1. Overview

Genealogy Allied Services Private Limited ("IRROI", "we", "our", or "us") is committed to protecting the privacy of every Guest, visitor, and enquirer. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights available to you under applicable law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (India).

This policy applies to our website at irroi.in, our reservation and communication channels, and all services provided at our properties — Irroi Kaziranga and Irroi Guwahati.

By using our website or making a reservation, you consent to the practices described in this policy.

2. Information We Collect

2.1 Information you provide directly

• Reservation data: name, date of birth, nationality, ID/passport number, contact number, email address, billing address, and payment details.
• Correspondence: enquiries, feedback, and communications sent via email, WhatsApp, or our contact form.
• Registration card: information completed at check-in, including co-guest details, vehicle registration, and any special requests.
• Event/wedding bookings: additional contact and planning information relevant to the event.

2.2 Information collected automatically

• Usage data: pages visited, time on site, referring URL, browser type, and device information.
• Cookies and similar technologies: see Section 5 for details.
• IP address: collected for security monitoring and geographic analytics.

2.3 Information from third parties

• Online travel agents (OTAs) or booking platforms may share reservation details with us when you book through their platforms.
• We may receive publicly available information to verify identity or prevent fraud, where permitted by law.

3. How We Use Your Information

We use personal data for the following purposes:

• Reservation & service delivery: to confirm bookings, process payments, arrange safaris and activities, and provide accommodation services.
• Legal compliance: to meet obligations under Indian law, including guest registration requirements and tax/GST compliance.
• Safety & security: to verify identity, prevent fraud, and maintain a safe environment at our properties.
• Communication: to respond to enquiries, send booking confirmations, pre-arrival information, and post-stay follow-ups.
• Service improvement: to analyse usage patterns, gather feedback, and improve our offering.
• Marketing (with consent): to send newsletters, offers, or stories from our journal — only where you have opted in. You may unsubscribe at any time.

We process personal data only where we have a lawful basis to do so: contract performance, legal obligation, legitimate interest, or your consent.

4. Sharing & Disclosure

We do not sell your personal data. We may share it only in the following circumstances:

• Service partners: forest department and safari operators (for permit processing), payment processors, and IT/hosting providers — each bound by confidentiality obligations.
• Legal authorities: where required by law, court order, or government regulation (e.g., hotel guest registration with local police, as mandated in India).
• Business transfers: in the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity.
• With your consent: any other sharing will only occur with your explicit prior approval.

5. Cookies

Our website uses cookies — small text files stored on your device — to improve functionality and analyse traffic. We use:

• Essential cookies: required for the website to function (e.g., session management). These cannot be disabled.
• Analytics cookies: help us understand how visitors interact with our site (e.g., pages visited, time spent). Data is aggregated and anonymised.
• Preference cookies: remember choices you have made (e.g., language) to personalise your experience.

You can control cookies through your browser settings. Disabling non-essential cookies will not affect your ability to make a reservation but may limit some site functionality.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Guest records: retained for a minimum of 5 years from the date of stay, as required for tax, legal, and regulatory compliance.
• Enquiries (no booking made): retained for up to 12 months, then deleted.
• Marketing preferences: retained until you withdraw consent.
• Website analytics: anonymised after 26 months.

When data is no longer needed, it is securely deleted or anonymised.

7. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. These include:

• HTTPS encryption for all data transmitted via our website.
• Restricted access to personal data on a need-to-know basis.
• Regular review of data handling practices and staff training.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. Please notify us immediately at irroihotels@gmail.com if you suspect any unauthorised use of your information.

8. Your Rights

Subject to applicable law, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Erasure: request deletion of your data where we no longer have a lawful basis to retain it.
• Withdraw consent: where processing is based on consent (e.g., marketing), you may withdraw it at any time without affecting prior lawful processing.
• Grievance: raise a complaint with us or with the relevant data protection authority.

To exercise any of these rights, please contact our Grievance Officer at irroihotels@gmail.com. We will respond within 30 days.

9. Children's Privacy

Our website is not directed at children under 18 years of age. We do not knowingly collect personal data from minors without parental or guardian consent. Where a reservation includes minors, the accompanying adult is responsible for providing any required information on their behalf.

10. Third-Party Links

Our website may contain links to third-party websites (e.g., OTAs, social media, map services). These links are provided for convenience and do not constitute endorsement. We are not responsible for the privacy practices of third-party sites and encourage you to review their policies independently.

11. International Transfers

Your data is primarily stored and processed in India. Where it is necessary to transfer data to service providers located outside India (e.g., cloud hosting, analytics platforms), we ensure that appropriate safeguards are in place in accordance with applicable data protection law.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. The current version will always be available on this page with the effective date noted at the top. Continued use of our website or services following any update constitutes acceptance of the revised policy.