This Privacy Policy (“Policy”) outlines how we collect, use, and protect your data when you book accommodations, and treatments at our spa, attend events, dine in our restaurants, or use any of the services provided at our properties. It explains the types of personal data we collect, the reasons for collecting it, how it is used, and the legal grounds for processing your data. Additionally, it explains your rights under applicable data protection laws, including the General Data Protection Regulation (GDPR) and the India Data Protection Act 2018.

“Personal data” refers to any information that can identify you.

By submitting your data, you agree to the terms of this Privacy Policy, so please review it carefully.

The entity responsible for your personal data is the company with whom you make a reservation (“Company,” “we,” “us,” “our”).

When you make a reservation, we collect the following personal data:

• Contact Information: First and last name, mailing address, email address, and phone number.
• Language Preference.
• Payment Information: Credit card number or payment account details, billing address, and other payment details.
• Communications: Copies of any correspondence with us.
• Guest Stay Details: Properties where you stayed, dates of arrival and departure, goods and services purchased.
• Reservation Specifics: Gender, date of birth, important dates (birthdays, anniversaries), names of other guests, meal preferences, health conditions, or other special requests.

Other Information: We may automatically collect data when you visit our website, including through cookies and similar technologies. Please refer to the privacy policy on our website for more details.

Sensitive Data: In some instances, we may collect sensitive personal data, such as health information (e.g., allergies or health conditions). We will seek your explicit consent for such data and use it only for the specific purposes communicated to you. In certain cases, processing sensitive data may be necessary to protect your or someone else's vital interests, or for public health reasons.

If you provide personal data about others (e.g., booking for someone else), you confirm that you have the authority to do so and consent to our use of that data per this Policy.

Some personal data is necessary for us to fulfill our contractual obligations, and if you do not provide it, we may not be able to offer our services. Where data collection is voluntary, we will inform you, and there will be no consequences if you choose not to provide it.

We collect personal data in the following ways:

• From Your Reservation: Directly from you when making a reservation via our websites, email, phone, or other communication methods. If you contact customer service or reach out via social media, we will also collect data through those interactions.
• From Property Visits: When you visit our properties or use on-property services like restaurants, spas, and concierge services.
• From Third Parties: You may book services via third-party platforms (e.g., OpenTable or travel aggregators), which forward your reservation details to us. Please review the privacy policy of these third parties to understand how they process your data.

You are not required to provide personal data, but failure to do so may limit our ability to provide our services.

We use your data in the following ways:

• Reservation and Stay Management: To complete and manage your reservation, including processing payments, confirming room availability, and providing related customer services such as pre-arrival messages and event assistance.
• Legitimate Interests: For purposes such as:
• Administering your user account on our reservation website, managing bookings, offering special promotions, and providing customized services.
• Communicating with you about your reservation, including follow-up on incomplete bookings, handling requests, and sending you administrative information (e.g., security alerts, and satisfaction surveys).
• Conducting analytics to improve marketing strategies, personalizing your experience, and creating customer profiles for targeted communications.
• Sending postal communications that may be of interest to you.
• Analyzing website interactions and ensuring a smooth user experience across devices.
• Legal and Security Reasons: To comply with legal obligations, enforce house rules, protect our rights and operations, or prevent damage.
• Sharing Personal Data: We may share your data within our affiliated businesses for administrative purposes, sales, and marketing activities.
• Data Aggregation: We may anonymize and aggregate data for internal purposes, including market research and demographic studies. If we invite you to participate in market research, we will provide clear information about the data collection process and its use.
• Marketing Communications: We may contact you via email (with your consent) to offer information about goods, services, or events that may interest you.

When processing data for legitimate interests, we carefully assess the impact on your rights and interests. You may object to data processing based on legitimate interests, subject to certain conditions (see "Your Data Protection Rights" below).

Note: The use of your data for the purposes above is necessary for fulfilling our contract with you, complying with legal obligations, or for legitimate interests.

We may share your data with third parties in the following circumstances:

Service Providers

Like many businesses, we engage trusted third-party service providers who assist in supporting our operations. These may include (i) payment and card processing services, (ii) credit reference agencies for fraud prevention, (iii) software management solutions for spa and wellness services, (iv) reservation platforms, (v) IT and infrastructure service providers, (vi) web analytics services, (vii) digital advertising providers, and (viii) CRM, marketing, and sales software solutions. These providers are authorized to access, process, or store your data solely to fulfill their services as per our instructions.

Affiliated Businesses

We operate globally. To provide the services you request, our affiliated businesses may access and process your data for the purposes outlined above, including offering products or services. These affiliates will only use your data for the specific purposes it was originally collected.

Business Transfers

If our company is sold, or if our assets are acquired by a third party, the personal data we hold about our members, applicants, or customers may be transferred as part of the transaction.

Administrative and Legal Reasons

We may disclose your data if necessary: (i) to comply with legal obligations, judicial or regulatory processes, court orders, or other legal requirements, (ii) to enforce our Terms & Conditions, House Rules, or any other applicable contract terms you are subject to, or (iii) to protect us, our members, applicants, or contractors from potential harm. This may involve sharing information with law enforcement agencies, courts, or authorities.

Payments made through our website are processed by third-party payment providers. Your payment data will be securely stored and encrypted using current industry standards. We do not directly process or store your debit/credit card information.

We may store your payment data to facilitate future transactions. Your data will be retained only for as long as legally permitted and by applicable laws. You have the option to opt out of data storage, though this means you will need to provide payment details again for any future purchases or reservations.

Your data may be transferred and stored in countries outside the one where it was originally collected, including destinations like the United States, Israel, or other countries outside the European Economic Area (EEA). These countries may not offer the same data protection standards as your home country. If your data is transferred outside of India, we will take steps to ensure its protection, including implementing legal safeguards such as standard contractual clauses for data transfers. For more information on these safeguards, please contact us.

Third parties may collect personal data regarding your online activities over time and across different websites when you visit our site.

Do Not Track (DNT) is a privacy setting available in most browsers. If you activate DNT in your browser, we will respect your request to avoid being tracked across the web.

Our website is not intended for children under the age of 13 (or a higher age as determined by the laws in your jurisdiction). We do not knowingly collect personal data from minors. If you believe that a child under the applicable legal age has provided personal information through our website, please contact us, and we will work to remove this data from our systems.

If you are given or choose a password or login to access restricted areas of our website, you are responsible for keeping this information confidential. Do not share your login details with anyone else.

While we take reasonable measures to protect your data from unauthorized access, loss, destruction, or damage, the transmission of information over the Internet or public networks can never be entirely secure. Although we implement appropriate technical and organizational security measures, we cannot guarantee 100% security for the data you provide online.

We will retain your data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by any legal, regulatory, accounting, or reporting obligations, whichever is longer. Specifically, we keep membership records for six years after your membership expires or is terminated. Information submitted through our website or other platforms we operate is kept for two years after account closure or your last contact with us. If you consent to receive marketing communications, we will retain your data until you unsubscribe.

To determine the appropriate retention period for your data, we consider the type, nature, and sensitivity of the data, the purposes for which we process it, any legal or operational retention requirements, and whether these purposes can be achieved through other means.

Once the retention period expires, we will securely delete your data in compliance with applicable laws and regulations. In some cases, we may anonymize your data, making it no longer identifiable as personal data.

Under applicable data protection laws, you may have specific rights regarding your data. If the processing of your data is subject to the GDPR, you are entitled to the following rights:

Right of Access

You can request confirmation of whether we are processing your data. If we are, we will provide you with a copy of the data along with details like the purpose of processing. If you request additional copies, we may charge a reasonable fee.

Right to Rectification

If your data is inaccurate or incomplete, you have the right to ask us to correct or update it. If we have shared your data with others, we will inform them of the correction, where possible. Upon request, we can also inform you of the parties with whom your data was shared.

Right to Erasure

You may request the deletion or removal of your data, particularly if our processing is based on your consent and you withdraw it. If we have shared your data with third parties, we will notify them of the erasure, where feasible. You can also request details about who we shared your data with. Note that we may still process your data if it is required for legitimate interests.

Right to Restrict Processing

You can ask us to restrict or block the processing of your data in certain circumstances, such as if you dispute the accuracy of the data or object to its processing. We will notify you before lifting any restrictions. If your data has been shared, we will inform those third parties about the restriction, where possible.

Right to Data Portability

You have the right to request a copy of the data that you have provided to us, which we process based on your consent or for contract purposes, and that is processed by automated means. We will provide this data in a structured, commonly used, and machine-readable format for reuse.

Right to Object

You can ask us to stop processing your data at any time, and we will comply if:

We are relying on a legitimate interest to process your data unless we can demonstrate compelling legitimate grounds for the processing;

We are processing your data for direct marketing purposes.

Right to Withdraw Consent

If we rely on your consent for data processing, you can withdraw it at any time. This will not affect the lawfulness of any processing before we receive your withdrawal request.

Right to Complain to the Data Protection Authority

If you have concerns about how we handle your data, you can file a complaint with the relevant data protection authority in India (such as the Information Commissioner’s Office or ICO), or another authorized authority.

If you wish to exercise any of these rights, please contact us as described in the ‘Contact’ section below. We may require additional information to verify your identity before responding to your request.

Any future changes to our Privacy Policy will be posted on this page. Please check back regularly for updates or modifications. If required by applicable law, we will notify you of any significant changes to this Privacy Policy.

Cookie Policy

We use cookies for tracking purposes.

You can choose to receive a notification every time a cookie is sent or disable all cookies through your browser settings. Since each browser is different, consult your browser’s Help menu for instructions on how to modify cookie settings.

Please note that disabling cookies may limit some features of our site, and some of our services may not function as intended.