Privacy Policy

Effective Date: 24 September 2024

Last Updated: 21 July 2026

Introduction

Orchid Vacation ("Company," "we," "us," or "our") is dedicated to protecting your privacy and ensuring the security of your personal data. This Privacy Policy outlines our practices regarding the collection, use, disclosure, and protection of information obtained through this website, as well as your rights under the Digital Personal Data Protection (DPDP) Act, 2023.

This policy applies exclusively to data collected through this website. Information gathered during membership onboarding is subject to separate contractual and regulatory terms (see Section 5).

1. Information We Collect

We collect personal data that you voluntarily provide to us, along with limited technical information required to maintain the functionality and security of the website.

A. Voluntarily Provided Information

  • Enquiry Forms: Name, email address, telephone number (optional), destination preference, message content, and record of consent (including timestamp).
  • Newsletter Subscriptions: Email address, name (optional), consent status (with timestamp), and campaign tracking parameters embedded in referral links.
  • User Reviews: Name, email address, star rating, review title, message content, and designated location.
  • Testimonials: Star rating, title, testimonial content, uploaded media (photos/videos), and profile metadata obtained via social authentication.
  • Single Sign-On (SSO) Data: When authenticating via Google or Facebook, we receive your basic profile information (name, email address, and profile picture). We do not collect, process, or store your third-party account passwords.

B. Technical and Automated Information

  • Security & Interaction Data: IP addresses are logged upon submission of forms, reviews, or testimonials to prevent automated abuse, spam, and unauthorized activity.

Note: This website does not collect sensitive demographic details (e.g., age, gender, marital status, physical address), government-issued identification, or financial payment information.

2. Purpose and Legal Basis for Processing

We process your personal data strictly for specified, explicit, and legitimate purposes:

  • Service Delivery & Communication: To process and respond to your enquiries, fulfill information requests, and facilitate relevant communication.
  • Marketing Communications: To distribute newsletters where explicit consent has been granted, and to evaluate marketing campaign performance.
  • Content Publication: To display verified user reviews and testimonials on our public platforms.
  • Platform Integrity & Security: To protect our website against spam, automated threats, and fraudulent activity.
  • Regulatory Compliance: To fulfill legal obligations under applicable Indian laws.

3. Data Sharing and Third-Party Services

We do not sell, rent, or trade your personal data. Third-party disclosures are limited to operational service providers acting under strict confidentiality and processing agreements:

  • Google reCAPTCHA: Deployed on form submissions to mitigate spam and automated bot activity. Interaction data and IP addresses transmitted to Google are governed by the Google Privacy Policy.
  • Authentication Providers: Google and Facebook process identity verification data strictly when you elect to use their SSO services.
  • Infrastructure & Hosting Providers: Third-party cloud hosting and content management platform providers store data securely on our behalf, operating strictly under our instructions.

4. Publicly Displayed Information

User reviews and testimonials are intended for public distribution. Upon approval, your name, profile picture (if authenticated via SSO), rating, submission content, and uploaded media will be visible to the public.

Your email address and IP address are strictly confidential and will never be published. You may request the removal of published content at any time by contacting our Grievance Officer.

5. Membership Onboarding Data

When you purchase a membership with Orchid Vacation, additional information — including formal identity documentation for Know Your Customer (KYC) compliance and financial details for payment processing — is collected through a dedicated onboarding process. That data is governed by the terms of your Membership Agreement and relevant statutory requirements, rather than this Website Privacy Policy.

6. Data Principal Rights (DPDP Act, 2023)

Under the Digital Personal Data Protection Act, 2023, you possess the following rights regarding your personal data:

  • Right to Access: Request a summary of your personal data currently being processed by us.
  • Right to Correction & Erasure: Request the correction of inaccurate or incomplete data, or the erasure of personal data that is no longer necessary for the purpose it was collected.
  • Right to Withdraw Consent: Revoke your consent at any time without affecting the lawfulness of processing based on consent prior to its withdrawal.
  • Right to Grievance Redressal: Access an effective mechanism to address any grievances regarding the processing of your personal data.

7. Data Retention Policy

Personal data is retained only for as long as necessary to fulfill the purposes outlined in this policy:

  • Enquiry Records: Retained for the duration of the communication and any subsequent membership evaluation period.
  • Marketing Data: Retained until you withdraw consent or opt out via the unsubscribe mechanism.
  • Published Media & Reviews: Retained until a formal deletion request is submitted.
  • Legal Obligations: Retained beyond standard operational periods where required by applicable statutory laws.

8. Grievance Redressal Officer

In accordance with the DPDP Act, 2023, if you have any questions, concerns, or requests regarding the processing of your personal data, please contact our designated Grievance Officer:

Orchid Vacation

Subscribe for Newsletter