What they may do · DPDP §6(4)
What IRCTC does with your data
India's government-owned rail ticketing body runs cookie-based advertising against your booking history and passes you to its alliance partners and vendors so they can send you promotions. Its privacy policy does not print a single email address or officer to complain to.
-
Shares your data with partners
Passed to group companies, advertisers or analytics firms you never chose.
What this costs you. Your number and habits travel to companies you have never heard of and never agreed to. This is the step where the spam calls start.
Show me where they say that
IRCTC’s own policy says “IRCTC does not sell or rent individual customer names or other Personal Information of Users to third parties except sharing of such information with our business / alliance partners or vendors who are engaged by us for providing various referral services and for sharing promotional and other benefits to our customers from time to time on the basis their booking history with us.”
Our summary shares with business/alliance partners and vendors for referral services and promotions, based on your booking history.
-
Builds an advertising profile of you
They watch what you view, tap and buy, and use it to decide which ads you see.
What this costs you. Your attention gets priced. What you hesitate over becomes a bid — and a profile built to predict you is a profile built to persuade you.
Show me where they say that
IRCTC’s own policy says “In order to identify your interest in our products, and to track the effectiveness of advertising served by us, such cookies are used.”
Our summary uses cookies to identify your interest in its products and to track advertising effectiveness.
What the policy does not mention
These are uses IRCTC’s policy is silent on. Silence is not a promise — it means the document does not say, and we do not infer either way.
- Follows you onto other websites and apps
- Keeps your records long-term
- Processes your face or other biometrics
- Trains AI models on your content
IRCTC is one app. How many are on your phone?
Most people carry twenty to forty. Add yours and see the total in one screen — how many share your data, profile you for ads, or follow you across the web. Then take it back from all of them at once.
Manage my data with Saaph.in →Free to check · no account needed · built in India for the DPDP Act
Questions
What does IRCTC do with my personal data?
According to IRCTC's own privacy policy, read on 2026-08-12, it discloses 2 of the six uses we track: shares your data with partners, builds an advertising profile of you.
Can I withdraw my consent from IRCTC?
Section 6(4) of India's Digital Personal Data Protection Act 2023 gives you the right to withdraw consent for processing you agreed to. The Act's substantive provisions commence in stages up to May 2027, so a request made now asks for voluntary compliance and puts the date on record. Processing a company carries out under a legal obligation — such as KYC records the RBI requires — cannot be withdrawn.
Does IRCTC track me for advertising?
Yes — IRCTC's published policy discloses this. The exact sentence it is based on is quoted on this page, with the date we read it and a link to the source.
Every use above is one IRCTC declared in its own published privacy policy, which we
read on 2026-08-12. Quotes are verbatim; the summary beside each one is ours
and is labelled as ours. Nothing here is inferred.
Saaph.in is a DPDP consent and request management platform operated by Ronin Works
Private Limited. It is a communication facilitator, not your legal or authorised
representative. The DPDP Act 2023 commences in stages up to May 2027, so a request
made today asks for voluntary compliance and records the date you asked.
Our privacy policy