Legal

Privacy Policy

Last updated: 14 October 2026

This policy explains what personal data this website collects, why we collect it, who it is shared with, how long we keep it, and the rights you have over it under India’s Digital Personal Data Protection Act, 2023. We have tried to say exactly what happens to your information, in plain words.

For the personal data described here, Vrindavan Staycation is the Data Fiduciary and you are the Data Principal. This policy applies to https://vrindavanstaycation.com and to the enquiries you send us through it.

1. What we collect

Information you give us

This website has no account, no login and no payment page. It asks for personal data in two places. The enquiry form in the booking section asks for:

• Your name — required
• Your mobile number — required
• Your intended check-in and check-out dates — required
• Your email address — optional
• The number of guests and rooms — optional
• Anything you choose to write in the message box — please include only what is relevant to your stay

The tour operator empanelment form, used by travel businesses applying to be listed with us as booking partners, asks for:

• The type of applicant, the name of the applicant or company, the registered office address, a contact person and their designation, a mobile number and an email address — required
• A trade or brand name, the year of establishment, a correspondence address and a landline number — optional
• The business’s PAN, GST, tourism department, trade licence, firm or company registration, and shop and establishment numbers — optional
• For up to four proprietors, partners or directors: name, designation, contact number, email address and PAN or Aadhaar number — optional
• The nature of the business, its years of experience, key destinations and areas of operation, and major clients or associations — optional

If you give us details of other people, such as your partners or directors, please let them know you are sharing them with us.

Apart from the business and identity numbers the empanelment form asks of applicants, we never ask for card, bank or UPI details or government ID numbers through this website, and you should not send them through the enquiry form. Any payment is arranged directly with our reservations team. The government-issued photo ID that every adult guest must provide (see our Terms & Conditions) is not collected through this website.

Information recorded automatically

• When you send either form, the date and time it was received, the IP address it came from and the address of the page it was sent from are added to the email it produces, so we can trace and block spam and abusive submissions.
• A small file on our server named with a coded form of your IP address, which the server uses only to stop a form being sent again within a short time.
• If you accept cookies, a count of the advertising events our server passes on to Meta for you in the current hour (see Meta in section 4), kept under a coded form of your IP address so that no one visitor can send too many. The code is made with a random key that is kept with the count; the first such event our server handles in a later hour replaces the key and deletes the counts, and from then on the old count can no longer be linked to your address.
• Standard web-server logs kept by our hosting provider, which record requests made to the site.
• Measurement data sent to Google Tag Manager, Google Analytics and Google Ads and, if you accept cookies, to Meta, as described in sections 4 and 9.

2. Why we use it

• To answer your enquiry, check availability for your dates and offer you a booking.
• To contact you about that enquiry by phone, WhatsApp or email. If you give us an email address, our replies to your enquiry go back to it.
• To keep a record of enquiries so our team can follow up, and so we can resolve any question about what was agreed.
• To review an empanelment application, contact the applicant about it, and keep a record of the businesses we work with as booking partners.
• To detect, block and investigate spam and misuse of the forms.
• To understand, in aggregate, how visitors use this website and which pages lead to enquiries, so we can improve it.
• To estimate, in aggregate, how many enquiries, calls and WhatsApp messages our Google ads lead to, from the cookie-free records described in section 4, which Google receives whether or not you accept cookies.
• If you accept advertising cookies, to measure how well our Google and Meta (Facebook and Instagram) ads work — for example, whether an ad led to an enquiry, a call or a WhatsApp message — and to show our ads to people who have visited this website.

We do not sell or rent your personal data. We do not use it for automated decision-making or profiling that produces legal effects for you, and we will not use your details for unrelated marketing without asking you first.

3. Consent, and how to withdraw it

We process your enquiry or empanelment application on the basis of the consent you give when you send it, for the purposes in section 2 and no others. Analytics and advertising cookies are set, and your visit is used to personalise ads or to build ad audiences, only if you accept them in the cookie notice (see section 9); before you choose, or if you decline, Google Analytics and Google Ads still receive cookie-free records of your visit, as described in section 4.

You can withdraw your consent at any time by emailing sales@vrindavanstaycation.com. Withdrawing is as easy as giving consent was. When you withdraw, we will stop processing your data and delete it, except for anything we are required by law to keep. Withdrawal does not make unlawful any processing we carried out before you withdrew. You can change your cookie choice at any time with Cookie settings, at the foot of every page.

4. Who we share it with

We share your enquiry or application only with the people and services needed to answer it:

• Our own team. Your enquiry is emailed to the team that handles reservations, at a mailbox hosted by Google. If you gave an email address, it is set as the reply address, so our answer comes straight back to you. Empanelment applications are emailed to the same mailbox, with the applicant’s email address as the reply address.
• Our web hosting and email provider, which stores this website and sends the enquiry email on our behalf.
• Google (Apps Script and Google Sheets). Our server also sends the details of your enquiry — everything except your IP address and the page address — to a Google Apps Script endpoint, which records them as a row in a private Google Sheet that we use as our enquiry register. Empanelment applications are recorded the same way, in a separate private Google Sheet that we use as our register of applications.
• Google (Tag Manager, Analytics and Ads). Every page loads Google Tag Manager, Google Analytics and our Google Ads tag. Google Analytics sends Google a record of each page you view and of some things you do on it, such as scrolling to the end of a page, clicking a link to another website, starting or sending the enquiry form, or playing a video; the Google Ads tag sends a record of each page you view; and when an enquiry has been sent, the thank-you page tells Google Ads that an enquiry was made; and when you tap one of our call or WhatsApp buttons, Google Ads is told that you contacted us that way, and Google Analytics which of the two you tapped and where the button is on the page. Each record includes the page, the time, your browser and device type and, as with any request over the internet, your IP address. Google’s tags read your cookie choice through Google Consent Mode. Until you accept, the records are sent without cookies and without an identifier that links one page view to the next; if you arrived by clicking one of our Google ads, they still carry the click identifier Google added to the page address, which Google uses to estimate, in aggregate, how many enquiries, calls and WhatsApp messages our ads lead to. If you accept, Google Analytics also sets cookies that recognise your browser on later visits, the Google Ads tags set cookies that link a click on one of our ads to the enquiry, call or WhatsApp message that follows (see section 9), and Google may use the data from your visit for advertising: to measure the results of our Google ads, and to include your browser in the audiences our ads are shown to on other websites and apps. These tools do not receive what you type into either form. How Google uses this data
• Meta (Facebook and Instagram). Only if you accept cookies in the cookie notice, every page also loads the Meta Pixel. It tells Meta each page you view, with the page address and details published on the page such as its title; on the thank-you page it tells Meta that an enquiry was sent, and when you tap one of our call or WhatsApp buttons it tells Meta that you contacted us that way. Our server sends Meta the same two events directly as well (Meta’s Conversions API), with your IP address, your browser’s user agent, the Meta cookie values described in section 9, the page address and an event number that lets Meta count each event once, so they are recorded even if your browser blocks the Pixel. Meta does not receive what you type into either form, your email address or your phone number. Meta may use this data to measure our ads and to show our ads to people who have visited this website, as its Privacy Policy describes. If you decline, nothing is sent to Meta.
• Google (Maps). The map at the foot of each page is embedded from Google Maps. When it loads, Google receives your IP address and may set cookies. Our page of places to stay around Vrindavan Staycation also shows a Google map, with nearby hotels and guest houses from Google Maps: your browser asks Google for the map, the list and its photos, so Google receives your IP address, whether you are looking at hotels or at vacation rentals, and the distance you choose. When you press the button to search for prices, the type of stay, the dates, the number of guests and the price range you chose on that page — or, if you search for one hotel, the name you typed — are sent to our server, which passes them, and nothing about you, not even your IP address, to SerpApi, a service based in the United States that returns Google Hotels’ results for them, with each booking site’s price. Our server keeps a note of which places a search listed, and their booking sites’ prices, for a day; to limit how many searches one visitor can make, it also keeps a coded form of your IP address (not the address itself) with the times of your searches, for ten minutes. Both are deleted after that, the next time the price search is used. The photos in the search results load from Google. If you open a place, or your search, on Google Hotels, your choices are put into the address of the Google Hotels page that opens, where Google’s own privacy policy applies. If you ask for more places, your browser makes further searches of Google Maps for the same area. Google Analytics records that you used those buttons, with the type of stay and the number of nights and guests (and, for more places, the distance and how many were found), but not the dates, the price or the names of places. Use of the map is subject to the Google Maps Terms of Service and the Google Privacy Policy.
• Google (YouTube). The guest review videos open from YouTube’s privacy-enhanced domain only when you choose to play one. Until then nothing is loaded from YouTube; the preview pictures are hosted on this website.
• WhatsApp (Meta). If you choose to message us on WhatsApp, that conversation is governed by WhatsApp’s own privacy policy, not this one.
• Social media. The links to our Instagram, X, YouTube and Facebook pages take you to those services, whose own privacy policies apply.

We may also disclose personal data where we are required to by law, a court, or a lawful request from a public authority.

5. Where your data is processed

Our hosting provider stores this website and sends the enquiry emails. The Google and Meta services named above, and SerpApi, may process data on servers outside India. The Digital Personal Data Protection Act, 2023 permits such transfers except to countries or territories that the Government of India restricts by notification, and we will comply with any such restriction.

6. How long we keep it

• Enquiries that do not become bookings are kept for up to 24 months after our last contact with you, and then deleted from our enquiry register and mailboxes.
• Enquiries that become bookings are kept for as long as the law requires us to retain records connected with that stay, including tax and accounting law, and then deleted.
• Empanelment applications are kept for as long as the business remains empanelled with us. Applications that are not taken forward are kept for up to 24 months after our last contact with the applicant, and then deleted from our register of applications and mailboxes.
• If you withdraw consent or ask us to erase your data, we delete it sooner — see sections 3 and 7.
• How long cookies last is set out in section 9.

7. Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you, what we have done with it, and who we have shared it with.
• Correct, complete or update anything inaccurate or out of date.
• Erase your personal data where we no longer need it for the purpose it was collected for.
• Withdraw consent at any time, as described in section 3.
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
• Have a grievance heard — see section 8.

To exercise any of these, email sales@vrindavanstaycation.com from the address you enquired with, or tell us the mobile number you used, so we can find your enquiry. We will respond within a reasonable time and in any case within the time the law allows. We may ask you to confirm your identity before acting, so that we do not disclose your data to someone else.

8. Grievance redressal

If you are unhappy with how we have handled your personal data or a request under section 7, contact our Grievance Officer:

• Grievance Officer, Vrindavan Staycation
• Email: sales@vrindavanstaycation.com
• Phone: +91 98327 77222
• Post: Vrindavan Staycation, Krishna Bhumi, Bhaktivedanta Swami Marg (Chhatikara Road), Vrindavan, Uttar Pradesh 281121, India

If you are still not satisfied, you may complain to the Data Protection Board of India in the manner it prescribes.

9. Cookies

This website sets one cookie of its own. The others below are set by Google Analytics, Google Ads and Meta, and only if you accept cookies in the cookie notice:

If you accept, Google may also use your visit for advertising, as described in section 4, and may set cookies of its own on its own domains (such as google.com, doubleclick.net and googleadservices.com) for the same advertising measurement; those are governed by Google’s privacy policy. Meta may likewise use your visit as described above, and its own cookies on facebook.com are governed by Meta’s privacy policy. If you decline, or later change your choice to decline, no analytics or advertising cookies are set, and any this website set earlier are removed; cookies Google or Meta set on their own domains can be removed in your browser’s settings. Some browsers, such as Safari, keep cookies set by a website’s own scripts for a shorter time, so you may be asked again sooner. The Google map may set its own cookies when it loads, and YouTube may do so if you play a video; our cookie notice does not control these. Our cookie notice used to ask about analytics only; if you accepted it then, we ask you again before your visit is used for advertising by Google or Meta.

You can change your choice at any time with Cookie settings at the foot of every page. Most browsers also let you block or delete cookies in their settings. Blocking cookies does not stop you enquiring — the form works without them.

The typefaces and icons on this website, and the code libraries it uses (jQuery and Fancybox), are served from this domain, so no font service or public code library is contacted. The only exceptions are the Google services described in section 4 and, if you accept cookies, the Meta Pixel’s code, which is loaded from Meta (connect.facebook.net).

10. Children

This website is intended for adults arranging a stay. We do not knowingly collect personal data from a child through the enquiry form without the verifiable consent of a parent or guardian, and we do not use children’s data for tracking or targeted advertising. Bookings must be made by an adult. If you believe a child has sent us personal data, email sales@vrindavanstaycation.com and we will delete it.

11. Keeping it secure

This website is served over an encrypted HTTPS connection. Access to enquiry data is limited to the people who need it to answer you, and the form has spam protection and server-side checks. We take reasonable security safeguards to prevent a personal data breach, and if one occurs we will notify the Data Protection Board of India and the people affected, as the law requires. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may change this policy from time to time. The date at the top of this page shows when it last changed. If a change materially affects how we use data you have already given us, we will take reasonable steps to tell you.