Privacy Policy

1. Introduction

Merina HMS Private Limited ("Company", "we", "us", "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our hotel management platform ("Platform").

This Policy is published in compliance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("IT Rules").

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, business name, GST number, and billing address
• Hotel/Property Information: Property details, room inventory, pricing, and amenities
• Payment Information: Processed securely via Razorpay; we do not store card details
• Guest Information: Guest names, contact details, ID documents (as required by law), and booking details
• Communications: Support tickets, feedback, and correspondence with us

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent, and actions taken
• Device Information: IP address, browser type, operating system, and device identifiers
• Cookies: Session cookies for authentication and analytics cookies (with consent)
• Log Data: Server logs for security and performance monitoring

3. Sensitive Personal Data or Information (SPDI)

As defined under the IT Rules, SPDI includes:

• Passwords and authentication credentials
• Financial information (bank account, payment instrument details)
• Physical, physiological, and mental health conditions (if provided)
• Biometric information (if used for verification)

We collect SPDI only with your explicit consent and process it in accordance with the IT Rules.

4. How We Use Your Information

We use collected information for:

• Service Delivery: Providing, maintaining, and improving the Platform
• Account Management: Creating and managing your account, processing subscriptions
• Communication: Sending service updates, security alerts, and support responses
• Billing: Processing payments, generating invoices, managing subscriptions
• Legal Compliance: Meeting regulatory requirements (C-Form, FRRO reporting, GST)
• Security: Detecting and preventing fraud, unauthorized access, and abuse
• Analytics: Understanding usage patterns to improve our services
• Marketing: Sending promotional communications (with consent, opt-out available)

5. Data Sharing and Disclosure

We may share your information with:

5.1 Service Providers

• Razorpay: Payment processing (PCI-DSS compliant)
• Cloud Providers: Data hosting and storage
• Communication Services: Email, SMS, and WhatsApp notifications
• Analytics: Usage analytics and performance monitoring

5.2 Legal Requirements

• Government authorities for C-Form and FRRO compliance
• Law enforcement agencies when required by law
• Courts or tribunals pursuant to valid legal process

5.3 Business Transfers

In the event of merger, acquisition, or sale of assets, your information may be transferred to the successor entity with prior notice.

6. Data Security

We implement reasonable security practices as required under the IT Rules:

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Access Controls: Role-based access, multi-factor authentication
• Infrastructure: Secure cloud hosting with regular security audits
• Monitoring: 24/7 security monitoring and intrusion detection
• Backups: Regular encrypted backups with disaster recovery
• Employee Training: Security awareness and data handling protocols

7. Data Retention

• Account Data: Retained while your account is active and for 3 years after termination
• Guest Records: As required by law (typically 1 year for C-Form records)
• Transaction Records: 8 years as per GST and accounting requirements
• Usage Logs: 90 days for analytics, 1 year for security logs

You may request data deletion subject to legal retention requirements.

8. Your Rights

Under applicable Indian laws, you have the right to:

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Withdrawal of Consent: Withdraw consent for SPDI processing
• Data Portability: Export your data in a structured format
• Deletion: Request deletion of your data (subject to legal requirements)
• Opt-out: Unsubscribe from marketing communications

To exercise these rights, contact us at privacy@merinahms.in.

9. Cookies Policy

We use the following types of cookies:

• Essential Cookies: Required for authentication and security (always active)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand Platform usage (with consent)

You can manage cookie preferences through your browser settings.

10. Children's Privacy

Our Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected such information, please contact us immediately.

11. Cross-Border Data Transfer

Your data is primarily stored in India. If data transfer outside India is necessary (e.g., for cloud services), we ensure adequate protection through:

• Contractual safeguards with service providers
• Compliance with applicable data protection standards
• Your explicit consent where required

12. Grievance Officer

In accordance with the IT Rules, we have appointed a Grievance Officer:

13. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or Platform notification at least 15 days before becoming effective. The "Last Updated" date indicates the most recent revision.

14. Contact Us