Riyan Holidays ("Riyan Holidays", "we", "us", "our") operates fully furnished 3BHK and 4BHK holiday villas at Attuvampatti, Kodaikanal, Tamil Nadu, India, and the website riyanholidays.in through which guests can check availability, get a price quote, and book a stay. This Privacy Policy explains what personal information we collect when you use our website or book with us, why we collect it, how we use and protect it, and the choices and rights you have. It is drawn up to comply with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023, together with rules made under it.

By using our website or providing your information to us (including to complete a booking), you agree to the collection and use of information as described in this policy. If you do not agree with this policy, please do not use our website or share your personal information with us.

1. Who we are

For the purposes of applicable data protection law, the "data fiduciary" responsible for your personal information is:

Riyan Holidays
Attuvampatti, Kodaikanal, Dindigul District, Tamil Nadu, India
WhatsApp/Phone: +91 89032 00612
Email: riyanholidayskkl@gmail.com

2. Information we collect

We collect information in three ways: what you give us directly, what we generate about your booking, and basic technical data from your browser.

2.1 Information you give us

• Booking details - the property, check-in/check-out dates, number of adults and children, and any optional add-ons you select.
• Contact details - your full name, WhatsApp/phone number, and email address, collected when you complete the guest details form.
• Government ID proof - a photo or scan of your Aadhaar card, Passport, Driving Licence, Voter ID, or another valid government-issued photo ID, uploaded to confirm your booking. This is "sensitive personal data" under Indian law, and we collect it strictly for the identity-verification and legal-registration purposes explained below, with your explicit consent given at the time of upload.
• Communications - messages you send us on WhatsApp, email, or through the website, including any special requests or complaints.

2.2 Information generated about your booking

• A unique booking reference, price quote, and price breakdown for your stay.
• The transaction reference (UTR) number and a screenshot of the payment confirmation you self-report after paying your advance by UPI or bank transfer directly to our business account, used to verify your payment. We do not receive or store your full card number, UPI PIN, or net-banking login credentials - we only ever see the reference number and screenshot you choose to share with us.

2.3 Technical information

Like most websites, our server and hosting providers automatically log basic technical data such as your IP address, browser type, device type, and pages visited, for security and troubleshooting purposes. We currently do not run advertising or analytics trackers such as Meta/Facebook Pixel or Google Analytics on this website; if we start using such tools in the future to understand website usage or show relevant ads, we will update this section and this policy before doing so.

3. How we use your information

We use your personal information only for the following purposes:

• To show live availability and calculate an accurate price quote for your stay.
• To create, confirm, and manage your booking, and to communicate with you about it (confirmations, payment follow-ups, check-in instructions, and any changes).
• To verify your identity at check-in, as required for the safety and security of our properties and guests, and to comply with local guest-registration requirements applicable to lodging establishments.
• To collect and verify advance payments made directly to our business UPI ID/bank account, process refunds, and coordinate payment follow-ups over WhatsApp.
• To respond to your questions, requests, or complaints.
• To detect and prevent fraud, misuse of our booking system, or security incidents (for example, our booking form includes a hidden "honeypot" field used only to catch automated bots, not to identify genuine guests).
• To comply with applicable law, including income-tax record-keeping and any lawful request from a government or law-enforcement authority.

We do not use your personal information for any purpose incompatible with the above without asking for your consent first.

4. How we share your information

We do not sell, rent, or trade your personal information. We only share it with the following categories of recipients, and only to the extent needed for them to provide their service to us:

• Cloud storage and hosting providers (such as Cloudinary, for securely storing uploaded ID proof documents and photos, and our website/database hosting providers) - to store your information securely.
• Our bank - advance payments are made directly to our business UPI ID/bank account, so your payment passes through your own bank/UPI app and ours, not a third-party payment gateway. If we start using a payment gateway in the future, this section will be updated before that happens.
• Communication providers (such as WhatsApp/Meta, when we message you on the WhatsApp number you provide) - to send booking updates and payment reminders.
• Government and law-enforcement authorities - where required by applicable Indian law, such as local guest-registration rules for lodging establishments, or in response to a valid legal request.
• Professional advisors (such as our accountant, if needed) - solely for tax, accounting, or legal-compliance purposes.

5. Where your data is stored

Some of our service providers (for example, cloud file storage) may store data on servers located outside India. Where this is the case, we take reasonable steps to ensure such providers maintain security practices consistent with this policy and applicable law. We do not transfer your personal information to any country restricted by the Central Government under the Digital Personal Data Protection Act, 2023.

6. How long we keep your data

We keep your personal information, including your ID proof and any payment screenshot, only for as long as reasonably necessary to fulfil the purposes described in this policy - typically for the duration of your stay plus a limited period afterwards to handle any follow-up questions, disputes, or refund requests, and to meet our record-keeping obligations under tax and other applicable law. After that, we securely delete or anonymise your information, unless a longer retention period is required by law or you have asked us to delete it sooner (see "Your rights" below).

7. How we protect your data

We use reasonable technical and organisational security practices to protect your personal information against unauthorised access, alteration, disclosure, or destruction - including transmitting data over encrypted (HTTPS) connections, storing ID proof documents with access-controlled cloud storage providers, and limiting access to your information to people who genuinely need it to run your booking. No method of transmission or storage is 100% secure, but we work to protect your information using practices consistent with the IT Rules, 2011.

8. Your rights

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal information we hold about you and how we process it.
• Correct or update inaccurate or incomplete personal information.
• Erase your personal information, once it is no longer needed for the purpose it was collected for (subject to our legal record-keeping requirements).
• Withdraw consent you previously gave us, at any time - though this may mean we are unable to process an active booking that relies on that information.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Register a complaint with us first, and if unresolved, with the Data Protection Board of India.

To exercise any of these rights, please contact us using the details in "Contact us" below. We will respond within a reasonable time, and in any case within the time limits prescribed by law.

9. Cookies and similar technology

Our website uses only the cookies/local browser storage strictly necessary to operate the booking widget and calendar (for example, remembering your selections while you complete a booking). These are not used to track you across other websites. We do not currently use advertising cookies or pixels. If this changes - for example, if we start using Meta Pixel or Google Analytics to understand site traffic or to show you relevant ads on Meta platforms - we will describe exactly what is collected and how here, and such tools will only be used in line with the relevant platform's own data-use policies.

10. Children's privacy

Our website and booking process are intended for use by adults (18 years or older) who are legally able to enter into a booking contract. We do not knowingly collect personal information directly from children. Children may of course be listed as guests as part of an adult's booking.

11. Third-party links

Our website may contain links to third-party services such as WhatsApp and Google Maps. We are not responsible for the privacy practices of these third parties, and we encourage you to review their respective privacy policies.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the revised policy on this page with an updated "Last updated" date. Significant changes will be highlighted on our website.

13. Grievance officer

In accordance with the Information Technology Act, 2000 and rules made under it, the Grievance Officer for privacy and data-related complaints is:

Prakash, Property Manager
Riyan Holidays, Attuvampatti, Kodaikanal, Dindigul District, Tamil Nadu, India
WhatsApp/Phone: +91 89032 00612
Email: riyanholidayskkl@gmail.com

We will acknowledge and address grievances as promptly as possible, and in any case within the timelines prescribed by applicable law.

14. Contact us

If you have any questions about this Privacy Policy or how we handle your personal information, please reach out to us on WhatsApp at +91 89032 00612 or by email at riyanholidayskkl@gmail.com.

This Privacy Policy is governed by the laws of India, and courts at Dindigul, Tamil Nadu shall have jurisdiction over any disputes arising from it, without prejudice to any consumer-forum rights you may separately have under the Consumer Protection Act, 2019.