Privacy Policy

Effective Date: 23rd July, 2025

Ahilya Experiental Hospitality and Services LLP its affiliates and subsidiaries, operating under the trade name Ahilya by the sea (“Company”, “we”, “us”, or “our”), respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, share, and safeguard your information when you engage with us, including via our website www.ahilyafort.com, or our hotel, restaurants, bars, spas, salons, etc. and our mobile applications, or other online products and services or when you fill up a form email, and become member of our loyalty programs.

We use our guest information, to offer seamless and personalized service across our properties.

1. Scope

This policy applies to all individuals (“you”) whose personal data is collected or processed by us in the course of hospitality, marketing, and business operations.

2. Entities Covered

This Privacy Policy covers data processed across our properties including: (“Group Entities”)

• Ahilya Fort (Tiger Tops Cultural Travels & Tours Private Limited)
• Ahilya by the Sea (Ahilya Experiential Hospitality & Services LLP)

Your data may be shared securely between these two entities for the purposes defined below.

3. What Information We Collect

a. Personal Information

This includes information that can identify you or is capable of identifying you:

• Contact and Identity Information: Name, email address, phone number, postal address, country, date of birth, gender, and nationality.
• Account and Transaction Data: Membership or registration details, service usage data, feedback and reviews, payment details (including method, mode, and transaction history), preferences, and booking or reservation information.
• Government Identifiers: Passport number, visa details, Aadhaar number.
• Digital and Technical Data: IP address, device information, browser type, browsing behaviour, geolocation data, and other data collected via cookies or similar technologies, including as mandated by law enforcement authorities.
• Social Media and Publicly Available Data: Data made available through social media profiles or public sources, as permitted under applicable law.
• Loyalty Programme Information: Loyalty membership details, account credentials, and any affiliation with third-party travel or reward programmes.
• Other Voluntarily Provided Information: Any other personal information you provide in surveys, questionnaires, forms or communication with us (e.g., marital status, occupation, nationality, preferences, etc.).

b. Sensitive Personal Data

We may collect and process the following SPDI, only where necessary and with your express consent:

• Health and Medical Information: Details relating to medical conditions, allergies, accessibility requirements, or emergency contacts.
• Religious or Dietary Preferences: Information voluntarily provided by you, such as religious beliefs or dietary restrictions.
• Financial Data: Payment instrument details, such as credit/debit card numbers or bank account information (collected via secure payment gateways).

We collect and use this information only for lawful purposes, with your consent where required, and in a fair and transparent manner. You may choose not to provide certain categories of personal or sensitive data, but this may limit your ability to use certain features or services.

4. How We Collect Your Information

• Information You Give Us: We receive and store any information you enter on on our websites or mobile application or give us in any other way (e.g., at our outlets, stores, hotels, kiosks, phone, email, or WhatsApp)
• Automatic Information We Collect from Other Websites: We receive and store certain types of information when you interact with third-party websites that use our platform or with whom we have a specific tie-ups.
• Email Communications: We often receive a confirmation (if your device supports such capabilities) when you open an email from us or click on a link in the email. You can choose not to receive marketing emails from us by clicking on the unsubscribe link in any marketing email.
• Information from Other Sources: We may obtain information from other sources. An example of this is when you authorize a third-party website to interact directly with our website or mobile application to provide or receive information about you. In that case, we may receive information to identify your account with that website.
• Information Previously Provided to the Company: Where you have shared any information previously with any of the Group Entities, it will share such information with us.

You can make choices about our collection and use of your data. For example, you may want to access, edit or remove your data on our website or mobile application. When you are asked to provide data, you may decline.

5. Why We Collect and Use Your Data

We collect and use your personal data in accordance with applicable Indian data protection laws for the following lawful purposes:

• To perform our contractual obligations with you, including the provision of products and/or services you have requested;
• To manage, operate, and improve our products, services, website, and mobile application, and to communicate with you regarding the same;
• To enable our affiliates, subsidiaries, or Group Entities to offer and provide their products and/or services and communicate with you about such offerings;
• To process, disclose, share, or transfer your data with Group Entities or third parties with whom we have a lawful business or contractual relationship, strictly for legitimate purposes;
• To provide you with personalized content, offers, and recommendations, including in relation to financial products and services;
• To analyse usage patterns, conduct market research, generate insights, and improve customer experience and service delivery;
• To administer and facilitate participation in loyalty programs, promotional campaigns, or reward-based services operated by us or our Group Entities;
• To respond to your communications, manage feedback, and address disputes or customer service-related matters;
• To enforce our terms of use and other contractual obligations;
• To detect, investigate, prevent, and mitigate fraudulent activity, security incidents, and other illegal or harmful actions;
• To comply with applicable legal obligations, regulatory requirements, or directions from lawful authorities;
• For any other purpose as may be specifically disclosed to you at the time of collection, or otherwise permitted or required under applicable law.
• We only process your data for the purposes stated above or any other purpose permitted by law, and in a fair and reasonable manner that respects your privacy.

6. Data Sharing

We securely share your data with:

• Partners: We may make available to you services, products, or applications provided by Select third parties (“Partners”) for use on or through our website or mobile application. If you choose to use such services, products or applications, data related to these uses may be shared with such Partner. Such Partners use your data for the purposes of providing their own products or services to you. Their use of your data is subject to their own privacy policies.
• Group Entity: We may share your data with Group Entities for them to:
• Offer personalized service based on your previous stays
• Understand and respect your preferences (e.g. food, room, allergies)
• Simplify your communication with Group Entities
• Service Providers: We may share your data with entities which provide services to the Company (“Service Providers”) who may, in the course of providing their respective services, receive and process data.
• Business Transfers: As we continue to develop our business, we might sell or buy subsidiaries or business units or undergo merger and acquisition. Your data (including in relation to loyalty programs) may be transferred as part of such transactions

7. Cookies and Tracking

Our website and mobile application may place and access certain cookies on your device. Cookies are unique identifiers that we transfer to your device to enable our systems to recognize your device. We also use pixels and similar technologies to analyse traffic on our website and mobile application to improve your experience of using them.

When you first visit our website and mobile application, you will be presented with a pop-up screen informing you of our use of Cookies and asking you to provide your consent for such use. The pop-up screen may not reappear for all your subsequent visits to our website and mobile application. You may adjust your web browser software if you do not wish to receive Cookies or web beacons, but this may prevent you from taking advantage of some of the features of our website and mobile application.

8. Storage and Protection of Your Data

Your data will be stored and processed in India, where we are headquartered. By providing your data, you acknowledge that it will be transferred to and maintained in India, which may not offer the same level of data protection as your home jurisdiction.

If the General Data Protection Regulation (“GDPR”) or the United Kingdom GDPR applies to our processing of your data, we will ensure that any transfer of personal data outside the European Economic Area or the United Kingdom complies with applicable data protection laws and is subject to appropriate safeguards, such as:

• Standard contractual clauses approved by the European Commission or the United Kingdom Information Commissioner’s Office;
• Transfers to countries recognised as providing an adequate level of protection;
• Transfers necessary for the performance of a contract entered into in your interest; or
• Your explicit consent to the transfer.

We will continue to protect your data in accordance with this Privacy Policy, and as otherwise disclosed to you at the time of collection or through any relevant program-specific privacy notice.

9. How Long We Keep Your Information

We retain your data only as long as necessary to:

• Comply with laws (e.g. ID records for 7 years)
• Respond to post-stay requests
• Improve future stays

We may anonymize data for analytics after retention limits are reached.

10. Your Rights

Depending on applicable laws, you may have certain rights in relation to the personal data we hold about you. These may include:

• Access and Confirmation: to know what data we hold and request a copy.
• Rectification: to correct incomplete or inaccurate data.
• Erasure: to request deletion of your data in certain circumstances.
• Restriction: to limit how we process your data, for example, if its accuracy is disputed.
• Objection: to object to certain types of processing, including where based on our legitimate interests.
• Data Portability: to request transfer of your data to another party, where technically feasible.
• Withdraw Consent: to revoke your consent at any time, where processing is based on consent.
• Lodge a Complaint: to contact your local data protection authority if you believe your rights have been violated.

To exercise any of these rights, please email us at [email protected]. We aim to respond without undue delay and within applicable legal timelines. Please keep your data with us up to date. We may retain records of communications and, where permitted, may decline a request in accordance with law.

11. Minors

Our website and mobile application do not offer products or services for use by minors. If you are under 18, you may use our website or mobile application only with the involvement of a parent or guardian.

12. Grievance Office

13. Policy Updates

Our business changes constantly and our Privacy Policy will change also. We may email periodic reminders of our notices and conditions, unless you have instructed us not to, but you should check our website and mobile application frequently to see recent changes. The updated version will be effective as soon as it is accessible. We encourage you to review this Privacy Policy frequently to be informed of how we are protecting your information.