Privacy Policy
Last updated: June 2026
Nargis Hospitality Pvt. Ltd.(“we”, “us”, or “our”) operates the Villa website. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable rules thereunder.
1. Data Fiduciary
For the purposes of the DPDP Act, Nargis Hospitality Pvt. Ltd. is the Data Fiduciary responsible for the processing of your personal data through this website.
| Data Fiduciary | Nargis Hospitality Pvt. Ltd. |
| Registered Address | Villa 2,Sanctuary by Boheim, JQ9X+6V8, Sodiem Siolim, Gude, Goa 403507 |
| Contact Email | contact@nargishospitality.in |
2. Personal Data We Collect
We collect personal data only when you voluntarily provide it for a specific, lawful purpose. We collect:
| Data Category | Data Points | When Collected |
|---|---|---|
| Identity Data | Full name | Booking, contact form |
| Contact Data | Email address, phone number | Booking, contact form |
| Booking Data | Check-in/out dates, number of guests, special requests, add-on selections | Booking |
| Payment Data | Transaction ID, payment status (card details are NOT stored by us — processed by Razorpay) | Booking payment |
| Usage Data | Pages visited, time on site, referral source (anonymised, via Google Analytics — only with your consent) | Website browsing |
We do not collect Aadhaar numbers, PAN numbers, biometric data, or any sensitive personal data as defined under the DPDP Act.
3. Purpose and Legal Basis for Processing
Under the DPDP Act, we process your personal data based on your consent and for legitimate uses as defined in the Act:
| Purpose | Legal Basis (DPDP Act) |
|---|---|
| Process and manage your booking | Performance of contract (Section 7(a) — consent for specified purpose) |
| Send booking confirmation and invoice emails | Performance of contract |
| Respond to your enquiries via the contact form | Consent (voluntarily provided) |
| Generate GST-compliant invoices | Legal obligation (GST Act, Income Tax Act) |
| Website analytics (anonymised) | Consent (via cookie consent banner) |
4. Consent
In accordance with Section 6 of the DPDP Act, we obtain your consent before processing your personal data:
- Booking form: By submitting the booking form, you provide explicit consent (via the checkbox) for us to process your data to fulfil the booking.
- Contact form: By submitting an enquiry, you consent to us using your contact details to respond.
- Analytics cookies:Collected only after you click “Accept All” on our cookie consent banner. You may decline analytics cookies without affecting website functionality.
You may withdraw your consent at any time by contacting us at contact@nargishospitality.in. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
5. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:
| Data Type | Retention Period | Reason |
|---|---|---|
| Booking & payment records | 8 years from check-out | GST Act and Income Tax Act compliance |
| Contact form enquiries | 1 year from submission | Guest relations and follow-up |
| Analytics data | 26 months (Google Analytics default) | Website improvement |
After the retention period, personal data is securely deleted or anonymised.
6. Data Processors (Third Parties)
We share your personal data with the following third-party Data Processors who process data on our behalf:
| Service | Purpose | Data Shared |
|---|---|---|
| Razorpay | Payment processing | Name, email, phone, payment amount |
| Google Analytics | Website analytics (consent-gated) | Anonymised usage data, IP address (anonymised) |
| Google Maps | Map display on Contact page | No personal data shared by us |
| Vercel | Website hosting | Server logs (IP address, request data) |
We do not sell, rent, or trade your personal data to any third party. Data is shared with processors only to the extent necessary to provide our services.
7. Data Security
We implement reasonable security safeguards as required under Section 8 of the DPDP Act:
- All data is transmitted over HTTPS (TLS 1.3 encryption)
- Payment data is processed by Razorpay, which is PCI-DSS Level 1 compliant — we never store card numbers, CVVs, or PINs
- Database access is restricted and authenticated
- Admin dashboard is protected by Clerk authentication with role-based access
8. Your Rights Under the DPDP Act
As a Data Principal under the DPDP Act, you have the following rights:
| Right | Description | DPDP Act Section |
|---|---|---|
| Right to Access | Request a summary of the personal data we hold about you and how it is processed | Section 11(a) |
| Right to Correction | Request correction of inaccurate or incomplete personal data | Section 11(b) |
| Right to Erasure | Request deletion of your personal data (subject to legal retention obligations) | Section 11(c) |
| Right to Withdraw Consent | Withdraw consent for data processing at any time | Section 6(5) |
| Right to Grievance Redressal | File a complaint about our data processing practices | Section 11(d) |
| Right to Nominate | Nominate another person to exercise your rights in case of death or incapacity | Section 14 |
To exercise any of these rights, email us at contact@nargishospitality.in. We will respond within 30 days of receiving your request.
9. Children's Data
Our website is not directed at children under 18. We do not knowingly collect personal data from minors. Bookings involving minors must be made by a parent or legal guardian. If you believe we have inadvertently collected data from a child, contact us immediately for deletion.
10. Data Transfer Outside India
Some of our Data Processors (Google, Vercel, Razorpay) may process data on servers located outside India. Such transfers are conducted in compliance with the DPDP Act and only to countries or entities that provide adequate data protection as notified by the Central Government.
11. Cookies
We use cookies to operate our website and, with your consent, for analytics. For full details, see our Cookie Policy.
12. Grievance Redressal
If you have any complaints about how we handle your personal data, you may:
- Contact our Grievance Officer at contact@nargishospitality.in — we will acknowledge your complaint within 48 hours and resolve it within 30 days
- If unsatisfied with our response, you may file a complaint with the Data Protection Board of India as established under Section 18 of the DPDP Act
13. Changes to This Policy
We may update this Privacy Policy to reflect changes in the law or our practices. Material changes will be communicated via a notice on our website. The “Last updated” date at the top indicates the most recent revision.
14. Contact
For any privacy-related questions or to exercise your rights under the DPDP Act, contact:
Nargis Hospitality Pvt. Ltd.
Villa 2,Sanctuary by Boheim, JQ9X+6V8, Sodiem Siolim, Gude, Goa 403507
Email: contact@nargishospitality.in