This Privacy Policy applies to personal data collected by Heartistry Stays (owned by Sarthak Shrivastava) and processed through the Qord platform in connection with bookings. It complies with the Digital Personal Data Protection (DPDP) Act 2023 and the Information Technology Act 2000.
1. Data Controller
The data controller for personal data collected via this website is:
- M/S Raghav Enterprises (operating as Heartistry Stays) / Sarthak Shrivastava
- Email: heatistrystays@gmail.com
- Phone: +91 89898 93763
Qord (qord.in) acts as a data processor on behalf of Heartistry Stays for the purposes of booking management and payment collection. EaseBuzz acts as an independent data controller for payment processing data.
2. Data We Collect
2.1 Information you provide directly
- Identity data: Full name, date of birth (where required for check-in compliance)
- Contact data: Email address, mobile phone number, WhatsApp number
- ID verification: Government-issued ID (Aadhaar, PAN, passport, or driving licence) — collected only as required for property check-in under applicable regulations
- Booking data: Property selected, check-in/check-out dates, number of guests, special requests
- Payment data: Card type, last 4 digits, UPI handle, or net banking bank name. Full card/account numbers are never stored by Heartistry Stays or Qord — they are handled solely by EaseBuzz under PCI-DSS standards.
2.2 Information collected automatically
- IP address, browser type, device type, operating system
- Pages visited, time spent, referral URLs
- Cookie data (see Cookie Policy)
3. How We Use Your Data
| Purpose | Legal Basis (DPDP Act 2023) |
|---|
| Processing and confirming your booking | Contractual necessity |
| Sending booking confirmations and stay-related communications | Contractual necessity |
| Processing payments via Qord / EaseBuzz | Contractual necessity |
| ID verification at check-in | Legal obligation |
| Responding to queries and complaints | Legitimate interest |
| Sending post-stay review requests | Legitimate interest |
| Analytics and website improvement | Legitimate interest / Consent (cookies) |
| Marketing communications (opt-in only) | Consent |
4. Third-Party Sharing
We share your personal data only with the following parties, and only to the extent necessary:
- Qord (qord.in): Booking management, payment collection, and guest communication platform. Qord processes your data as our data processor under a data processing agreement.
- EaseBuzz: Payment gateway. EaseBuzz receives payment data independently and is subject to its own privacy policy and RBI regulations.
- Supabase: Cloud database infrastructure used by Qord to store booking and guest data. Data is stored on servers that may be located outside India; appropriate safeguards are applied.
- WhatsApp (Meta): Guest communication channel. Messages sent via WhatsApp are subject to Meta's privacy policy.
We do not sell, rent, or trade your personal data to any third party for marketing purposes.
5. Data Retention
- Booking and payment records: Retained for 7 years from the date of stay to comply with Indian tax and accounting regulations.
- ID verification documents: Retained for the period required by applicable law and deleted thereafter.
- Marketing preferences: Retained until you withdraw consent.
- Website analytics data: Retained for up to 26 months in anonymised form.
6. Your Rights Under the DPDP Act 2023
As a data principal under the Digital Personal Data Protection Act 2023, you have the right to:
- Access: Request a summary of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete personal data.
- Erasure: Request deletion of your personal data, subject to legal retention requirements.
- Grievance redressal: File a complaint with our designated Data Protection Officer (contact below) or escalate to the Data Protection Board of India.
- Nomination: Nominate another individual to exercise your rights in the event of death or incapacity.
To exercise any of these rights, write to heatistrystays@gmail.com with the subject line "Data Rights Request". We will respond within 30 days.
7. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Payment data is handled exclusively by EaseBuzz under PCI-DSS compliance. However, no internet transmission is 100% secure, and we cannot guarantee absolute security.
8. Cookies
We use cookies and similar tracking technologies on this website. Please refer to our Cookie Policy for full details and opt-out options.
9. Children's Privacy
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data to us, please contact us immediately.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date reflects the most recent revision. Continued use of the website after any update constitutes acceptance of the revised policy.
11. Contact & Grievance Officer
For privacy-related queries, data requests, or complaints:
- Sarthak Shrivastava (Grievance Officer) — M/S Raghav Enterprises
- Email: heatistrystays@gmail.com
- Phone: +91 89898 93763
- Response time: Within 30 days of receipt of complaint.