Policies · Hotel Villa EverestPrivacy Policy

This Privacy Policy is our notice to you under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, and our privacy policy under the Information Technology Act, 2000 and its rules. It explains, in plain language, what personal data we collect, why, who we share it with, how long we keep it, and how you can use your rights.

2.1 Who is responsible for your data

Villa Everest, operating Hotel Villa Everest and Everest Cafe, Lal Kothi Road (1 AJC Bose Road), Near Circuit House, Darjeeling, West Bengal 734101, is the Data Fiduciary: we decide why and how your personal data is processed. You, the person the data is about, are the Data Principal.

For privacy questions, requests or complaints, contact our Grievance Officer: [Grievance Officer Name], [grievance@hotelvillaeverest.com], +91 73648 54463.

2.2 What we collect, and why

Data we collect	Why we need it	Legal basis
Identity and contact: name, phone, WhatsApp number, email, city/country	To make and manage your booking, confirm it, and contact you about your stay	Your consent, given when you book or enquire
Booking details: dates, room, number of guests, special requests, arrival time	To provide the stay you booked	Your consent
Identity document at check-in: type and number of a government photo ID, and a copy where required (masked Aadhaar preferred)	To verify identity and keep the guest register required by law and local police	Legal obligation
Foreign nationals (including OCI cardholders): passport, visa, arrival details, address in India, next destination	To file Form-III (formerly Form C) with the immigration authorities within 24 hours of arrival	Legal obligation under the Immigration and Foreigners Act, 2025
Payment details: amount, date, transaction reference, last four digits or UPI ID	To take payments, issue GST invoices, and process refunds	Your consent and our tax obligations
Dietary needs and allergies you tell us about	To serve you food safely at Everest Cafe	Your consent
Communications: emails, WhatsApp messages, call notes, feedback, reviews	To answer you and improve our service	Your consent
Website data: IP address, browser, pages visited, cookies	To run the Website securely and understand how it is used	Your consent (for non-essential cookies)
CCTV images in public areas such as the entrance, reception and corridors (never in rooms or washrooms)	Safety and security of guests, staff and property	Legitimate use for safety and security permitted by law
Marketing preferences	To send offers and news, only if you opt in	Your separate, optional consent

We collect only what we need for these purposes. Giving us identity, contact and ID details is necessary to stay with us; marketing consent is always optional and never a condition of booking.

Aadhaar: we prefer a masked Aadhaar (showing only the last four digits) or DigiLocker verification. If you give us a full Aadhaar copy, we will mask the first eight digits before storing it.

2.3 Children’s data

We do not knowingly collect personal data directly from anyone under 18. Details of children travelling with a parent or guardian (name, age, and ID where the law requires it) are provided by, and processed with the consent of, that parent or guardian. We do not use children’s data for marketing, tracking or targeted advertising.

2.4 Who we share your data with

We never sell your personal data. We share it only as below, and only as much as each purpose needs.

Service providers who process data on our behalf (Data Processors), under contracts that require them to protect it:

• Booking engine and channel manager: [ResAvenue / provider name]
• Payment gateway: [Payment Gateway Name]
• Email and file storage: [e.g. Google Workspace]
• Messaging: WhatsApp Business (Meta), for booking communication you start or agree to
• Website hosting, security and analytics: [Hosting Provider], [Cloudflare], [Google Analytics]
• Accounting and GST filing: [Accountant / Software]

Partners you ask us to involve: for example, Atharva Travels for airport or railway transfers (your name, phone number, pick-up point and timing only).

Online travel agencies: if you booked through Booking.com, Agoda or a similar platform, that platform shares your booking details with us. The platform is a separate Data Fiduciary and its own privacy policy applies to what it collects.

Government and law enforcement, when required by law: the Bureau of Immigration / FRRO (Form-III for foreign guests), the local police (guest register inspections), tax authorities (GST records), or any court or authority with a lawful order.

2.5 Data stored outside India

Some of our service providers (for example email, messaging or cloud hosting) may store data on servers outside India. We use such providers only where the transfer is permitted under the DPDP Act and any restrictions notified by the Central Government, and only with providers that apply reasonable security safeguards.

2.6 How long we keep your data

Data	How long we keep it
Booking records, invoices and payment records	[8] years, to meet GST and income-tax record-keeping laws
Guest register and ID copies	[As long as required by the local police / for (period)], then securely deleted
Form-III records for foreign nationals	As long as required under the Immigration and Foreigners Rules, 2025
Enquiries that did not become a booking	[12] months from the last contact
Marketing list	Until you unsubscribe or withdraw consent
CCTV footage	[30] days, unless needed for an incident investigation
Website and system logs	At least one year, as required by the DPDP Rules, 2025

When a retention period ends, we delete or anonymise the data securely, unless a law requires us to keep it longer.

2.7 How we protect your data

We take reasonable security safeguards, including: HTTPS on the Website; access to guest data limited to staff who need it; strong passwords and two-step login on our email and booking accounts; locked storage for paper registers and ID copies; backups; and contracts requiring our processors to protect data. If a personal data breach occurs, we will inform you and the Data Protection Board of India as the DPDP Rules, 2025 require, and tell you what we are doing about it.

2.8 Your rights

As a Data Principal, you have the right to:

1. Access: get a summary of the personal data we hold about you and how we use it, and the names of those we have shared it with.
2. Correction and updating: ask us to correct inaccurate or incomplete data.
3. Erasure: ask us to delete data we no longer need, unless a law requires us to keep it (for example GST records or guest-register entries).
4. Withdraw consent: withdraw any consent you gave, as easily as you gave it. Withdrawal does not affect processing already done, and it may mean we cannot complete a pending booking.
5. Grievance redressal: complain to our Grievance Officer and receive a response within the timelines in clause 1.14.
6. Nominate: name another person to exercise your rights if you die or become unable to do so.

How to use these rights: email [grievance@hotelvillaeverest.com] or WhatsApp +91 73648 54463 with the subject “Privacy request”, your name, and your booking reference if you have one. We may ask you to confirm your identity before acting. To stop marketing at any time, click “unsubscribe” in any email or reply STOP on WhatsApp.

If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.

Your duties: under the DPDP Act, please give us accurate information, do not impersonate anyone, and do not file false or frivolous complaints.

2.9 Cookies

We use essential cookies to make the Website and booking engine work. With your consent, we also use analytics cookies to understand how visitors use the Website [and marketing cookies or pixels, e.g. Meta Pixel / Google Ads, to measure our advertising]. You can accept or reject non-essential cookies through the cookie banner and change your choice at any time in [Cookie Settings link]. Rejecting them does not stop you from booking.

2.10 Changes to this policy

We will post any changes here with a new “Last updated” date. If a change materially affects how we use data you have already given us, we will tell you and, where required, ask for fresh consent.