1. Introduction

At iZhinga, we value your trust and are committed to protect your privacy and personal data. We believe that safeguarding your information is fundamental in delivering a safe, transparent, and reliable travel experience. This Privacy Policy explains how we collect, use, process, store, share, retain, and protect your personal data when you use our Platform and the services offered through it.

iZhinga is owned and operated by MOVODREAM PRIVATE LIMITED ("Company", "we", "our" or "us"). The Platform offers AI-assisted travel discovery, itinerary planning, booking facilitation, destination information, customer support, payment-related services, and other travel-related features designed to enhance your travel experience. This Privacy Policy applies to all personal data processed by us in connection with these services.

We process your personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), other applicable laws of India, and recognised industry practices relating to data privacy and information security. For the purposes of the DPDP Act, MOVODREAM PRIVATE LIMITED acts as the Data Fiduciary, while the individuals whose personal data is processed under this Privacy Policy are the Data Principals.

This Privacy Policy is intended to help you understand what information we collect, why we collect it, how we use and protect it, with whom it may be shared, and the rights available to you in relation to your personal data.

By accessing or using the Platform, creating an account, making a booking, submitting information, or otherwise using our services, you acknowledge that you have read and understood this Privacy Policy. Where consent is required under applicable law, we may seek your free, specific, informed, unconditional, and unambiguous consent through a separate notice or consent mechanism before processing your personal data for such purpose.

2. Definitions

For the purposes of this Privacy Policy, unless the context otherwise requires, the following terms shall have the meanings assigned to them below:

2.1 "Company" means MOVODREAM PRIVATE LIMITED, the owner and operator of the iZhinga Platform.

2.2 "Platform" or "iZhinga" means the iZhinga mobile application and all related digital services, features, communication channels, and technology interfaces owned or operated by the Company for providing travel-related services.

2.3 "User", "You" or "Your" means any individual who accesses, browses, registers on, transacts through, or otherwise uses the Platform.

2.4 "Personal Data" shall have the meaning assigned to it under the Digital Personal Data Protection Act, 2023, and means any data about an individual who is identifiable by or in relation to such data.

2.5 "Processing" means any operation performed on Personal Data, whether by automated or non-automated means, including collection, recording, organisation, storage, use, adaptation, retrieval, sharing, disclosure, transmission, transfer, restriction, erasure, or destruction.

2.6 "Data Principal" shall have the meaning assigned to it under the Digital Personal Data Protection Act, 2023, and refers to the individual to whom the Personal Data relates.

2.7 "Data Fiduciary" means MOVODREAM PRIVATE LIMITED, which determines the purpose and means of processing Personal Data collected through the Platform.

2.8 "Third-Party Service Provider" means any independent entity that provides or facilitates travel-related or supporting services through the Platform, including but not limited to airlines, hotels, bus operators, cab operators, activity providers, insurance providers, payment gateways, technology partners, analytics providers, customer support partners, and other service providers engaged by the Company.

2.9 "AI Services" means artificial intelligence-powered features available on the Platform, including travel recommendations, itinerary generation, destination intelligence, conversational assistance, personalised suggestions, and other automated features designed to enhance the user experience.

2.10 "Applicable Law" means all applicable laws, rules, regulations, notifications, circulars, directions, and governmental or regulatory requirements in force in India, including the Digital Personal Data Protection Act, 2023, and any amendments, rules, or subordinate legislation issued thereunder.

2.11 "Travel Services" means travel-related products, services, experiences, and facilities made available through the Platform, including transportation, accommodation, activities, destination information, itinerary planning, Local Guru services, and allied travel assistance.

(Unless the context otherwise requires, words importing the singular shall include the plural and vice versa, and references to any law shall include any amendment, modification, re-enactment, or replacement thereof from time to time.)

3. Scope and Applicability

This Privacy Policy applies to every individual who accesses, browses, registers on, interacts with, or uses the iZhinga Platform for travel discovery, itinerary planning, booking facilitation, customer support, payment-related services, or any other services offered by MOVODREAM PRIVATE LIMITED.

The Policy governs the processing of Personal Data collected through your interaction with the Platform, whether while creating an account, making enquiries, completing bookings, availing services, communicating with customer support, participating in promotional activities, or providing feedback and reviews.

The Company may, where necessary for providing the services requested by you, share limited Personal Data with carefully selected Third-Party Service Providers such as airlines, hotels, transport operators, activity providers, payment gateways, insurance partners, technology partners, and other service providers associated with the Platform. Such sharing shall be limited to the information reasonably required for the performance of the relevant service.

The Company endeavours to engage business partners who maintain appropriate standards of privacy, confidentiality, and information security and expects them to process Personal Data only for authorised purposes and in accordance with applicable law and contractual obligations. The Company shall take reasonable measures to safeguard Personal Data shared for service fulfilment and to promote responsible data handling practices across its service ecosystem.

This Privacy Policy governs the processing of Personal Data by MOVODREAM PRIVATE LIMITED in connection with the operation of the iZhinga Platform. Where a Third-Party Service Provider independently processes your Personal Data for the performance of its own contractual, operational, or statutory obligations, such processing may also be subject to the privacy practices and legal obligations applicable to that service provider.

Nothing contained in this Privacy Policy shall diminish the Company's commitment in protecting your Personal Data or exercising reasonable care while sharing such data for legitimate service delivery purposes.

4. Information We Collect

Depending on the services used by you, the permissions granted by you, and your interaction with the Platform, the Company may collect the following categories of Personal Data:

4.1 Registration Information

When you create an account or register on the Platform, we may collect information such as your name, mobile number, email address, date of birth, profile photograph, and such other information as may be made available through authorised social login providers.

Registration on the Platform may be completed through Mobile OTP, Email OTP, Google Login, Facebook Login, or other login methods supported by the Platform from time to time.

4.2 Booking and Travel Information

In order to facilitate Travel Services requested by you, we may collect information relating to travellers and bookings, including passenger names, mobile numbers, email addresses, age or date of birth, gender, travel preferences, itinerary details, and booking-related information.

Where required by airlines, aggregators, regulatory authorities, or applicable law, additional information such as PAN details, passport information, VISA information, or GST details may also be collected for booking fulfilment and compliance purposes.

4.3 Payment Information

All payments made through the Platform are processed through authorised payment gateways and payment service providers.

The Company does not store complete credit card details, debit card details, bank account information, UPI PINs, or other payment credentials. However, we may retain limited transaction-related information, including transaction references, payment status, refund information, and other details reasonably required for reconciliation, customer support, dispute resolution, fraud prevention, and compliance purposes.

4.4 Device and Technical Information

To maintain the security, performance, and reliability of the Platform, we may collect certain technical information relating to the device used to access our services, including Device ID, IP address, operating system, application version, device type, device model, and device time zone.

Such information is used for account security, fraud prevention, device authentication, troubleshooting, analytics, system administration, service improvement, and personalisation of user experiences.

4.5 Location Information

Subject to your device settings and permissions, the Platform may collect location information to provide location-based services and enhance your travel experience.

Location sharing is generally optional and may be used for journey planning, personalised recommendations, nearby attractions, Local Guru suggestions, travel assistance, destination intelligence, and AI- assisted travel guidance.

4.6 AI and Preference Information

To improve the relevance and quality of recommendations made through the Platform, we may collect and process information relating to your searches, travel preferences, itinerary selections, recommendation history, interactions with AI-powered features, and other usage patterns.

Such information helps us better understand user preferences, improve our services, and provide more relevant and personalised travel experiences.

4.7 Customer Communication Information

We may collect and retain information shared by you when you communicate with us through customer support channels, emails, chats, telephone calls, messaging platforms, feedback forms, surveys, or similar communication channels.

Such information may be used for resolving customer queries, service improvement, quality monitoring, training, dispute resolution, fraud prevention, and compliance with legal obligations.

4.8 User Content and Reviews

The Platform may permit users to submit reviews, ratings, photographs, comments, travel experiences, and other content.

While ownership of such content remains with the respective user, the Company may display, moderate, reproduce, analyse, and use such content within the Platform for service improvement, promotional activities, customer engagement, and related business purposes, subject to applicable law and the rights granted by the user.

4.9 Marketing and Analytics Information

We may collect information relating to user interactions with the platform, promotional campaigns, offers, rewards programmes, and marketing initiatives.

Such information may be used to understand user behaviour, improve services, generate analytics, measure campaign effectiveness, and provide personalised offers, recommendations, and rewards based on user preferences and interactions with the Platform.

4.10 Information Received from Third Parties

The Company may receive limited information from authorised third- party service providers, social login providers, payment partners, travel service providers, analytics providers, and other business partners in connection with the services requested by you.

Such information is collected only where necessary for service delivery, account management, fraud prevention, customer support, regulatory compliance, or improvement of the Platform and its services.

5. How We Use Your Information

The Company uses Personal Data collected through the Platform to provide, operate, improve, and secure its services and to deliver a seamless travel experience to users. Depending upon the nature of your interaction with the Platform and the services availed by you, your Personal Data may be used for one or more of the following purposes:

 To create, verify, maintain, and manage your account on the Platform.

 To facilitate travel bookings, itinerary planning, Local Guru services, customer assistance, payment processing, confirmations, cancellations, modifications, refunds, and other Travel Services requested by you.

 To communicate with you regarding bookings, transactions, service updates, customer support requests, feedback, and other matters relating to your use of the Platform.

 To personalise your experience by providing relevant travel suggestions, destination information, recommendations, offers, rewards, and other content that may be of interest to you.

 To improve the quality, functionality, performance, and reliability of the Platform, including the development of new features, products, and services.

 To maintain platform security, detect and prevent fraud, investigate suspicious activities, protect user accounts, and safeguard the integrity of our systems and services.

 To analyse user behaviour, usage trends, and service performance for business planning, analytics, operational improvement, and decision- making purposes.

 To comply with applicable laws, regulatory requirements, lawful requests from government authorities, court orders, tax obligations, audit requirements, and other legal responsibilities.

 To establish, exercise, or defend legal claims, protect the rights and interests of the Company, its users, business partners, and other stakeholders, and prevent misuse of the Platform.

 To send promotional communications, marketing information, offers, campaigns, and updates relating to our services, where permitted by applicable law and subject to your communication preferences.

The Company processes Personal Data only for lawful and legitimate purposes connected with the operation of the Platform, the provision of Travel Services, compliance with legal obligations, protection of user interests, improvement of services, and such other purposes as may be permitted under applicable law.

6. Sharing of Information and Third-Party Service Providers

The Company respects the confidentiality of your Personal Data and does not sell your Personal Data to third parties for commercial gain.

However, in order to provide Travel Services and operate the Platform effectively, the Company may share Personal Data with selected Third-Party Service Providers and business partners on a need-to-know basis and only to the extent reasonably necessary for the relevant purpose.

Personal Data may be shared with:

 Airlines, hotels, transport operators, activity providers, insurance providers, and other travel service providers for booking fulfilment and service delivery.

 Payment gateways, payment service providers, banking partners, and financial institutions for processing payments, refunds, chargebacks, and related transactions.

 Technology service providers, cloud service providers, analytics partners, customer support partners, and other vendors who assist in operating, maintaining, securing, and improving the Platform.

 Social login providers and authentication partners where you choose to register or access the Platform through such services.

 Professional advisers, auditors, consultants, legal representatives, insurers, or other authorised persons where such disclosure is necessary for legitimate business, legal, compliance, or risk management purposes.

 Government authorities, regulatory bodies, law enforcement agencies, courts, tribunals, or other competent authorities where disclosure is required under applicable law or pursuant to a lawful request or order.

The Company shares Personal Data only to the extent reasonably necessary for the provision of services, compliance with legal obligations, prevention of fraud, protection of user interests, operation of the Platform, or other legitimate purposes permitted under applicable law.

The Company endeavours to engage business partners and service providers who maintain appropriate standards of privacy, confidentiality, and information security and may require such parties to comply with applicable contractual and legal obligations relating to the protection of Personal Data.

While the Company takes reasonable measures to safeguard Personal Data shared for legitimate service delivery purposes, independent Third-Party Service Providers may remain responsible for their own acts, omissions, and data processing activities undertaken in violation of applicable law or contractual obligations.

Where the Company becomes aware of any unauthorised use, disclosure, or misuse of Personal Data by a Third-Party Service Provider, it may take appropriate contractual, operational, or legal measures, as considered necessary and reasonably practicable under the circumstances and in accordance with applicable law.

7. AI Features and Personalisation

The Platform uses artificial intelligence ("AI") technologies and automated tools to enhance user experience, improve service delivery, and provide personalised travel assistance.

AI-powered features use information such as your travel preferences, search history, itinerary selections, booking history, interactions with the Platform, and location information (where permitted by you) to generate personalised recommendations, destination insights, Local Guru suggestions, travel guidance, relevant offers, and other content tailored to your interests and travel requirements.

The Company also uses analytical and aggregated information to improve the accuracy, relevance, quality, and effectiveness of AI-powered services and recommendations available on the Platform.

AI-generated recommendations are intended to assist users in discovering destinations, planning journeys, and making informed travel decisions. Such recommendations are generated using information available to the Platform, user preferences, travel patterns, destination intelligence, Local Guru insights, and other relevant inputs available at the time of processing.

The Company continuously endeavours to improve the accuracy, relevance, and usefulness of AI-powered services. However, travel-related information and circumstances may evolve over time due to factors such as weather conditions, service availability, local developments, regulatory changes, schedules, pricing, and other external influences. Accordingly, AI-generated recommendations and travel guidance should be viewed as decision-support tools designed to enhance the travel experience and assist users in making well-informed choices.

The Company remains committed to using AI technologies responsibly and in a manner that supports user interests, improves service quality, and enhances the overall travel experience.

8. Data Retention

The Company retains Personal Data only for as long as it is reasonably necessary to fulfil the purposes for which it was collected, provide services requested by users, maintain business records, resolve disputes, support customer service requirements, comply with contractual obligations, and meet applicable legal, regulatory, taxation, accounting, audit, or reporting requirements.

The retention period applicable to different categories of Personal Data may vary depending upon the nature of the information, the services availed by the user, applicable legal requirements, operational needs, and legitimate business purposes.

Where Personal Data is no longer required for the purposes for which it was collected, and subject to applicable legal, regulatory, contractual, audit, taxation, fraud prevention, or record-keeping requirements, the Company shall take reasonable steps to delete, anonymise, aggregate, archive, or securely dispose of such information in a manner consistent with applicable law, industry practices, and responsible data management principles.

Users may request deactivation or deletion of their account, subject to any legal, regulatory, contractual, fraud prevention, dispute resolution, audit, taxation, or record-keeping requirements that may require the Company to retain certain information for a longer period.

The Company periodically reviews its data retention practices to ensure that Personal Data is not retained for longer than reasonably necessary for legitimate business, operational, or legal purposes.

9. Cookies and Similar Technologies

The Platform uses cookies and similar technologies to operate efficiently, maintain security, enhance user experience, and improve the services made available through the Platform.

These technologies may be used to remember user preferences, support account login and authentication, maintain secure sessions, understand usage patterns, improve Platform performance, prevent fraud, and support the efficient functioning of the Platform.

The Company may also use analytics tools and similar technologies to better understand how users interact with the Platform, improve service quality, enhance functionality, develop new features, and improve the overall user experience.

Where required under applicable law, the Company may obtain consent for the use of certain cookies or similar technologies. Users may also manage or restrict certain permissions and settings through their browser, device, or application settings, subject to the limitations of the relevant technology.

Please note that restricting or disabling certain cookies, permissions, or similar technologies may affect the availability, functionality, performance, or user experience of certain features of the Platform.

10. Data Security

The Company is committed to protecting Personal Data and maintaining appropriate standards of information security. The Company implements reasonable technical, administrative, organisational, and security measures designed to safeguard Personal Data against unauthorised access, use, disclosure, alteration, loss, destruction, misuse, or other unlawful processing.

Such measures may include access controls, authentication mechanisms, encryption, monitoring systems, secure data storage practices, periodic security reviews, vulnerability management processes, and other safeguards appropriate to the nature of the information being processed and the risks associated with such processing.

The Company stores and processes Personal Data using infrastructure located in India and endeavours to maintain its data management and information security practices in accordance with applicable Indian laws, regulatory requirements, and relevant governmental guidelines.

Access to Personal Data is limited to authorised personnel, service providers, and business partners who require such access for legitimate business, operational, legal, compliance, or service-related purposes and who are subject to appropriate confidentiality, contractual, or legal obligations.

The Company periodically reviews and strengthens its information security practices to address evolving technologies, operational requirements, cybersecurity risks, and regulatory expectations.

While the Company takes reasonable and appropriate measures to protect Personal Data, no method of transmission over the internet, electronic storage system, or technology platform can be guaranteed to be completely secure. Accordingly, the Company cannot guarantee absolute security of Personal Data, though it remains committed to maintaining and continuously improving its security safeguards.

In the event the Company becomes aware of any actual or suspected security incident affecting Personal Data, it may take such remedial, investigative, containment, recovery, notification, or other measures as may be considered appropriate under the circumstances and in accordance with applicable law.

11. Managing Your Personal Data

The Company seeks to provide users with reasonable options to access, review, update, manage, and control their Personal Data, subject to applicable law and legitimate business, operational, legal, regulatory, security, and compliance requirements.

Users may review, update, correct, or request modification of Personal Data maintained by the Company, where such requests are permissible under applicable law and reasonably capable of being implemented by the Company.

Users who no longer wish to receive promotional communications may opt out by following the instructions contained in such communications or by contacting the Company. However, the Company may continue to send communications relating to bookings, transactions, account administration,

security, legal obligations, customer support, or other service-related matters.

Users may request deactivation or deletion of their account and associated Personal Data. Such requests shall be processed subject to applicable legal, regulatory, contractual, fraud prevention, dispute resolution, taxation, audit, record-keeping, security, and other legitimate business requirements that may require the Company to retain certain information.

Before acting upon requests relating to Personal Data, the Company may take reasonable steps to verify the authenticity of such requests in order to protect user privacy, maintain security, prevent fraud, and comply with applicable law.

Users may contact the Company through the grievance redressal mechanism described in this Privacy Policy for any questions, concerns, requests, or complaints relating to the collection, use, disclosure, retention, correction, deletion, or processing of their Personal Data.

12. Children's Privacy

The Platform may be accessed and used by individuals of different age groups. However, bookings, purchases, and other transactions through the Platform should be undertaken by persons who are legally competent to enter into binding agreements under applicable law.

The Company recognises that certain Travel Services may involve travel arrangements for children and minors. Accordingly, Personal Data relating to children may be collected and processed where such information is provided in connection with a booking, travel arrangement, customer support request, regulatory requirement, or other legitimate service-related purpose.

The Company expects that any person providing Personal Data relating to a child through the Platform has the necessary authority to do so and provides such information only to the extent reasonably required for the relevant Travel Service or related purpose.

The Company endeavours to process Personal Data relating to children with appropriate care and in accordance with applicable law. Parents, guardians, or authorised representatives who have questions or concerns regarding the processing of a child's Personal Data may contact the Company through the grievance redressal mechanism described in this Privacy Policy.

13. Changes to this Privacy Policy

The Company recognises that privacy, technology, business practices, and regulatory requirements continue to evolve over time. Accordingly, the Company may review, update, amend, or revise this Privacy Policy from time to time to ensure that it remains accurate, relevant, and consistent with applicable legal, regulatory, operational, and business requirements.

Such changes may become necessary due to, among other things, changes in applicable laws, judicial decisions, governmental or regulatory requirements, introduction of new products, services, business models, AI- powered features, technology integrations, payment systems, data collection or processing practices, cybersecurity requirements, organisational restructuring, mergers, acquisitions, or other developments affecting the Company's operations or the services offered through the Platform.

Any revised version of this Privacy Policy shall be made available through the Platform and shall become effective from the date specified therein, unless otherwise required under applicable law.

Where the Company considers a change to be material, or where required under applicable law, users may be informed of such changes through the Platform, email, mobile application notifications, or other reasonable means of communication.

Users are encouraged to review this Privacy Policy periodically to remain informed about how the Company collects, uses, shares, retains, and protects Personal Data

14. Grievance Redressal and Contact Details

The Company values user trust, feedback, and engagement. Feedback, suggestions, and comments from users help the Company improve its services, strengthen user experience, and enhance the overall quality of the Platform. While providing feedback is entirely voluntary, users are encouraged to share their suggestions, observations, or concerns regarding the Platform and the services offered through it.

The Company is also committed to addressing concerns relating to the collection, use, disclosure, retention, security, correction, deletion, or other processing of Personal Data in a fair, transparent, and timely manner. Users

who have questions, concerns, complaints, requests, or grievances relating to their Personal Data or this Privacy Policy may contact the Grievance Officer using the details provided below.

Grievance Officer

Name: Arjun Bali

Designation: VP Product, Supply & Quality

Email: Arjun.bali@movodream.com

Contact Number: +91 9463411290

The Company shall endeavour to review and respond to grievances and privacy-related concerns within a reasonable period of time and in accordance with applicable law.

15. Our Commitment to Privacy

The Company appreciates the trust placed in it by its users and remains committed to handling Personal Data in a responsible, transparent, and secure manner. This Privacy Policy is intended to help users understand how their Personal Data is collected, used, shared, retained, and protected while using the Platform and the Travel Services offered through it.

By maintaining appropriate privacy and security practices and continuously improving its processes, the Company seeks to provide a safe, reliable, and user-centric digital travel experience for all users.

This Privacy Policy shall be effective from July 2026 and shall remain in force until amended, modified, or replaced in accordance with Section 13 of this Privacy Policy.