Draft — pending review by legal counsel before launch. Items in brackets are finalised when the operating entity is incorporated.
This notice explains what personal data [Operating entity — set at incorporation] (“Visit Valparai”, “we”) collects when you use visitvalparai.com, why, and the choices you have. We are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023. We show this notice before you consent, and we ask for consent for a specific purpose — never a single blanket tick.
What we collect
- Guests: your name, and your phone number or email address (to sign you in with a one-time code); your booking details (dates, guests, the property); your messages about a booking; basic device information; and your consent records.
- Payments: handled by our payment processor (Razorpay). We do not store your card, UPI or bank details — only a reference to the transaction.
- Hosts: name, phone, a tax identifier (PAN or Aadhaar) and, if applicable, GSTIN and bank details. Your PAN/Aadhaar number is never stored in readable form — we keep only the last four digits and a one-way hash.
Why we use it
- To run the booking service — search, hold a room, contact the host to confirm, and confirm your stay.
- To take payment, refund you, and pay hosts.
- To meet our legal obligations (tax withholding and GST).
Our legal basis is your consent, given when you sign in or when a host is onboarded. You can withdraw it at any time (see “Your rights”).
Who we share it with
- Your host — only after a booking is confirmed do we share your name and contact so you can coordinate your stay. Never before.
- Our payment processor (Razorpay) to take payment and issue refunds/payouts.
- Communication providers to deliver your one-time code and, for hosts, the confirmation call/message.
We do not sell your personal data, and we do not compile it across sources for advertising.
How long we keep it
We keep booking and payment records for as long as tax law requires us to. Other personal data is kept until you ask us to erase it, or your account is closed.
How we protect it
Data is encrypted in transit and at rest. Aadhaar and PAN are stored only as a masked reference and a hash — never the full number. Access to personal data is limited and logged.
Your rights
- Access / portability — download everything we hold about you from your account (“Download my data”).
- Erasure — delete your account from your account page. We anonymise your data, keeping only the booking/payment records tax law requires (which then carry no personal identifiers).
- Withdraw consent — for any contact channel, at any time.
- Grievance — contact our Grievance Officer below; we will respond within the timeframe the DPDP Rules require.
Breach notification
If a personal-data breach occurs, we will notify the Data Protection Board and affected users as required by the DPDP Act and Rules.
Grievance Officer
[Grievance Officer name] · [grievance@visitvalparai.com]
[Operating entity — set at incorporation], [Registered address — set at incorporation]