip details — origin/destination, dates, traveller counts, cabin class, and similar — for flights, hotels, buses, and holidays. Notice what's not in that list: there is no field anywhere in this tool for your name, email address, phone number, or passport details. When you press search, the site turns your trip details into a pre-written WhatsApp message and opens WhatsApp with it ready to send — it does not post anything to our servers. We only receive that message if you then press Send inside WhatsApp yourself.
A few pages (for example the quick-search boxes on our Hotels and Bus pages) show text boxes that look similar but aren't wired up to anything — the WhatsApp button next to them sends a fixed, generic message regardless of what you type into those boxes. We're flagging this here for accuracy: nothing you type into those particular boxes is read, stored, or sent anywhere.
The email box in our site footer (“Get exclusive Hashloom offers”) does submit. When you press Subscribe, your email address is sent to formsubmit.co, a third-party form-forwarding service operated by Devro LABS, which emails it on to us at connect@hashloom.com. That is the only field sent — we do not attach your name, IP address, or anything else to it. We use the address to send you offers, and you can tell us to stop at any time by replying to any message or emailing us. FormSubmit's only published policy is a single document, last dated 17 January 2019 and apparently unrevised since, stating that data is used only to operate the platform and fulfil the request submitted through it, and is not disclosed to third parties except where the law requires it — but that document does not state a retention period for submitted addresses, where they are stored or processed, or offer a data-processing agreement, and Devro LABS does not publish FormSubmit's country of incorporation anywhere on its own sites. Where this transfer takes personal data outside the EEA, we rely on the safeguards permitted under Chapter V of the GDPR — see section 8.
Once you're in a conversation with us — almost always WhatsApp, sometimes email or phone — you may share information needed to plan and book your trip. Depending on what you're booking, this can include: your name; contact details; travel dates and destinations; number and ages of travellers; passport number, nationality, and date of birth (needed for ticketing, visas, and some insurance); frequent-flyer or loyalty numbers; dietary, accessibility, or medical needs relevant to your trip; visa-application documents; and payment confirmation details for whatever payment method you use with us. We only ask for what a given booking actually needs.
Almost every button on this site — “Book on WhatsApp”, “Start chat”, service and search buttons — does the same thing:
wa.me/48739674748, with a pre-written message attached where relevant.From that point on, the conversation is carried by WhatsApp, a Meta product, under Meta's own privacy policy and terms of service — not this website's code. Meta processes the message content, your phone number, and related metadata according to its own policies, which we don't control. Anything you subsequently type in that chat — including sensitive things like your passport number, date of birth, or payment confirmation — is sent to us as the recipient of the chat, and we then use it to plan, quote, and book your trip, exactly as described in section 3.3.
We do not use a chatbot or any automated system to read or reply to these conversations. A person on our team reads and responds.
Under GDPR, we need a lawful basis for each way we use personal data. Here's how our main purposes map to Article 6 GDPR:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Answering your enquiry and preparing a quote | Legitimate interests (Art. 6(1)(f)) and/or steps taken at your request before a contract (Art. 6(1)(b)) |
| Making and administering a booking you've confirmed | Performance of a contract (Art. 6(1)(b)) |
| Sharing your details with an airline, hotel, insurer, or visa authority to fulfil that booking | Performance of a contract (Art. 6(1)(b)); legal obligation for visa/immigration submissions (Art. 6(1)(c)) |
| Sending you booking and trip-related updates | Performance of a contract (Art. 6(1)(b)) |
| Aggregate website analytics and performance monitoring | Legitimate interests in running and improving the site (Art. 6(1)(f)) |
| Accounting, tax, and travel-industry record-keeping | Legal obligation (Art. 6(1)(c)) |
| Marketing you've opted into (not currently active on this site — see 3.2) | Consent (Art. 6(1)(a)) |
We don't use automated decision-making or profiling to make decisions that would legally or similarly significantly affect you — every quote, itinerary, and booking is put together by a person on our team, not an algorithm.
Travel booking genuinely requires some sensitive information, and we want to be direct about it rather than hide it in boilerplate.
Passport numbers and dates of birth are not “special category” data under GDPR Article 9 (that term covers things like racial or ethnic origin, religious belief, and health data — not identity-document numbers). But we treat them as highly sensitive because of the harm that could follow if they were mishandled, and we only ever use them for the specific ticketing, visa, or insurance step that needs them.
Some bookings do involve genuine GDPR special category data. If you ask us to book a religious tour — Umrah, Hajj, a pilgrimage circuit — the fact of that booking can reveal your religious belief, which is special category data under Article 9 GDPR. If you tell us about a medical condition, dietary requirement, or accessibility need, that can be health data, also special category. In both cases, our basis for processing it is your explicit consent under Article 9(2)(a) — you are the one who tells us, and you do so in order to get that specific service.
India's DPDP Act does not draw the same distinction between “ordinary” and “special category” personal data that GDPR does; it applies broadly to all personal data. We apply the same care to passport, date-of-birth, and similar details for our Indian customers as we do for GDPR purposes.
This site does not set or read any cookies — no tracking cookies, no session cookies, no advertising cookies. It also doesn't use your browser's local or session storage. The trip details you enter in the search tool live only in the page's memory while your tab is open and are gone the moment you refresh or navigate away — we don't save them anywhere, on your device or ours.
We use Vercel Web Analytics and Vercel Speed Insights, two tools built by our hosting provider, Vercel. Per Vercel's own documentation, both are cookieless: Web Analytics identifies visitors “by a hash created from the incoming request” rather than a cookie, and neither tool ties the data it reports to an individual visitor or IP address — both report aggregate information, like which pages get viewed and page-performance metrics such as load times (“Core Web Vitals”), rather than building a profile of you individually. They run on every page of this site; we haven't added any custom event tracking on top of them.
Like any web request, the request that sends this data to Vercel necessarily carries your IP address and browser information to Vercel's collection endpoint, in the same way it reaches our own hosting infrastructure (section 3.1) and the third-party image hosts described in section 16. Per Vercel's documentation, Web Analytics and Speed Insights are cookieless and report the resulting data in aggregate. For exactly how Vercel itself processes this data, see Vercel's own analytics and speed-insights documentation.
We don't run any advertising pixels, remarketing tags, or third-party tracking scripts of our own on this site.
We are a travel agency, which means fulfilling your booking necessarily means sharing your details with the people who actually provide the travel — we can't book you a flight without giving the airline your name. Depending on what you book, we share the information needed to complete it with: airlines, hotels and serviced-apartment providers, bus operators, tour and holiday-package operators, visa-issuing authorities and visa application/processing centres, travel insurers, and ground-transport/transfer partners.
We also rely on a small number of service providers that process data on our behalf rather than for their own purposes: Vercel, which hosts this site and provides its analytics; WhatsApp/Meta, which carries the conversation once you message us; and FormSubmit (formsubmit.co), which forwards footer newsletter sign-ups to our inbox. Section 3 describes exactly what each one receives.
We do not sell your personal data to anyone — not to data brokers, not for advertising, not for any other purpose.
This website itself has no payment gateway and never asks you to enter card details on hashloom.com. If you pay us, that happens through a channel we agree with you directly in that WhatsApp, phone, or email conversation, and confirm with you before you pay. Hashloom will never ask you to pay into a personal account outside that agreed channel. Whatever the channel turns out to be, that transaction is between you and your bank or payment provider, governed by their own terms, not this website's.
Because our customers and our suppliers are often in different countries — Indian airlines and hotels serving diaspora customers booking from Europe, European suppliers serving Indian travellers, visa authorities in whichever country you're travelling to — your data will often cross borders as an unavoidable part of booking travel. Where that means transferring personal data outside the EEA, we rely on the safeguards permitted under Chapter V of the GDPR for that transfer.
We keep enquiry, booking, and payment-confirmation information for as long as we need it to deliver your trip and handle any issues that come up afterwards, and to meet our own accounting, tax, and travel-industry record-keeping obligations. Once none of those purposes apply, we delete it.
Messages you send us on our WhatsApp business number stay visible on our side of that conversation, the same way any WhatsApp conversation does, until deleted from both sides or otherwise removed under WhatsApp's own retention settings.
We take reasonable steps to protect the information you share with us and limit access to people on our team who need it to help with your trip. Because this website has no payment gateway and never collects card details, there is no cardholder data stored on hashloom.com to protect in the first place. No method of transmission or storage is completely secure, and we can't guarantee absolute security — including for messages sent over WhatsApp, email, or phone, which are also subject to the security of those platforms themselves.
This site and our WhatsApp channel are intended for use by adults arranging their own travel or travel for their family or group. It's entirely normal for a booking to include children as travellers — family holidays, student travel, group and religious tours — and in those cases, the adult making the booking provides that information to us and is responsible for having the authority to do so. We don't knowingly direct this website at children as independent users of the site itself.
If GDPR applies to you, you have the right to:
As a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the right to:
We honour these rights in practice regardless of exactly when each provision of the Act and its Rules comes fully into force. connect@hashloom.com is Hashloom's designated contact for any DPDP Act request or grievance — see section 19 — alongside the Data Protection Board of India, the authority designated under the Act to hear an unresolved grievance.
Email connect@hashloom.com telling us what you'd like (access, correction, deletion, etc.) and enough detail for us to find your records — for example, the WhatsApp number or email you booked with. We'd rather you use email than WhatsApp for these requests specifically, so there's a clear written record on both sides. We may need to verify your identity before acting on a request.
We'd like the chance to sort out any concern directly first — contact us using section 19.
If you're in the EU/EEA, you also have the right to lodge a complaint with a data protection supervisory authority. Because we have an operations office in Poland, the relevant authority is the Urząd Ochrony Danych Osobowych (UODO) — Poland's Personal Data Protection Office — (website: uodo.gov.pl). You may also have the right to complain to the supervisory authority in your own EU/EEA country of residence.
If you're in India, the DPDP Act gives you the right to escalate an unresolved grievance to the Data Protection Board of India, the authority designated under the Act to hear it. You can also raise any DPDP Act-related concern with us directly using the contact details in section 19.
Most images on this site are loaded directly from third-party hosts, rather than proxied through our server — this is the default for images across the site, not a rare exception. Sources include Unsplash, picsum.photos, and a bucket at flybtc.blr1.digitaloceanspaces.com. When your browser loads one of those images, that host can see standard web request information (your IP address, browser type) the same way it would for any website that embeds its images, because they're serving the image directly to you.
We link out to our Instagram and Facebook pages. Those platforms are run by their own operators under their own privacy policies, which we don't control.
We may update this policy as our services, this website, or the law change. We'll update the “Last updated” date at the top when we do, and flag material changes more prominently.
This Privacy Policy is governed by the law of the country of the Hashloom office responsible for the data in question. Any dispute may be brought before the courts of that country. Nothing in this policy removes any mandatory data-protection or consumer-protection right you have under the law of the country where you live, where that law would otherwise apply.
For any privacy matter, the email above reaches the team responsible.