Effective Date: 23/10/2026

Last Updated: 23/10/2026

This Privacy Policy (“Policy”) describes how Esc Trips a dedicated travel vertical of Escape Plan (together with its website, mobile pages and any allied properties, the “Platform”), operated by Enchante Brands Private Limited (“EBPL”, “Company”, “we”, “us” or “our”), a company incorporated under the Companies Act, 2013, having its office at Unit 906-909, Sakti Statesman, 9th Floor, Green Glen Layout, No. 37/301/34/1, SY. No. 34, Ibblur Village, Begur Hobli, Bellandur, Bangalore, Bangalore South, Karnataka, India, 560103 (“Office”), collects, uses, stores, shares and protects the personal data of individuals (“User”, “Traveler”, “you” or “your”) who access or use the Platform, engage with our official channels, submit a Request, or make or travel on a Booking.

This Policy is prepared in accordance with applicable laws, including the Digital Personal Data Protection Act, 2023 and the rules made thereunder, including the Digital Personal Data Protection Rules, 2025 to the extent in force (together, the “DPDP Act”), the Information Technology Act, 2000 and the rules made thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), and the Consumer Protection (E-Commerce) Rules, 2020. For the purposes of the DPDP Act, the Company is the Data Fiduciary, and you are the Data Principal.

This Policy forms part of, and should be read together with, our Terms and Conditions (the “Terms”) published on the Platform. Capitalised terms used but not defined in this Policy shall have the meanings given to them in the Terms. This Policy applies to the Escape Plan trips vertical and is to be read with the Escape Plan Privacy Policy at https://myescplan.com/pages/privacy-policy. For the travel vertical, where the two differ, this Policy applies.

When you use the Platform, make a Request or confirm a Booking, you confirm that you have read this Policy. Where we need your consent, we ask for it separately, through a tick box or the cookie banner, and you may withdraw it at any time.

1. PERSONAL DATA WE COLLECT

1.1 The personal data we collect depends on how you interact with us, and may include the following:

(a) Contact and identity information: your name, age, email address and mobile number, and such other contact details as you provide to us.

(b) Booking information: your intended destination, travel dates, budget, the number and details of the Travelers in your Booking, your Package Plan and itinerary, the occupancy basis of your Booking, and your booking, payment, modification, cancellation and refund history.

(c) Request information: where you send a Request for an Invite-only Package Plan, your name, age, social media handle or handles and the other information the Request form asks for, together with content that is publicly available on any handle you give us and anything you share with us if we speak with you about your Request.

(d) Identity and travel documents: a valid government-issued photo identification, a copy of your passport and the details in it, visa, permit and other travel documents, proof of age for a minor Traveler, any declaration or waiver you sign before taking part in an adventure activity, and such other documents as the Company or a Service Provider may require to process your Booking.

(e) Tax and foreign exchange information: your Permanent Account Number (PAN), residency status, purpose of travel, source of funds, and other information and declarations required for Tax Collected at Source (TCS) under the Income Tax Act, 1961 and for compliance with the Liberalised Remittance Scheme (LRS) and other applicable Reserve Bank of India regulations.

(f) Health, dietary and accessibility information: any pre-existing medical condition or physical limitation, any condition requiring regular medication, any serious allergy, any mobility or accessibility requirement and any dietary requirement that you disclose, a medical fitness certificate where we require one, and information relating to any accident, injury, illness or emergency assistance during a trip.

(g) Supporting documentation: where you ask us to modify, reschedule or otherwise accommodate your Package Plan on account of a serious medical condition, bereavement or other significant personal exigency, the supporting documentation you provide, such as a medical certificate or death certificate.

(h) Insurance information: proof of your travel insurance policy, which is mandatory for every international Package Plan, and, where you opt for travel insurance as an Additional Service, the information the insurer or insurance intermediary requires to issue the policy.

(i) Payment information: details of your payment of the Request Fee and of the price of your Package Plan, your chosen payment method (including credit or debit card, net banking, UPI, bank transfer, transaction references and payment history), and the details required to process a refund to the original mode of payment. Card and payment credentials are processed by our payment gateway partners. We will never ask you for your OTP or card PIN.

(j) Communications: your correspondence with us through the Platform, WhatsApp, SMS, email and our customer support telephone number, and, where you are added to a messaging group for a trip, your mobile number, display name and the content you share in that group. We may keep records of chats and messages with us.

(k) Trip records: records of your participation in previous trips with us, including any incident, complaint or report concerning your conduct on a trip.

(l) Submitted Content: reviews, photographs, videos and other content relating to your trip that you submit to us.

(m) Trip Content: photographs, video and audio captured on or in connection with a trip by the Company, the Tour Captain, a Host, or any photographer, videographer or creator we appoint, in which you appear, including your image, likeness, voice and first name.

(n) Technical and usage information: your IP address, device identifiers, browser type, operating system, access times, referring URLs, pages viewed, session duration, clickstream and log information, information about how you use and engage with the Platform (such as the trips you view and the Requests and Bookings you make), and other information collected automatically through cookies and similar technologies, as described in Section 11.

(o) Preferences: your communication and marketing preferences and your account preferences on the Platform.

1.2 We collect personal data only for lawful purposes connected with the Platform and your Booking, and only to the extent necessary for those purposes.

2. HOW WE COLLECT PERSONAL DATA

2.1 We collect personal data:

(a) directly from you, when you use the Platform, contact us through our official channels, submit a Request, make or manage a Booking, submit documents or Submitted Content, or travel with us;

(b) from a User who makes a Booking on behalf of one or more Travelers;

(c) from content that is publicly available on a social media handle you give us in your Request;

(d) from the Tour Captain, a Host or a Service Provider in the course of delivering your Package Plan, including where an incident occurs during a trip; and

(e) automatically, through cookies and similar technologies, when you use the Platform, as described in Section 11.

2.2 Where you provide personal data relating to another person, including a Traveler named in your Booking, you represent that you are authorised to do so on that person’s behalf, that you have informed them of this Policy, and, in the case of a minor Traveler, that you are their parent or legal guardian or have that parent’s or guardian’s consent.

3. PURPOSES FOR WHICH WE USE PERSONAL DATA

3.1 We use your personal data for the following purposes:

(a) operating, maintaining and improving the Platform and our official channels;

(b) responding to your queries and requests, and providing customer support;

(c) reviewing a Request against the criteria set out in the Terms, assembling a group suited to the nature and composition of a trip, verifying the information you give us, issuing or withdrawing an Invitation, and processing the Request Fee and any refund of it;

(d) designing, finalising, confirming, modifying, rescheduling and cancelling a Package Plan and a Booking, including considering a request made on account of a serious medical condition, bereavement or other significant personal exigency;

(e) arranging the inclusions in your Package Plan, including accommodation, meals, transfers, sightseeing, activities and experiences, and any Additional Service you opt for, namely flights, visa advisory and documentation assistance, an eSIM or local SIM card, a forex card or foreign currency, and travel insurance;

(f) coordinating your trip through your Tour Captain and, on a Hosted Trip, enabling the Host to accompany the group;

(g) assessing your participation in any strenuous or adventure-based component of your Package Plan, accommodating dietary, medical and accessibility requests where we reasonably can, and arranging medical attention, evacuation or other emergency assistance where required;

(h) processing payments, instalments, refunds and credit notes;

(i) collecting and depositing TCS, and complying with LRS and other foreign exchange requirements;

(j) sending transactional communications relating to your Request, Booking or trip, including booking and payment confirmations, payment reminders, pre-trip information and cancellation or other updates, by WhatsApp, SMS, email or telephone call;

(k) operating a messaging group for a group trip;

(l) publishing Submitted Content and Trip Content for marketing, promotional and business purposes, in accordance with Section 7;

(m) where you have consented, informing you about other products, services, offers and brands operated by the Company or its group entities that may be of interest to you, subject to Section 14;

(n) tracking and analysing how you use and engage with the Platform, to provide and improve our services and, with your consent, to measure the effectiveness of our communications and advertising, as described in Section 11;

(o) conducting market research and analysis, and, where you choose to take part, running surveys, polls and newsletters;

(p) detecting, preventing and investigating fraud, misuse of the Platform and breaches of the Terms;

(q) enforcing the Terms and establishing, exercising or defending our legal rights; and

(r) complying with applicable law and the lawful requests of any governmental authority.

4. CONSENT AND WITHDRAWAL OF CONSENT

4.1 We process your personal data on the basis of your consent, or on any other lawful basis permitted under the DPDP Act, including where you have voluntarily provided personal data for a specified purpose, where processing is necessary to comply with law, or where it is necessary to respond to a medical emergency.

4.2 By initiating a query or a Booking, you consent to receiving transactional communications from us relating to your Booking by WhatsApp, SMS, email and telephone call. When you register, or make a Request or a Booking, we ask you to confirm by a tick box that you are at least 18 years old, that you accept the Terms and this Policy, and that we may track your use of and engagement with the Platform in order to provide and improve our services. This is needed to use the Platform. Marketing messages need your separate, optional consent, as described in Section 14.

4.3 You may withdraw your consent at any time by writing to us using the details in Section 17. Specifically: (a) you may opt out of marketing communications as described in Section 14.2; (b) you may withhold consent to the use of your Submitted Content by notifying us in writing, as described in Section 7.1; and (c) you may ask not to appear in Trip Content as described in Section 7.3. You may also change your cookie choice at any time through the cookie settings on the Platform, as described in Section 11.6.

4.4 On withdrawal of your consent, we will cease processing the relevant personal data within a reasonable time, unless its processing or retention is required or permitted under applicable law. Withdrawal does not affect processing carried out before it.

4.5 Some personal data is necessary to make and deliver your Booking. If you do not provide, or withdraw consent to the processing of, documents, tax information or health disclosures required under the Terms, we may be unable to confirm or proceed with your Booking or permit your participation in a particular component of it, and the Terms will apply to any resulting cancellation.

5. REQUESTS

5.1 When you send a Request, we use your name, age, social media handle or handles and the other information you provide to assess your fit for a trip, verify what you tell us, plan the trip and the group, and communicate with you. We may review content that is publicly available on the handles you give us, and may ask to speak with you before deciding.

5.2 We decide whether to issue an Invitation at our discretion, on the basic criteria set out in the Terms. We do not decide on any ground on which discrimination is prohibited by law.

5.3 Payment of the Request Fee is processed through our payment gateway partners. If a Request is not accepted, or an Invitation lapses or is withdrawn, we keep the information in the Request for [12] months and then erase or anonymise it, unless the law requires us to keep it longer.

6. HEALTH, DIETARY AND ACCESSIBILITY INFORMATION

6.1 We ask for health, dietary and accessibility information so that we can assess your participation in your Package Plan, particularly any strenuous or adventure-based component, accommodate your requests where we reasonably can, and keep you safe during your trip. Such information is sensitive personal data or information under the SPDI Rules, and we collect it only where it is necessary for these purposes.

6.2 After your Booking is confirmed, we share such information with the Tour Captain and the relevant Service Providers only to the extent that each of them needs it to deliver your Package Plan. We do not share it with a Host.

6.3 Where medical attention, evacuation or other emergency assistance is required during a trip, the Tour Captain may share relevant information with medical professionals, hospitals and emergency or evacuation services in order to arrange that assistance.

6.4 Medical certificates and other supporting documentation you provide with a request to modify or reschedule your Package Plan are used only to assess that request and, where relevant, to pursue recoveries from the relevant Service Providers.

7. SUBMITTED CONTENT AND TRIP CONTENT

7.1 Submitted Content. Where you submit reviews, photographs, videos or other content relating to your trip, we may use, reproduce, adapt and display it for marketing, promotional and business purposes across the Platform and other media operated by the Company, unless you notify us in writing that you withhold this consent. Submitted Content that is published on the Platform will be visible to other visitors to the Platform.

7.2 Trip Content. Trips are documented, and Trip Content in which you appear, including your image, likeness, voice and first name, may be used and published by the Company for its marketing, promotional and business purposes, on the Platform, on social media, and through partners, creators and media. The Company may extend this use to a Host for the purpose of that Host’s own content about the trip.

7.3 Opting out of Trip Content. You may tell us in writing before the trip begins, or tell the Tour Captain at any time during the trip, that you do not wish to appear in Trip Content. We will then take reasonable steps to exclude you from Trip Content published after your request. We cannot withdraw material already published, and we cannot guarantee that you will not appear incidentally in a group, crowd or background image, or in content published by a Fellow Traveler, by a Host in their personal capacity, or by any third party.

8. TRIP MESSAGING GROUPS AND FELLOW TRAVELERS

8.1 Before a group trip, we may add you to a messaging group for that trip, which will include your Fellow Travelers and the Tour Captain. A representative of the Company will be present in the group. If you prefer not to be added, tell us before departure and we will communicate with you individually.

8.2 Anything you share in the group, including your mobile number and display name, is visible to the other members of it. The group exists for the purposes of that trip only, may not be used for marketing, solicitation or the promotion of any business, and will be closed after the trip ends.

8.3 You must not use the personal information of a Fellow Traveler, a Host, the Tour Captain or any of our personnel obtained through a trip or a messaging group for any purpose other than the trip itself. We are not responsible for the use another member of a group makes of information you choose to share in it.

9. SHARING AND DISCLOSURE OF PERSONAL DATA

9.1 We may share your personal data, to the extent necessary for the purposes set out in this Policy, with:

(a) our authorised personnel who require access to it for those purposes;

(b) the Tour Captain and, on a Hosted Trip, the Host, to the limited extent described in Section 9.2;

(c) Service Providers involved in delivering your Package Plan, including airlines, accommodation, transport and activity providers and specialist guides;

(d) providers of any Additional Service you opt for, including flights, visa advisory and documentation providers, eSIM and SIM card providers (which, for international roaming eSIMs, are providers authorised by the Department of Telecommunications that contract with you directly and collect the identity and travel details required by law), forex card and foreign currency providers, and insurers and insurance intermediaries registered with the Insurance Regulatory and Development Authority of India;

(e) payment gateways, banks and, where you choose to pay by EMI, the relevant lender;

(f) third parties we engage for the provision and maintenance of the Platform and our business operations, including hosting, technology, analytics, advertising, communication and customer support providers;

(g) medical professionals, hospitals and emergency or evacuation services, in the circumstances described in Section 6.3; and

(h) government authorities, regulators, courts and law enforcement agencies, where required by applicable law or legal process, including the income tax authorities in connection with TCS, and the immigration or other authorities relevant to your itinerary.

9.2 After your Booking is confirmed, the information we share with the Tour Captain and the relevant Service Providers may include your name, contact details, identification and passport details, and any dietary, medical or accessibility information you have disclosed. On a Hosted Trip, we share with the Host only your name and such other information as the Host needs to take part in the trip with the group. Each of them is required to use it only for the purpose of delivering your Package Plan, to keep it secure, and to delete or return it afterwards.

9.3 Service Providers, providers of Additional Services, insurers, lenders, payment gateways, and advertising and analytics platforms may also process your personal data in accordance with their own terms and privacy policies, which apply in addition to this Policy.

9.4 We may also disclose your personal data where we reasonably believe it is necessary to enforce the Terms, to investigate or prevent fraud, misuse or other unlawful activity, or to protect the rights, property or safety of the Company, our Travelers, our personnel or others.

9.5 If the Company is involved in a merger, acquisition, restructuring or sale of its business, your personal data may be transferred to the successor, which must continue to protect it in line with this Policy.

9.6 We do not sell or rent your personal data to any third party.

10. INTERNATIONAL PACKAGE PLANS

10.1 Where your Package Plan involves travel outside India, your personal data will be shared with Service Providers and, where applicable, with embassies, consulates and immigration or other authorities located in the destination country, to the extent necessary to make and deliver your arrangements and to meet entry and exit requirements.

10.2 Such transfers are made in accordance with the DPDP Act, including any restriction notified by the Central Government on the transfer of personal data to a country or territory outside India. Personal data transferred outside India may be subject to the laws of the destination country.

11. USE OF COOKIES AND SESSION DATA

11.1 What cookies are. The Platform uses cookies, pixel tags, web beacons, clear GIFs and similar tracking technologies (together, “Cookies”) to operate the Platform, improve your experience of it, analyse traffic, remember your preferences, and measure the effectiveness of our communications and marketing campaigns. Cookies are small text files placed on your device when you visit the Platform, which enable us to recognise your browser or device over time. A Cookie may be a session Cookie, which is deleted when you close your browser, or a persistent Cookie, which remains on your device until it expires or you delete it.

11.2 Types of Cookies we use. We and our third-party service providers use the following categories of Cookies:

(a) Essential Cookies, which are required for the basic functionality of the Platform, such as navigating it, remembering your session while you submit an enquiry, a Request or a Booking request, keeping your account secure, processing payments securely, and detecting and preventing fraud and misuse, including through your device identifier;

(b) Performance and Analytics Cookies, which help us measure traffic to the Platform, understand how users interact with it, determine which destinations, Package Plans and parts of the Platform are of most interest to users, identify errors, and generate aggregate reports;

(c) Functional Cookies, which allow the Platform to remember your preferences and settings and the Package Plans you have viewed; and

(d) Advertising and Marketing Cookies, including those placed by our advertising partners, which enable us to deliver promotions for Package Plans and offers that are relevant to you, on and off the Platform, to limit the number of times you see a particular advertisement, and to measure the effectiveness of our advertising campaigns.

11.3 Pixel tags in emails. We and our service providers may use pixel tags and clear GIFs in our emails to understand whether an email has been opened and to measure the effectiveness of our communications.

11.4 Session and technical data. When you interact with the Platform, we and our third-party service providers also automatically collect technical and session information, including your IP address, device identifiers, browser type, operating system, access times, referring URLs, the pages you view, how frequently you visit, session duration, clickstream data and log information. This information is used primarily for analytics, fraud detection, improving the functionality of the Platform and ensuring the security of our systems. We also use it to understand how you use and engage with the Platform, so that we can provide and improve our services.

11.5 Third-party Cookies. Some Cookies on the Platform are placed by third-party analytics providers and advertising networks. For example, an advertising network may place a Cookie on your device when you click on one of our advertisements, so that it can tell whether you later visited the Platform. The use of such Cookies is governed by this Policy and by the privacy policy of the relevant third party, and we do not control the Cookies placed by third parties.

11.6 Your choices. When you first visit the Platform, you can choose “Accept All” or “Essential Only”. If you choose Essential Only, we use only Essential Cookies. If you choose Accept All, we also use Performance and Analytics, Functional, and Advertising and Marketing Cookies. You can change your choice at any time through the cookie settings on the Platform, and you can also manage, block or delete Cookies through your browser settings. Disabling some Cookies may limit the features available on the Platform.

11.7 Cookies and personal data. Information collected through Cookies that constitutes personal data is processed in accordance with this Policy. We do not sell or rent such information, and we do not direct targeted advertising at children.

12. DATA SECURITY

12.1 We employ reasonable procedural, technical and organisational security measures, in accordance with applicable law, designed to protect your personal data from unauthorised access, disclosure, alteration, misuse or loss. These include access controls that limit access to authorised personnel, and encryption and password protection where appropriate.

12.2 You are responsible for keeping your account credentials confidential. You should not share sensitive payment information, such as card numbers, CVV, OTPs or online banking credentials, with any person, including anyone representing the Company. The Company will never ask you for your OTP or card PIN.

12.3 No security measures are entirely free of risk. In the event of a personal data breach, we will take steps to investigate and mitigate it, and will notify affected Data Principals and the Data Protection Board of India in accordance with the DPDP Act.

13. RETENTION OF PERSONAL DATA

13.1 We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or for such longer period as is required under applicable law, including for tax, accounting and audit purposes, or for the establishment, exercise or defence of a legal claim.

13.2 Once the relevant purpose is fulfilled, or on withdrawal of your consent where no other lawful basis applies, we will erase or anonymise your personal data, unless its continued retention is required or permitted under applicable law.

13.3 Records of your participation in previous trips, including any incident, complaint or report concerning your conduct, are retained for 3 (three) years from the end of the relevant trip, so that they may be taken into account in reviewing any future Request.

14. MARKETING COMMUNICATIONS

14.1 Where you have given your consent, which we seek separately from your acceptance of the Terms, we may use your personal data to inform you about other products, services, offers and brands operated by the Company or its group entities that may be of interest to you.

14.2 You may withdraw this consent and opt out of such communications at any time, without affecting your use of the Platform or any existing Booking, through the unsubscribe option in any such communication or through your account preferences on the Platform. Opt-out requests may take up to 10 (ten) business days to process.

14.3 If you opt out of marketing communications, you will continue to receive transactional communications relating to your Request, Booking or trip.

15. YOUR RIGHTS

15.1 Subject to the DPDP Act and applicable law, you have the right to:

(a) obtain a summary of the personal data we process about you and the processing activities we undertake with it, and the identities of those with whom we have shared it;

(b) seek correction, completion or updating of your personal data;

(c) seek erasure of your personal data, where it is no longer necessary for the purpose for which it was collected and its retention is not required under applicable law;

(d) withdraw your consent, as described in Section 4.3;

(e) avail of the grievance redressal mechanism described in Section 17; and

(f) nominate another individual to exercise your rights in the event of your death or incapacity.

15.2 You may exercise these rights by writing to the Grievance Officer using the details in Section 17. We may ask for information reasonably necessary to verify your identity before acting on a request. Where you have published Submitted Content, or Trip Content in which you appear has already been published, we may not be able to remove it from every place in which it appears. We will respond to your request within thirty (30) days, and in any case within ninety (90) days.

15.3 You must ensure that the personal data you provide to us is accurate, complete and up to date, and must promptly notify us of any change to it.

16. CHILDREN

16.1 Any individual using the Platform or entering into a Booking must be at least 18 years of age. Every Traveler on an Invite-only Package Plan (including every Hosted Trip) must be at least 18 years of age at the date of departure.

16.2 A minor may be a Traveler on other Package Plans, in accordance with the Terms. Where a Booking involves a minor Traveler, we process the minor’s personal data only with the verifiable consent of their parent or legal guardian, and only to the extent necessary to make and deliver the Booking. We do not undertake tracking or behavioural monitoring of children, or direct targeted advertising at them.

17. GRIEVANCE OFFICER

17.1 For any questions, requests, complaints or grievances relating to this Policy or the processing of your personal data, including to exercise any of your rights, please contact:

Name: Vishal Chaurasia

Designation: Grievance Officer

Email: care@enchantebrands.com

Contact Number: 9740508909

Address: Unit 906-909, Sakti Statesman, 9th Floor, Green Glen Layout, No. 37/301/34/1, SY. No. 34, Ibblur Village, Begur Hobli, Bellandur, Bangalore, Bangalore South, Karnataka, India, 560103

17.2 Grievances are handled in accordance with Section 27 of the Terms and applicable law, including the Information Technology Act, 2000, the rules made thereunder, and the Consumer Protection (E-Commerce) Rules, 2020. We will acknowledge your grievance within [forty-eight (48)] hours of receipt and endeavour to redress it within fifteen (15) days of receipt.

18. CHANGES TO THIS POLICY

18.1 We may update or amend this Policy from time to time to reflect changes in our services, business operations or legal requirements. All updates will be published on the Platform with the “Last Updated” date revised accordingly.

18.2 We encourage you to review this Policy periodically. Your continued use of the Platform after an updated Policy is published constitutes your acknowledgement of it. Where a change requires your consent under applicable law, we will seek it.