The short version
- What we collect
- Contact and booking details, ID at check-in, payment references, preferences, call recordings, CCTV in public areas and website data.
- Why
- To take your booking, check you in as the law requires, look after your stay, keep guests safe and, only if you agree, send you offers.
- What we never do
- We do not sell your personal data or use it for anything you were not told about.
- Your rights
- Access, correct or erase your data, withdraw consent, raise a grievance, or nominate someone.
- How long
- Only as long as needed or required by law, with a set period for each type of data.
- Contact
- Our Grievance Officer at privacy@rhythmhospitality.com. We reply within 90 days at the latest.
About this policy
Rhythm Hospitality Private Limited ("Rhythm", "we", "us") is the Data Fiduciary for the personal data described in this policy. Our registered office is at Landmark Building, 3rd Floor, Next to Mahindra Towers, HR Devrukhkar Marg, Worli, Mumbai 400018, India. CIN: U65944MH1993PTC072876
This policy covers personal data we collect through:
- rhythmhospitality.com and the websites of each property
- Rhythm Lonavala, Rhythm Kumarakom and Rhythm Gurugram
- bookings made directly, by phone, WhatsApp or email, or through travel agents and online travel platforms
- calls to our reservation and property numbers, including our automated voice assistant
- weddings, events, corporate bookings, enquiries, marketing and social media
It is written to meet the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. You can ask for this policy in English or in any of the 22 languages listed in the Eighth Schedule to the Constitution of India.
Personal data we collect
We collect only what we need. You can choose not to share some details, but we may then be unable to confirm a booking or check you in.
| Type | Examples |
|---|---|
| Contact and booking | Name, phone, email, address, stay dates, room type, number of guests, special requests |
| Identity documents | Government photo ID at check-in; passport and visa details for foreign nationals |
| Payment | Billing name, GST number, transaction reference. Card details are handled by our payment partners; we do not store full card numbers. |
| Stay and preferences | Room and dining preferences, occasions, spa bookings, feedback and reviews |
| Calls | Recordings and transcripts of calls with our reservation and property teams |
| CCTV | Video from cameras in public areas of our properties |
| Website and device | IP address, browser, device type, pages visited, cookies, ad click data |
| Events and corporate | Organiser and attendee names and contact details |
| Marketing | Contact details and preferences from enquiry forms, social media and ad lead forms |
How we collect it
- From you, when you book, call, message, fill in a form, check in or speak to our team.
- From partners, such as travel agents, online travel platforms and companies that book on your behalf.
- Automatically, through cookies on our websites, our call system and CCTV at our properties.
- From platforms you use, such as Google and Meta, when you respond to our ads or contact us there.
Why we use it
Each purpose, and the reason we are allowed to process data for it.
| Purpose | Data | Basis |
|---|---|---|
| Take, confirm and manage bookings and events | Contact, booking, payment, event | Your consent, or the purpose you shared it for |
| Check-in and guest registers | Identity, booking | Legal obligation, including Form C for foreign nationals |
| Billing, tax and accounts | Payment, GST | Legal obligation |
| Look after your stay | Preferences, stay details | Your consent |
| Answer and return calls, improve service | Call recordings | Your consent, announced at the start of each call |
| Safety of guests, staff and property | CCTV | Legitimate use for safety and security |
| Offers and newsletters | Contact, marketing | Your consent, which you can withdraw |
| Measure and improve our websites and ads | Website and device | Your consent through our cookie banner |
We do not sell your personal data, and we do not use it for any other purpose without telling you and, where needed, asking for your consent.
Consent and your choices
Where we rely on consent, we ask for it clearly and separately for each purpose. Marketing consent is always a separate choice and never a condition of booking.
You can withdraw consent at any time, as easily as you gave it:
- use the unsubscribe link in any email, or reply STOP to our WhatsApp or SMS messages
- change your choice in the cookie settings on our websites
- write to our Grievance Officer
Withdrawing consent does not affect anything we did before. If a service depends on that consent, we may no longer be able to provide it.
CCTV and call recordings
CCTV
Our properties use CCTV in public areas such as entrances, lobbies, corridors, parking and outdoor spaces, for the safety of guests, staff and property. Signs show where cameras are in use. We never place cameras in guest rooms, washrooms, changing rooms or spa treatment rooms.
Call recordings
Calls to our reservation and property numbers are recorded, and this is announced at the start of each call. Recordings and transcripts help us return missed calls, follow up on enquiries, train our team and resolve disputes. Some calls may be answered by an automated voice assistant. If you prefer not to be recorded, you can reach us by email instead.
Identity and sensitive data
Indian law requires hotels to record the identity of every guest at check-in, and to report foreign nationals to the authorities through the applicable foreigner registration form (Form C or Form III, as required). We collect identity documents only for this purpose and store them securely.
If you tell us about dietary needs, allergies or accessibility needs, we use this only to look after you during your stay, and only with your consent.
Children
Bookings must be made by an adult aged 18 or over. Children's details given as part of a family or group booking are provided by the booking adult and used only for that stay and as the law requires. We do not knowingly collect data directly from anyone under 18 without verifiable consent from a parent or lawful guardian, and we do not track children or target advertising at them.
Transfers outside India
Some of our service providers, such as cloud and email providers, may store data on servers outside India. We transfer data only as permitted by the DPDP Act, and never to a country the Government of India has restricted.
How long we keep it
Only as long as the purpose needs it or the law requires. After that, we delete it or make it anonymous so it can no longer identify you.
| Data | Kept for |
|---|---|
| Booking, billing and tax records | 8 years, as required by tax and accounting law |
| Identity documents and guest registers | 1 year after checkout, or as required by applicable police regulations |
| Call recordings and transcripts | 1 year, unless needed to resolve a complaint or dispute |
| CCTV footage | 30 days, unless needed for an investigation |
| Marketing data | Until you withdraw consent, or 3 years after your last interaction |
| Website and access logs | At least one year, as required by the DPDP Rules |
Security and breaches
We protect personal data with encryption, access controls, access logs and regular training for our team. Only people who need data for their work can see it. Please do not send card numbers or ID documents by email or WhatsApp.
If a personal data breach happens, we will inform affected people and the Data Protection Board of India without delay, as the law requires, and explain what happened, its likely impact and what you can do.
Your rights
Under the DPDP Act, you have the right to:
- Access
- A summary of your data, how we use it and who we have shared it with.
- Correct
- Correct, complete or update data that is wrong or incomplete.
- Erase
- Have data deleted once it is no longer needed, unless the law requires us to keep it.
- Withdraw
- Stop any processing that relies on your consent.
- Complain
- Raise a grievance with us, and then with the Data Protection Board of India.
- Nominate
- Name someone to exercise these rights for you in case of death or incapacity.
To use any of these rights, write to our Grievance Officer. We may ask you to confirm your identity first. We do not charge for reasonable requests.
Booking for others
If you share details of other people, such as family, colleagues or event guests, please make sure they know about this policy and have agreed to you sharing their details with us.
Grievance Officer
For any question, request or complaint about your personal data:
We acknowledge every request promptly and respond within 90 days at the latest. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Changes to this policy
We may update this policy when our services or the law change. The latest version will always be on this page, with its effective date at the top. For significant changes, we will tell you by email or with a notice on our website before they take effect.