Privacy Policy
At Saltstayz, we endeavor to provide our guests outstanding services and experiences in our hotels and other accommodations all over India. We value your business and your faith in us in delivering you a superior level of service.
We recognize that privacy is important to our guests, hence this Privacy Policy explains our practices regarding personal information we collect when you visit our accommodations, and our website or mobile application. Your data shall be protected by us and kept secure as per applicable privacy and data protection laws.
It also explains as to why we collect your personal information, the other parties with whom we may share it with and the measures we take to protect the security of your data. It also tells you about the rights available to you in respect of it.
Please read this Privacy Policy carefully before using or availing any of our products and/or services.
Definitions
In this Privacy Policy:
Scope of this Privacy Policy
2.1 This Privacy Policy applies to Personal Data we process in connection with: the Website and any App; enquiries you make by web form, telephone, email or WhatsApp; reservations, stays, dining and events at our Properties, your Account and Beyond Membership, and our marketing communications. It also applies to Personal Data we process when you interact with our official social media pages and widgets, and when you apply for a role with us through our careers channels.
2.2 This Privacy Policy does not apply to:
- Partner Properties. Where a hotel listed on the Website is operated by another person, that person determines how it processes Personal Data within its control and does so under its own privacy policy. If you would like to know who operates a particular Property, ask us before you book and we will tell you.
- Travel intermediaries. Where you book through an online travel agent, aggregator, corporate travel desk or event organizer, that party collects your Personal Data first under its own privacy policy and transfers to us what is required to deliver your stay.
- Third-party websites. We are not responsible for the privacy practices of websites we link to.
2.3 We are a Data Fiduciary in respect of the processing described here. Where we process Personal Data on the documented instructions of a corporate client or event organizer, we do so under our contract with that party.
Personal Data we collect
Saltstayz collects Data for various purposes set out in this Privacy Policy. This Data includes, without limitation, the following categories:
- Identity and Contact information: first and last name, email address, mobile and telephone number, postal address where provided, country, names of guests accompanying you and other similar contact data.
- Identity verification data: the photo identity document presented or uploaded at Check-in and, in the case of foreign nationals, passport and visa particulars. Where Check-in is completed digitally, this includes any scan, photograph or image of the document that you upload on the website or the app.
- Reservation and stay data: dates, Property, room or venue, rate and package, occupancy, arrival and departure times, room allocation, folio and billing entries, restaurant and in-room orders, services used, and any special request you make. This includes both overnight stays and day-use (day room) bookings.
- Financial data: payment instrument information, transactions, transaction history, preferences, payment method, mode and manner of payment, spending pattern or trends, refund and chargeback records, masked card particulars, corporate or GST billing particulars where applicable, and other similar data.
- Account and membership data: login credentials or one-time passcodes, membership tier, entitlements, and booking history. We assign and adjust your Beyond tier automatically based on the number of bookings you complete, and we record the cashback, discounts and other benefits you earn and redeem.
- Technical and usage data: website, device usage, Internet Protocol (IP) address and similar information collected via automated means, such as cookies, pixels and similar technologies. This may include the information mandated by applicable law.
- Product and Service data: your account membership number, registration information, and program-specific information, when you request products and/or services directly from us or participate in marketing programs.
- Marketing and Communications data: your contact preferences, consent and withdrawal records, and your engagement with our communications.
- Feedback and correspondence data: your enquiries, reviews, feedback, complaints and related correspondence regarding our products, programmes and services.
- Security data: CCTV footage recorded in public and common areas of our Properties, and incident records.
- Other information and data revealed by special request (which may include special category personal data): age, sex, date of birth, marital status, nationality, details of government identification documents provided, occupation, religion, health or diet information, disability information, information regarding your beliefs. This data will only be used to provide you with the best hospitality and care during the term of your stay with us.
- Recruitment data: where you apply for a role with us, the contents of your application, CV, work history, qualifications and related correspondence.
- Data from third parties: information we receive about you from travel intermediaries, corporate travel desks, event organizers, payment providers and, where you have consented, advertising platforms; where we combine such information with data we already hold, we treat the combined data as Personal Data.
Where you provide us with Personal Data relating to another person (for example, a guest accompanying you), you confirm that you are authorised to do so and that you have informed that person of this Privacy Policy.
How we collect Data
4.1 Information you give us. We receive and store information when you complete the enquiry form, telephone or message us, make a reservation, register an Account, join Beyond Membership, Check-in at the Property or done digitally, use services during your stay, or give us feedback or when you enter information into our website.
4.2 Automatic information we collect. We use Cookies and server logs when you use the Website, and through CCTV when you are in public and common areas of a Property. Please refer to Section 15 for an explanation of our use of Cookies.
4.3 Automatic information we collect from other websites. We receive and store certain types of information when you interact with third-party websites with whom we have a specific agreement. This can range from travel intermediaries and corporate travel desks that book on your behalf, from our payment providers in the form of payment confirmations and fraud or chargeback signals, and from advertising platforms in the form of aggregated campaign reporting.
4.4 From advertising and referral links. Where you reach the Website through an advertisement, the link may carry campaign parameters and click identifiers, including Google Ads click identifiers, which indicate which campaign brought you to us.
Personal Data you provide to us
Personal Data is collected from you when you, among other things:
- submit an enquiry, request a call back or message us on WhatsApp;
- search for availability and make, amend or cancel a reservation;
- register an Account or enroll in Beyond Membership;
- make a payment or request a refund;
- complete check in whether at a Property or digitally, and present identification;
- order food, beverages or services during a stay;
- book a restaurant table, banquet, conference or event;
- respond to a survey, submit feedback or a review, or raise a complaint; or
- elect to receive, or to stop receiving, marketing communications;
- from the information gathered by your visit to our Properties and Website.
Data collected automatically
6.1 We automatically collect some information when you visit our website or use our App. It includes your IP address, device and browser characteristics, the pages and Properties you view, the searches you run, and the point at which you leave a booking journey. This information helps us to make improvements to our content and navigation.
6.2 Our Website and App servers collect your IP address, operating system details, browser details, device details and language settings, and this information is aggregated to measure the number of visits, average time spent on the site, pages viewed and similar information, and to understand demand, diagnose faults, protect the website against misuse, and improve the booking experience.
6.3 We may collect your information automatically via Cookies and similar technologies in line with settings on your browser.
6.4 CCTV cameras operate in public and common areas of our Properties, including lobbies, corridors, entrances and parking areas. Cameras are not placed in guest rooms, bathrooms or other private areas. Signage is displayed where cameras operate.
How we use Personal Data
7.1 Under the Data Protection Laws we process Personal Data on the basis of your consent, or where the processing is a legitimate use permitted by law, including compliance with a legal obligation. We use Personal Data for the following purposes:
- carry out our obligations arising from any contract entered into between you and us;
- provide products and/or services and communicate with you about products and/or services offered by us;
- provide you with offers, personalized services and recommendation and improve your experience on our website;
- operate, evaluate and improve our business, website;
- generate aggregated data to prepare insights to enable us to understand customer behavior, patterns and trends with a view to learning more about your preferences or other characteristics;
- provide privileges and benefits to you, marketing and promotional campaigns based on your profile;
- in connection with loyalty programs owned and operated by us;
- communicate with you (including to respond to your requests, questions, feedback, claims or disputes) and to customize and improve our services;
- enforce the terms of use of our website;
- protect against and prevent fraud, illegal activity, harm, financial loss and other legal or information security risks;
- serve other purposes for which we provide specific notice at the time of collection, and as otherwise authorized or required by applicable law.
Where required under relevant Data Protection Laws, we may need to ensure that there is a legal basis to justify our processing of your Data. There are a number of different ways that we are lawfully able to process your Data. We have set these out below.
Where processing your Data is necessary for us to carry out our obligations arising from any contracts entered into between you and us: if you enter into a contract with us in relation to any of our product or service offerings, we may process certain Data about you in order to perform our obligations under this contract, including to enable us to communicate with you about such products and/or services and to process your payment transactions.
Where processing your personal information is within our legitimate interests: we can process certain Data where it is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights or freedoms of yours which require protection of your Data. The ways in which we may process your Data for the purposes of our legitimate interests include enforcing the terms of use of our website; generating aggregated data to prepare insights to enable us to understand customer behavior, patterns and trends; improving our website and ensuring that they run smoothly; providing you with offers, personalized services and recommendations; protecting against and preventing fraud, illegal activity, harm, financial loss and other legal or information security risks; providing offers, privileges and benefits to you, marketing and promotional campaigns based on your profile; communicating with you and customizing and improving our services; operating, evaluating and improving our business; enabling us to offer our products and/or services and to communicate with you about them; in connection with loyalty programs owned and operated by us; and processing, disclosing, transmitting and/or sharing the Data with other third parties which have business or contractual dealings with us in relation to your stay with us.
Where you give us your opt-in consent to process your personal information: in certain circumstances, where required under relevant Data Protection Laws, we will seek to obtain your consent before we undertake certain processing activities with your Data. You have the right to withdraw your consent to these activities. You can do so at any time, and details of how to do so can be found in the section titled “Your Rights and Choices”.
Where processing your personal information is necessary for our compliance with a legal obligation: in certain circumstances, we may disclose your Data for the purposes of compliance with a legal obligation (for example, to comply with a law, regulation or compulsory legal request). We do not think that any of the above activities prejudice you in any way. However, you do have the right to object to us processing your personal information in certain circumstances. If you would like to know more about these circumstances and how to object to our processing activities, please see the section titled “Your Rights and Choices”.
7.2 Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your Data.
7.3 Further, where required under relevant Data Protection Laws, we will only process ‘special category personal data’ (as defined under Data Protection Laws) if there is a valid legal basis, which might involve obtaining your explicit consent.
7.4 Where we use or share your Data on behalf of another entity (i.e., the controller) as part of our services offered to that entity, we do so under the instructions of that entity and that entity is responsible for ensuring that there is a legal basis for us to use or share your Data on its behalf (if such legal basis is required under relevant Data Protection Laws).
7.5 Automated decision making. We do not take decisions that significantly affect you by automated processing alone. Room rates vary with dates, demand and booking channel; we do not set an individual’s rate by reference to a profile of that individual. Your Beyond membership tier is set automatically by how many bookings you complete; this affects the discounts, cashback and perks available to you, but does not produce legal or similarly significant effects, and you may ask us how your tier was determined.
7.6 Change of purpose. If we need to use your Personal Data for a purpose that is not described in this Privacy Policy, we will tell you and, where the law requires it, obtain your consent before we do so.
Minors
8.1 Under the Data Protection Laws, a minor is an individual who has not completed eighteen years of age.
8.2 The Website, Accounts, Beyond Membership and our booking services are intended for adults. We do not knowingly permit a minor to register an Account, enroll in Beyond Membership or make a reservation.
8.3 Where minors stay at a Property, their particulars are provided by the booking adult, who confirms that they are the parent or lawful guardian of the child or are authorised by the parent or lawful guardian. Before processing the Personal Data of a minor we obtain verifiable consent of the parent or lawful guardian in the manner required by the Data Protection Laws, and we may take steps to verify that the consenting adult is an adult and is identifiable.
8.4 We do not track minors, direct behavioral or targeted advertising at them, or undertake processing in respect of a minor that is likely to have a detrimental effect on the minor’s well-being.
8.5 If you believe a minor has provided Personal Data to us without appropriate parental consent, contact us under section 18 and the data shall be erased as per applicable laws.
Sharing of Personal Data
9.1 We share Personal Data only where it is necessary, and with the following categories of recipient:
- the Property at which your reservation is held, which receives what it needs to host you;
- Partner Properties, where your reservation is at such a Property, so that it can deliver your stay;
- Service Providers, comprising our booking engine and property management system, website and cloud hosting providers, payment providers, email and SMS and WhatsApp messaging providers, customer support tools, and analytics providers;
- payment providers, banks, card networks and acquirers, for the purpose of taking payment, issuing refunds and resolving chargebacks;
- government, regulatory and law-enforcement authorities, including the immigration authorities in respect of foreign nationals, police and local authorities where required, and tax authorities;
- professional advisers, auditors and insurers, where necessary and subject to obligations of confidentiality;
- advertising platforms, where you have consented to advertising Cookies, so that we can measure which campaigns resulted in bookings;
- a purchaser or successor, in connection with any reorganization, merger, sale or acquisition of our business or any part of it, subject to this Privacy Policy continuing to apply to the Personal Data transferred.
9.2 We do not sell Personal Data. We do not disclose Personal Data to third parties for those parties’ own marketing purposes.
Keeping Personal Data secure
10.1 We take reasonable security safeguards to prevent a personal data breach, including encryption of data in transit, role-based access controls, logging and monitoring of access, secure configuration and patching, backups, and training of personnel who handle guest data.
10.2 We require our Service Providers, by contract, to process Personal Data only on our instructions and to maintain appropriate security safeguards.
10.3 No system of transmission or storage can be guaranteed to be completely secure, and we do not represent otherwise. We are not liable for any loss or unauthorized access caused by events beyond our reasonable control, including hacking, network or infrastructure failure, or your own failure to keep your login credentials confidential.
10.4 In the event of a personal data breach, we will inform the Data Protection Board of India and each affected Data Principal in the manner and within the timelines required by the Data Protection Laws, including a description of the breach, its likely consequences, the measures we have taken, and the steps you may take to protect yourself.
Retention of Personal Data
11.1 We retain Personal Data for the period necessary for the purpose for which it was collected, or for the period required by law, whichever is longer.
11.2 On expiry of the applicable period we erase the Personal Data or de-identify it so that it can no longer be associated with you.
11.3 Personal Data erased from our live systems may persist in secure backups for a limited period and is removed as those backups are cycled.
11.4 Where we propose to erase Account data by reason of inactivity, we will give you at least forty-eight hours’ prior notice so that you may prevent the erasure by logging in or contacting us.
Where Personal Data is stored and transferred
12.1 We process Personal Data in India.
12.2 Certain Service Providers, including cloud hosting, email, messaging and analytics providers, may store or access Personal Data on infrastructure located outside India.
12.3 The Data Protection Laws permit the transfer of Personal Data outside India, except to a country or territory restricted by notification of the Central Government. Where we transfer Personal Data outside India, we comply with those restrictions and require the recipient by contract to protect the Personal Data.
12.4 If you would like further information about a particular transfer, write to us under section 18.
Your rights and choices
13.1 Subject to the Data Protection Laws, you have the right:
- to access — to obtain a summary of the Personal Data we process about you, the processing activities undertaken, and the identities of other Data Fiduciaries and processors with whom it has been shared;
- to correction, completion and updating — to have inaccurate or misleading Personal Data corrected, incomplete Personal Data completed, and Personal Data brought up to date;
- to erasure — to have your Personal Data erased, unless retention is required for compliance with law or for a purpose for which consent was given and remains operative;
- to nominate — to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
- to grievance redressal — to have a grievance about our handling of your Personal Data addressed by us; and
- to complain to the Data Protection Board of India.
13.2 Withdrawal of consent. Where processing is based on consent, you may withdraw it at any time with the same ease with which it was given. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not require us to erase records we are required by law to retain. Where the processing is necessary to a reservation, withdrawal may mean we are unable to provide the service, and we will tell you if that is the case. You may give, manage, review or withdraw your consent directly with us, or through a Consent Manager once we make that facility available.
13.3 Marketing choices. You may opt out of marketing communications at any time by using the unsubscribe facility in any email, by replying STOP to an SMS or WhatsApp message, or by contacting us. We honor opt-outs and any do-not-disturb registration you have made. We will continue to send you transactional messages relating to a reservation you have made.
13.4 Verification. We may request information reasonably necessary to verify your identity before acting on a request. Information provided for verification is used only for that purpose.
13.5 Response time. We will respond to a request or grievance under this section within 30 days.
13.6 Duties of Data Principals. The Data Protection Laws require you not to impersonate another person when providing Personal Data, not to suppress material information when providing Personal Data where required by law, and not to register a false or frivolous grievance.
Processing by Service Providers
14.1 We engage Service Providers under written contracts that require them to process Personal Data only for the purposes we specify, only on our instructions, and subject to appropriate security safeguards, confidentiality obligations, breach notification, and deletion or return of Personal Data on termination.
14.2 We remain responsible under the Data Protection Laws for Personal Data processed on our behalf by a Service Provider.
Cookies, pixels and similar technologies
15.1 We use Cookies on the Website, and equivalent software in the App, for the following purposes:
- strictly necessary — session management, security, load balancing and sign-in, without which the Website cannot function;
- preference — retaining your search dates, location and language choices;
- analytics — understanding how visitors find and use the Website, which Properties are viewed, and where booking journeys are abandoned; and
- advertising and measurement — attributing reservations to advertising campaigns.
15.2 No analytics or advertising Cookie is placed before you have consented to it. When you first visit the Website you are presented with a Cookie banner through which you may accept or reject non-essential Cookies. You may change or withdraw that choice at any time through the Cookie settings control on the Website.
15.3 Our Cookie notice sets out each Cookie we place, the party that provides it, its purpose and its duration.
15.4 You may also block or delete Cookies through your browser settings. Strictly necessary Cookies cannot be disabled without affecting the operation of the Website. In the App, you can manage these choices through your device settings and in the in-App privacy settings.
Third-party links and social media
16.1 The Website and our communications may contain links to, or features from, third-party websites, applications and social media platforms (including our Instagram, Facebook and LinkedIn pages). Those third parties collect and process Personal Data under their own privacy policies, and we are not responsible for their practices. We encourage you to read them before you share Personal Data with them.
16.2 Where our pages include social media plug-ins or widgets, the relevant platform may collect information about your visit and set its own cookies, whether or not you interact with the widget. Your dealings with those platforms are governed by their privacy policies.
Governing law and jurisdiction
17.1 This Privacy Policy is governed by the laws of India. Subject to the powers of the Data Protection Board of India and your right to complain to it, the courts at Gurugram, Haryana shall have jurisdiction over any dispute arising out of or in connection with this Privacy Policy.
Severability
If any provision of this Privacy Policy is held to be invalid or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.
Changes to this Privacy Policy
19.1 We may amend this Privacy Policy from time to time to reflect changes in our processing, our services or the law. The version number and effective date appear at the top of this document.
19.2 Where an amendment materially affects the manner in which we use your Personal Data or the choices available to you, we will bring it to your attention before it takes effect, by notice on the Website, by email, or at the time of your next reservation, and where the amendment requires your consent we will seek it.
19.3 Previous versions are available on request.
How to contact us
20.1 For any question, request or grievance concerning your Personal Data, contact Saltstayz Hospitality Private Limited, LG-1, Vishnu Palace, Ajronda Flyover, Faridabad, Haryana 121007, India. Email [email protected]. Telephone +91 95991 99610. Online, use the contact form at saltstayz.com/contact-us, selecting “Complaint”.
20.2 We will acknowledge your communication and respond within 30 days.
20.3 If you are not satisfied with the manner in which your grievance has been addressed, you may complain to the Data Protection Board of India in the manner prescribed by it.
20.4 Language. This Privacy Policy is published in English. If you would prefer it in any other language, write to us and we will provide it.