Privacy Policy

Privacy Policy Last Updated: 3 October 2026 1. Introduction & Scope This Privacy Policy explains how Green Heritage Town & Resort Pvt. Ltd. ("Green Heritage Resort", "Green Heritage", "GHR", "we", "us", "our") handles personal data in connection with the GHR mobile app and our website https://greenheritage.co.in, and the enquiry, booking-request and membership services offered through them. We aim to handle personal data transparently, fairly and securely, taking into account applicable Indian data-protection requirements, including the provisions of the Digital Personal Data Protection Act, 2023 and related rules as and when they come into force and apply to us. Separate terms may also apply to membership agreements and on-ground resort services. 2. Information We Collect We collect only what we need to respond to you and provide our services. Information you provide directly: • Website enquiry forms (stay, package, group/event and occasion enquiries): your name, email, phone number, and — where you provide them — preferred cottage, check-in/check-out dates, number of guests, and your message. • Website contact form: name, email, optional phone, subject and message. • "Own a cottage" / membership-interest form: name, phone, optional email and message. • Account & data-deletion requests: name, registered mobile number, email and an optional reason. Account details (app / member account): • Name, mobile number, email, password (stored hashed, never in plain text), date of birth, address, and profile photo. Booking & payment records: • Stays booked, cottage/category, payment records and invoices. Membership details (members only): • Membership category, agreement, wallet/income ledger, and bank details used for withdrawals. Usage & technical information: • Data needed to operate the app and website (for example login sessions), and limited technical information (such as IP address and basic device/request details) processed by our hosting and backend systems as part of normal operation and security. We do not sell your personal data, and our app and website carry no advertising or analytics SDKs or tracking pixels. 3. How We Use Information We use personal data to: • respond to enquiries and prepare custom quotes for bookings, picnics, group events and celebrations; • create and manage your account, process bookings and payments, and operate the membership programme (allocation, wallet, withdrawals); • manage our customer/member relationship and respond to support requests; • operate, maintain, secure and improve the app and website, and prevent fraud or misuse; • meet legal, regulatory, tax and accounting obligations; and • send service communications and, only where appropriate and permitted, relevant updates. All bookings and group plans are enquiry-based: submitting a website form is a request, not a confirmed reservation, until our team confirms it. 4. Consent & Choice Where we rely on your consent — for example when you voluntarily submit an enquiry form or choose to contact us on WhatsApp — you may decline to provide information, though this may limit our ability to assist you. You can ask us to stop sending non-essential or promotional communications, and you may withdraw consent where consent is the basis for processing, by contacting us using the details in "Contact & Grievances". Withdrawing consent does not affect processing already carried out, or processing we are required or permitted to continue under applicable law. 5. Cookies & Similar Technologies We use cookies and similar technologies sparingly and mainly where necessary for the service to work: • Essential / authentication: when you sign in to a member or staff portal, we use a secure, httpOnly session cookie to keep you signed in; your access token is held only in memory for the session and is not stored in your browser's local storage. We do not currently use third-party advertising, marketing or web-analytics cookies. If this changes, we will update this policy. 6. Sharing & Data Processors We do not sell your personal information for monetary consideration. We use a small number of service providers that process your data only to perform their service for us: • Razorpay — processes online payments. When you pay in the app, your name, email and mobile number are shared with Razorpay to prefill and complete checkout; card/UPI details are entered directly into Razorpay's own secure checkout and are never seen or stored by us. • MSG91 — delivers the SMS OTP codes used for login and registration; your mobile number is shared solely to send that SMS. • Expo (EAS Update) — delivers app updates to your device; this does not involve sharing your personal account data. • Our email provider — used to send booking, contact and account-related notifications from our team. • Google Maps — may load map content on our website Contact page and therefore receive standard request information from your browser, under Google's own privacy practices. • WhatsApp (Meta) — if you choose to contact us through a WhatsApp link, your conversation is handled under WhatsApp's own terms and privacy practices. • Authorities, advisors or others where disclosure is required or permitted by applicable law, or to protect our rights, safety and property. Where a service provider processes personal data on our behalf, we expect it to use that data only as necessary to provide the relevant service and in accordance with applicable contractual and legal requirements. Some third-party services that you choose to use or interact with, such as WhatsApp or Google Maps, may also process information independently under their own terms and privacy policies. 7. Payments Payments for bookings or membership are processed through our payment provider, Razorpay: card/UPI details are entered directly into Razorpay's secure checkout and are never seen or stored by Green Heritage. Our website forms are enquiry-only — no payment or reservation is confirmed from the website. We do not store full card credentials. 8. Data Retention We keep personal data only for as long as is reasonably necessary for the purposes described in this policy — including responding to and acting on your enquiry, providing requested services, managing your membership or account, handling disputes, and meeting legal, tax, accounting and security requirements — after which we take steps to delete or anonymise it. Records tied to completed bookings, payments or memberships may be retained longer where law or legitimate business needs require. 9. Data Security We use reasonable technical and organisational measures intended to protect personal data, such as encrypted (HTTPS) connections, hashed password storage, OTP-based sign-in, httpOnly session handling, and access controls limiting who can view information. No method of transmission over the internet or of electronic storage is completely secure, so while we work to protect your data we cannot guarantee absolute security. 10. Data Breach / Security Incidents If a personal-data security incident occurs, we will assess it and respond in accordance with applicable legal requirements, including any notification obligations that apply to us. 11. Your Rights Subject to applicable law and to our legitimate retention and legal obligations, you may ask us to: • access or obtain information about the personal data we hold about you; • correct or update inaccurate or incomplete data; • delete your data where appropriate — including through "Delete Account" in the app, or our web request page at greenheritage.co.in/account-deletion. A request is verified (matching your registered mobile/email; for member/staff accounts our team confirms identity directly) before any data is changed; on verification we delete or anonymise your personal account data and retain only what we are legally, financially or security-required to keep; • withdraw consent where we rely on consent; and • raise a grievance or concern about how we handle your data. Where applicable law provides further rights (such as nominating another person to exercise rights in certain circumstances), we will honour them as required. We may need to verify your identity before acting, and some data may be retained where law or legitimate business needs require. 12. Children Our app and website are intended for adults (for example, account sign-in requires a mobile number and OTP) and are not directed at children for the direct collection of their personal data. Some promotional images show children enjoying the resort (for example, school or family picnics); this reflects the experiences we host and does not mean we knowingly collect personal data directly from children. School, college and family group arrangements are made with the responsible adults, institutions or guardians. We do not knowingly collect personal data directly from children without appropriate parent, guardian or institutional involvement where required by law. 13. Third-Party Links Our website and communications may link to third-party sites and services (for example our Instagram and YouTube pages, Google Maps, or WhatsApp). We are not responsible for their content or privacy practices; please review their own privacy policies. 14. International / Cross-Border Processing Our core systems are operated for Green Heritage Resort in India. Some third-party service providers may process or store certain information on infrastructure located outside India, depending on how their services are configured and operated. Where cross-border processing occurs, we handle it in accordance with applicable Indian data-protection requirements as they apply to us and rely on the relevant provider's applicable terms and safeguards. 15. Photography / Event Media Where Green Heritage Resort wishes to capture or use photographs or video of guests or events (for example at weddings, functions or group events), this is arranged and agreed directly with the guests or organisers concerned. This Privacy Policy does not by itself grant consent to use your image; any such use is handled separately. If you have a concern about event media, please contact us. 16. Changes to This Policy We may update this Privacy Policy from time to time. Material changes will be reflected on this page with a revised "Last Updated" date. Please review it periodically. 17. Contact & Grievances If you have questions, requests or concerns about this policy or your personal data, please contact us: • Email: greenheritageindia@gmail.com • Phone: +91 8516085813 • Resort: Green Heritage Resort, Narwar, Bandhavgarh, Dist – Umaria, Madhya Pradesh 484664 • Corporate: Near Hanuman Mandir, St. Aloysius School Road, Gortara, Shahdol, Madhya Pradesh These are our general contact channels; data-protection and grievance queries sent to them will be directed to the responsible person within Green Heritage Resort. We will respond within a reasonable time and in accordance with applicable law.