privacy-Policy | The Oterra

The Oterra – Website Privacy Policy

Welcome to the website privacy notice of The Oterra, (“The Oterra”). .

The Oterra respects your privacy and is committed to protecting your personal data. This privacy notice sets out information about how we treat your personal data, including when you visit our website (www.theoterra.com).

1. Important information and who we are

2. The data we collect about you

3. How your personal data is collected

4. How we use your personal data

5. Cookies

6. Disclosures of your personal data

7. Data security

8. Data retention

1. IMPORTANT INFORMATION AND WHO WE ARE

Purpose of This Privacy Notice

This privacy notice aims to give you information about how The Oterra collects and processes your personal data, including any data you may provide through this website when you make a booking reservation, purchase another service, subscribe to our newsletter or consent to receive marketing communications.

This privacy notice should be read together with any other data privacy notice or fair processing notices we may provide to you from time to time in connection with our processing of your personal data for specified purposes.

About Us

This privacy policy is issued on behalf of Velankani Information System Limited and its group of affiliated entities and references to The Oterra, “we”, “us” or “our” in this privacy notice, are referring to the relevant entity within The Oterra responsible for processing your personal data. We will let you know which entity is the data controller of your personal data (or recipient of personal data as otherwise identified) when you make a reservation or purchase another service with us. Unless you are otherwise notified,The Oterra (a unit of Velankani Information System Limited) is the data controller and responsible for the processing of your personal data in connection with this website. .

Contacting Us

If you have any questions regarding this privacy notice or if you would like to exercise any of your rights in relation to your personal data, you can do so by contacting our IT team at any time by email to: isghelpdesk@theoterra.com .

Additional contact information:

Full name of legal entity:The Oterra, A Unit of Velankani Information System Limited

Postal address:The Oterra, 43, Electronics City Phase 1, Hosur Road, Bengaluru, Karnataka – 560100, India.

Telephone number: + 91 80 3003 0303

Changes to the Privacy Notice and your duty to inform us of the Changes

We keep our privacy notice under regular review. This version was last updated on August 5, 2020.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

2. THE DATA WE COLLECT ABOUT YOU

Types of Personal Data

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed or cannot be revealed and which is classified as anonymous data.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Identity Data includes first name, maiden name, last name, username or similar identifier, title, date of birth, gender, nationality and passport or identification card details.

Contact Data includes billing address, home and business address, email addresses and telephone numbers.

Financial Data includes bank account and payment card details.

Transaction Data includes details about payments to and from you and other details of booking reservations, services you have purchased from us.

Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.

Profile Data includes your username (identifier email address used to log-in) and password, booking reservations, purchases or orders made by you, your interests, preferences (such as for specific destinations, room types or other requests), feedback, survey responses, company information, The Oterra Exclusive & The Oterra Advantage membership or other loyalty program information.

Usage Data includes information about how you use our website and services.

Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences. We may also use and share information which does not directly or indirectly reveal your identity including statistical or demographic data(Aggregated Data) for any purpose. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice. We may in certain circumstances collect and process Special Categories of Personal Data about you including disability and health records relevant to your visit (such as food allergies, health condition requirements and hotel accessibility requirements) and religious information relevant to your visit (such as dietary requirements), in which case we shall only do so in accordance with applicable law (which may require that we obtain your consent). Failure to Provide Personal Data In certain circumstances, we need your personal data to perform our obligations to you in connection with the services you request from us (for example, to fulfill your booking reservation or to provide you with other services) or in order to comply with certain legal requirements. If you fail to provide information to us, we may not be able to provide you with the services you desire. We will of course notify you if this is the case.

Failure to Provide Personal Data In certain circumstances, we need your personal data to perform our obligations to you in connection with the services you request from us (for example, to fulfill your booking reservation or to provide you with other services) or in order to comply with certain legal requirements. If you fail to provide information to us, we may not be able to provide you with the services you desire. We will of course notify you if this is the case.

3. HOW YOUR PERSONAL DATA IS COLLECTED

Your personal data is made available to us through various methods, including:

Direct interactions. You may give us your Identity, Contact, Financial, Transaction, Profile and Marketing and Communications Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:

make a room reservation

directly provide it to us at one of The Oterra properties

create an account on our website

subscribe to our newsletter or other publications

request marketing communications be sent to you

enter a competition, promotion, or survey

give us feedback or contact us

Cookies and similar technologies. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please refer to our cookie policy for further details.

Third parties. We will receive personal data about you from various third parties as set out below:

Identity, Contact, Financial, Transaction and Profile Data from third parties such as travel agents or other booking partners booking comparison websites, airline or car rental partners or loyalty program partners

Identity, Contact, Financial, Transaction, Profile and Marketing and Communications Data received from our “Associated Hotels” (i.e., hotels or resorts owned by third-party entities which are not part of The Oterra group of affiliated entities but which operate under The Oterra brand).

Identity, Contact, Financial, Transaction and Profile Data from The Oterra Exclusive & The Oterra Advantage loyalty program

Technical Data from the following parties:

Analytics and search information providers such as Google & Bing

Advertising networks such as search engines and social channels

Identity, Contact, Financial and Transaction Data from providers of technical, payment, delivery services, data brokers or aggregators.

4. HOW WE USE YOUR PERSONAL DATA

Purposes for which we will use your Personal Data

We will only use your personal data for the purposes described below, unless we reasonably consider that we need to use it for another purpose and which is compatible with the original purpose. You can contact us for more information in connection with the purposes for which your personal data is processed at any time.

Purpose/Activity	Types of personal data used
To register you as a new guest/customer	(a) Identity (b) Contact (c) Profile
To process and fulfil your booking reservation including: Managing payments, fees, and charges Invoicing and collecting money owed to us	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Profile
To manage our relationship with you which will include: Communicating with you before, during and after your visit Sharing your information with the hotel or resort in which you are staying Providing guest and concierge services Ensuring your preferences and interests as a guest are recorded for future visits Responding to enquiries or complaints Notifying you about changes to our terms or privacy notice Asking you to leave a review or take a survey	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications (f) Profile
To enable you to partake in a promotion, prize draw, competition or complete a survey	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications
To administer and protect our business and this website(including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity (b) Contact (c) Technical
For website delivery, optimization and advertising online, including: Delivery of online advertising to you Measuring the effectiveness of the advertising we serve to you Using data analytics to improve our website, services, marketing, guest and customer relationships and experiences	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical
Email marketing (including to make suggestions and recommendations to you about services that may be of interest to you and to send you details of promotional offers)	(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Marketing and Communications

Additional Information about Marketing

You may receive marketing communications from us if you have so requested, or if you have made booking reservations or purchased other services from us and you have not opted out of receiving such marketing. If you are an EEA visitor, we will only send you marketing communications in compliance with applicable EU laws, which may require that we have received your express opt-in consent.

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

You can ask us or third parties to stop sending you marketing messages at any time by logging into the website and checking or unchecking relevant boxes to adjust your marketing preferences, by following the opt-out links on any marketing message sent to you, or by contacting us at any time at isghelpdesk@theoterra.com

Where you opt out of receiving these marketing messages, we may continue to communicate with you in connection with your booking reservations, enquiries, or other transactions as such communications are necessary in connection with our provision of services to you and are not marketing.

5. COOKIES

Our website uses cookies and similar technologies for a variety of purposes. For more information about the cookies we use, the information they collect and the purposes for which they are used, please read our Cookie Policy. You may choose to refuse all or some cookies, which may cause some parts of this website to become inaccessible or not function properly.

6. DISCLOSURES OF YOUR PERSONAL DATA

We may share your personal data with the parties set out below for the purposes described in section 4, above.

Members of The Oterra or Velankani group.

Service providers based in India and other parts of the world who provide website, IT and system administration services.

Professional advisers including lawyers, bankers, auditors and insurers based in India and other parts of the world who provide consultancy, banking, legal, insurance and accounting services.

Tax authorities, regulators and other authorities based in India and other parts of the world who require reporting of processing activities in certain circumstances.

Other third parties including booking partners, travel agents, marketing and PR companies, customer service companies, market researchers, data analytic companies, booking comparison websites, airline or car rental partners and loyalty program partners based in India and other parts of the world

Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

Third-Party Links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

7. DATA SECURITY

We have put in place appropriate technical and organizational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. DATA RETENTION

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances we will anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. ADDITIONAL INFORMATION FOR WEBSITE VISITORS FROM THE EUROPEAN ECONOMIC AREA (THE “EEA”)

The following information is relevant for visitors to the website located in the EEA. This section provides information about the lawful bases that we rely upon to process your personal data, your legal rights in relation to our processing of your personal data [and data transfers out of the EEA]. This information is intended to supplement the rest of this privacy notice.

Lawful Bases for Processing

We rely on the following lawful bases when we process your personal data:

Our legitimate interests – this means our legitimate interests in managing our business, website, hotels, resorts and Associated Hotels efficiently and effectively to enable us to give you the best service and the best and most secure experience (and for other legitimate interests described in the table below). We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data on this basis where our interests are overridden by the impact on you. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

For the performance of a contract with you – this means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

To comply with a legal obligation – this means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to (such as regulatory, tax, accounting or reporting requirements).?

We have set out below the lawful basis for processing we rely on to process your personal data for specific purposes/activities set out in section 4 above. We have also identified what our legitimate interests are where appropriate.

In some cases, more than one lawful basis is available to us (in which case we have provided the details of all such bases). If you would like to understand more about the legal basis that applies in connection with the processing of your personal data in a particular circumstance, please contact us at any time.

Purpose/Activity	Lawful basis for processing including basis of legitimate interest
To register you as a new guest/customer	Performance of a contract with you
To process and fulfil your booking reservation including: Managing payments, fees and charges Invoicing and collecting money owed to us	A. Performance of a contract with you B. Necessary for our legitimate interests (to recover debts due to us) Identity
To manage our relationship with you which will include: Communicating with you before, during and after your visit Sharing your information with the hotel or resort in which you are staying Providing guest and concierge services Ensuring your preferences and interests as a guest are recorded for future visits Responding to enquiries or complaints Notifying you about changes to our terms or privacy notice Asking you to leave a review or take a survey	A. Performance of a contract with you B. Necessary to comply with a legal obligation C. Necessary for our legitimate interests (to keep our records updated and to study how guests/customers use our services)
To enable you to partake in a promotion, prize draw, competition or complete a survey	A. Performance of a contract with you B. Necessary for our legitimate interests (to study how guests/customers use our services, to develop them and grow our business)
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	A. Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of abusiness reorganization or group restructuring exercise) B. Necessary to comply with a legal obligation
For website delivery, optimization, and advertising online, including: Delivery of online advertising to you Measuring the effectiveness of the advertising we serve to you Using data analytics to improve our website, services, marketing, guest and customer relationships and experiences	Necessary for our legitimate interests (to study how guests/customers use our services, to develop them, to grow our business and to inform our marketing strategy)
Email marketing (including to make suggestions and recommendations to you about services that may be of interest to you and to send you details of promotional	Necessary for our legitimate

In certain, limited circumstances we may rely on your consent to process your personal data. Where we rely on consent, we will provide you with information about our intended processing activities at the moment of consent collection. You may withdraw your consent to processing at any time, by contacting us. If you receive marketing communications from us, you can opt-out of receiving such communications at any time.

Your Legal Rights

You have the following rights under data protection laws in the EEA in relation to your personal data:

Access – the right to request confirmation of whether we process personal data relating to you and, if so, to request a copy of that personal data;

Correction – the right to request that we rectify or update your personal data that we hold about you which is inaccurate, incomplete or outdated, although we may need to verify the accuracy of the new data that you provide to us.

Deletion – the right to request that we delete or remove your personal data where it is no longer necessary that we retain it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Restriction of Processing – the right to request that we restrict the processing of your personal data (i) if you want us to establish the data’s accuracy; (ii) where our processing of the data is unlawful but you do not want us to erase it; (iii) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Withdraw consent – in the limited circumstances where our processing of your personal data is based on your consent, the right to withdraw your consent at any time, although withdrawal of consent (i) does not invalidate the consent-based processing that occurred prior to such withdrawal or processing that is not based on consent, and (ii) means that we will no longer be able to perform such consent-based processing activities, and may result in us being unable to provide certain services to you;

Portability – the right to request that we provide a copy of your personal data to you or to a third party you have chosen in a structured, commonly used and machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Object to Processing – the right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Lodge a Complaint – You have the right to make a complaint at any time to the relevant data protection supervisory authority in the EEA country where you are located. We would, however, appreciate the opportunity to address any concerns before you approach your relevant data protection supervisory authority, so please feel free to contact us in the first instance.

If you wish to exercise any of the rights set out above, please contact us as detailed in the Contact Details section above. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

International Transfers

When you provide us with your personal data through your use of the website, you transfer such personal data directly to us in India. We may transfer your personal data to other jurisdictions from time to time, including where we need to share your personal data with other entities that make up The Oterra and to our external third parties (in each case, to fulfil the purposes we have described in this privacy notice). In connection with such transfers, we take all reasonable steps to ensure appropriate security measures are in place to secure your personal data.

In the event that we transfer your personal data from a location within the EEA, we ensure that safeguards are implemented in compliance with EEA legal requirements, including that: We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries; or We may make such transfers subject to specific contractual requirements approved by the European Commission. For further details, see European Commission: Model contracts for the transfer of personal data to third countries; or Where we make a transfer to the US, we may be able to make the transfer under the EU-US Privacy Shield mechanism. For further details, see European Commission: EU-US Privacy Shield.

Please contact us if you want further information about transfers of your data, including the mechanisms used by us when transferring your personal data out of the EEA.