Toucan India
Privacy policy
This policy explains what personal data we collect through toucanindia.in, why, who we share it with, and the rights you have over it. It is written to meet India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Information Technology Act, 2000.
1. Who we are
Toucan India ("we", "us") is a MICE, corporate travel and event production company based at G-32, Lokmanya Pan Bazar Complex, Sion, Mumbai 400022, India. For the personal data described here, we are the Data Fiduciary under the DPDP Act.
2. What we collect
What you give us. When you brief us through T.O.C.O. or email us, we collect what you choose to share, which is typically:
- your name, company and email address;
- details of the programme you have in mind: type of event, number of guests, destinations or region, and timing;
- any question you ask, and the conversation itself.
Please do not share sensitive information such as passport numbers, health information or payment details through the website. We collect those, where a programme needs them, through separate and secure channels once we are working together.
What is collected automatically. Like any website, our hosting provider receives technical information when you visit: your IP address, browser and device type, the pages requested, and the time. We use this only to run and secure the site. We do not currently use analytics or advertising trackers.
3. T.O.C.O., our enquiry assistant
T.O.C.O. is an AI assistant that helps you put a brief together. Please know that:
- Your messages are processed by Google. What you type is sent, through our server, to Google's Gemini API to generate T.O.C.O.'s replies. Our access key never reaches your browser.
- Google may use these messages to improve its products. We use Gemini's free tier, under whose terms Google may use what is sent to it to improve its services, and people at Google may read it for that purpose. For this reason, please do not share anything confidential or personal beyond what a first enquiry needs. You can always write to us directly at hello@toucanindia.in instead.
- A finished brief comes to us by email. When the brief is complete, it is sent with the conversation to our team at hello@toucanindia.in, so that a named person can reply to you.
- Replies are not quotations or commitments. T.O.C.O. can be wrong. Nothing it says is an offer, a price or a booking; only a written proposal from our team is.
- The voice and the tilt stay on your device. T.O.C.O.'s spoken line uses your browser's built-in speech, and "follow your phone" uses your device's motion sensor. Neither sends anything to us.
By sending a brief through T.O.C.O., you consent to it being processed as described here. You can withdraw that consent at any time (see section 9).
4. How we use it
- To reply to your enquiry and prepare a proposal or costing.
- To plan and deliver a programme if you engage us, under the separate agreement we will make at that time.
- To keep a record of our correspondence with you.
- To keep the website running, secure and free of abuse.
- To meet legal, tax and accounting obligations.
We do not sell your personal data, and we do not use it for advertising. If we would like to send you updates about our work, we will ask you first, and you can say no or stop them at any time.
5. Who we share it with
We share personal data only with service providers who process it for us under contract, and only as much as they need:
- Website hosting: Cloudflare, Inc., which runs the site and its server functions.
- AI processing: Google LLC (Gemini API), for T.O.C.O.'s replies, on the terms described in section 3.
- Email delivery: Resend, which delivers completed briefs to our inbox.
- Our email provider: Google Workspace, which hosts hello@toucanindia.in.
If you engage us for a programme, we will share the details a programme needs with airlines, hotels, venues and ground partners. That is covered by our agreement with you, not by this website policy.
We may also disclose personal data where the law requires it, or to protect our rights, our clients or the public.
Other services on our pages. Our pages load typefaces from Google Fonts and code libraries from cdnjs and jsdelivr, which receive your IP address as any web request does. The Jukebox page plays music through YouTube's embedded player, which is governed by Google's own privacy policy and may set its own cookies when you press play. Links to LinkedIn, Instagram and Google Maps take you to those services and their own policies.
6. Transfers outside India
Several of the providers above process data outside India, mainly in the United States and the European Union. The DPDP Act allows this except to countries the Government of India restricts, and we will not transfer data to any restricted country.
7. How long we keep it
We keep enquiry data for as long as we need it to respond and to continue the conversation, and then for up to 24 months after our last contact, unless you ask us to delete it sooner. If you become a client, we keep programme records for as long as our agreement and tax or accounting law require. Technical logs held by our hosting provider are kept for short periods set by that provider.
8. Cookies and your device
Our website does not set cookies. It stores a single item in your browser's local storage, toucan-tilt, which remembers whether you allowed T.O.C.O. to follow your phone's movement, so you are not asked again. You can clear it at any time from your browser's settings. Third-party services such as YouTube may set their own cookies when you use them.
9. Your rights
Under the DPDP Act you have the right to:
- ask what personal data of yours we hold and how we have used it;
- have it corrected, completed or updated;
- have it erased where we no longer need it, or where you withdraw consent;
- withdraw your consent at any time. This does not affect what was done before you withdrew it;
- have your grievance addressed by us; and
- nominate someone to exercise these rights for you in the event of death or incapacity.
To exercise any of these, write to hello@toucanindia.in. We will reply within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
10. Security
The site is served only over encrypted connections (HTTPS). The keys to our AI and email services are held on our server and never in your browser, and access to enquiries is limited to the people who need it. No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires.
11. Children
Our website and services are for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, please tell us and we will delete it.
12. Changes to this policy
We may update this policy as the site or the law changes. The date at the top shows the latest version. If we change how we use personal data we already hold, we will tell you where we reasonably can.
13. Contact and grievances
Questions, requests and complaints about personal data:
Grievance Officer
Toucan India
G-32, Lokmanya Pan Bazar Complex, Sion, Mumbai 400022, India
hello@toucanindia.in