Privacy Policy

SYFTE Market Services Private Limited operates venuebook.in ("venuebook.in", "we", "us" or "our"). We provide an online marketplace for venues, farmstays and other bookable categories, together with related customer-support, payment-facilitation and Partner software services.

For personal data that venuebook.in determines the purpose and means of processing, venuebook.in acts as the relevant data fiduciary or otherwise responsible entity under applicable law. A Partner may separately act as an independent data fiduciary or otherwise responsible entity for personal data it collects or uses for its own property operations, legal obligations and service delivery.

This Policy applies to visitors, registered Customers, persons making or receiving bookings, Partners, Partner employees/team users, prospective Partners, and persons who contact us through the Platform or support channels.

It applies to our website, mobile applications, customer-support channels, Partner dashboards and related online services. It does not govern an independent Partner's separate website, property CCTV system, guest register or other activity that the Partner controls outside venuebook.in.

As of the date of this Policy, the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") have phased commencement dates. Some institutional and procedural provisions are already in force, while many core processing, notice, consent, rights and security obligations are scheduled to commence later.

Until and after those provisions become applicable, we process personal information in accordance with the laws then in force, including the Information Technology Act, 2000 and applicable rules thereunder, and we will update our practices as the DPDP framework becomes fully operational.

Where we voluntarily offer a privacy control before a statutory right becomes enforceable, that voluntary control does not reduce any right that later becomes available under law.

• "Personal Data" means data about an individual who is identifiable by or in relation to such data, or the equivalent concept under applicable law.
• "Customer" means a person who searches for, requests or makes a booking.
• "Partner" means a venue owner, farmstay owner, operator, authorized manager or other supplier using the Platform.
• "Processing" includes collection, recording, organization, storage, use, sharing, retrieval, analysis, deletion or other handling of personal data.

Depending on how you use the Platform, we may collect your name, mobile number, email address, account details, billing information, GST details for invoicing, booking requirements, guest count, event or stay dates, special requests, uploaded content and communications with support.

If a booking or applicable law genuinely requires identity verification, we may request limited identity information. We do not encourage Customers to upload Aadhaar or other government-ID copies unless specifically requested for a lawful and necessary purpose, and we may offer alternative identification methods where appropriate.

For Partner onboarding and use of our SaaS tools, we may collect business name, authorized contact details, property details, GST registration information, PAN or other tax/KYC information, bank or settlement details, subscription records, listing content, reservation data, team-user names and contact information, and records relating to Partner support or compliance.

We collect and use Partner financial and KYC information only to the extent reasonably required for onboarding, payments, settlements, invoicing, tax, security, fraud prevention, contractual administration or legal compliance.

When you use the Platform, our systems and service providers may automatically receive technical information such as IP address, browser or app type, operating system, device category, app version, language, time zone, session identifiers, referring pages, crash information, security logs and usage events.

We do not claim to collect hardware identifiers such as IMEI or MAC addresses unless a particular app, operating system or authorized SDK actually provides such information and we have a lawful purpose to use it.

We may infer an approximate location from information such as IP address for localization, fraud prevention or search relevance.

If a feature requests precise device location, we will rely on the device permission or other appropriate choice mechanism. You can normally disable precise location through your device settings, although some nearby-search features may then be less accurate.

We may use cookies, local storage, pixels, SDKs and similar technologies for authentication, security, preferences, analytics, performance measurement and, where enabled, advertising or marketing.

Non-essential cookies and similar technologies will be managed in accordance with applicable law and the choices made available through our cookie banner, settings or browser/device controls. Disabling certain cookies may affect Platform functionality.

Payments may be processed by third-party payment gateways, banks and payment networks. venuebook.in may receive transaction identifiers, payment method type, amount, payment status, settlement/refund status and limited billing/contact details needed to reconcile the transaction.

venuebook.in does not intentionally store complete card numbers, card CVVs or UPI PINs. Payment providers handle payment credentials under their own regulatory, security and retention obligations.

We may process limited information needed to verify an account, investigate suspicious transactions, prevent chargeback abuse, protect users, resolve a refund or comply with lawful requests.

We aim to use the minimum information reasonably necessary for the relevant purpose and to avoid collecting identity documents merely because a transaction is high value.

We process booking history, Property selected, dates and times, guest counts, packages, add-ons, reservation status, cancellation/rescheduling history, support requests, refund status, invoices/receipts, coupons and loyalty-point activity.

Where necessary to fulfil a booking, we may also process special requests supplied by you. Please avoid placing medical, financial or other highly sensitive personal information in free-text fields unless it is necessary for the service and you are comfortable sharing it with the relevant Partner.

If you contact us by email, phone, chat, WhatsApp or another support channel, we may retain the content of the communication, relevant metadata and follow-up actions.

If calls are recorded, we will provide notice where required. Records may be used for service delivery, quality review, training, safety, dispute handling and legal compliance.

Reviews, ratings, photographs and other content that you choose to post publicly may be visible to other users and may be associated with the profile information displayed by the Platform.

Do not post personal data of other people without authorization. We may moderate or remove content in accordance with our Terms and applicable law.

We obtain data directly from you, from Partners when they create or update bookings, from payment and communication providers, from security/fraud tools, from your device/browser, and from other sources you authorize.

If a Partner creates an offline booking in venuebook.in, the Partner may provide the Customer's booking and contact information to us so that the booking can be recorded and made visible in the Customer account.

We use personal data to create and secure accounts; provide search and booking functionality; connect Customers and Partners; process and reconcile payments/refunds; issue or support invoices; manage subscriptions and settlements; deliver notifications; provide support; prevent fraud and misuse; maintain security; resolve disputes; comply with legal obligations; improve the Platform; perform analytics; personalize relevant content; and, where permitted, send marketing communications.

We may create aggregated or anonymized statistics that are not reasonably capable of identifying an individual and use those statistics for business analysis, planning and service improvement.

Where consent is required by applicable law, we will seek consent through an appropriate notice and affirmative action and will provide a mechanism to withdraw it. When the relevant DPDP provisions apply, consent will be handled in accordance with the standards set by the DPDP Act and Rules.

Applicable law may also permit processing without consent in specified circumstances. Under the DPDP framework, these are described as "certain legitimate uses" rather than a general business-interest test. We will rely on such a ground only where the facts and law support it.

The Privacy Policy itself is a transparency document; it is not intended to convert every type of processing into consent merely because a person visits the Platform.

We may use information such as search criteria, location, booking history, listing attributes, availability and Platform interactions to personalize recommendations or order search results.

We may also use aggregate performance or quality signals to improve rankings. Sponsored or promoted placements will be identified where required by applicable law. We do not use solely automated decisions to deny a statutory consumer or privacy right without an appropriate review process where law requires one.

When you interact with or book a Property, we share the information reasonably necessary for the Partner to respond, confirm and fulfil the booking, such as your name, contact details, dates, guest count, event/stay details and relevant requests.

Partners must use Platform-provided customer data for legitimate booking, service, safety, accounting, legal or dispute purposes and not for unauthorized scraping or unrelated marketing.

A Partner may separately collect information directly from you at the Property. For that separate collection and the Partner's independent legal obligations, the Partner is responsible for its own privacy practices.

We may engage service providers for cloud hosting, communications, payment processing, customer support, analytics, security, fraud prevention, document storage, accounting, tax, software development and other operational functions.

We provide these providers only the information reasonably required for their role and use contractual, technical or organizational controls appropriate to the nature of the processing.

Payment gateways, acquiring banks, issuing banks, UPI participants and payment networks may process personal and transaction data under their own legal and regulatory obligations. Their processing is also governed by their own privacy notices and terms.

We may exchange payment status, transaction references and refund information with them to complete or reconcile a transaction or investigate a payment issue.

We may disclose information where reasonably necessary to comply with a binding legal process, court order, statutory requirement, tax or regulatory obligation, or a lawful request from an authorized public authority.

We may also disclose limited information where permitted by law to protect users, prevent fraud, investigate security incidents, establish or defend legal claims, or protect rights and safety.

If the Company undergoes a merger, acquisition, financing, restructuring, sale of business or assets, or similar transaction, relevant personal data may be transferred as part of that transaction subject to confidentiality, applicable notice requirements and the legal rights of affected individuals.

Some service providers may process or store data outside India. We do not promise that all personal data is stored only in India unless a specific service expressly states this.

Cross-border processing will be handled subject to restrictions and conditions that are applicable under Indian law at the relevant time, together with reasonable contractual and security safeguards.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, for an active relationship or booking, for security and dispute purposes, or for a period required by tax, corporate, accounting, consumer, payment or other applicable law.

Certain books, invoices and accounting records may need to be retained for several years under Indian corporate and tax laws. We do not apply a blanket ten-year retention period to all payment or customer data merely because a payment was made.

Security and fraud-prevention records are retained on a restricted basis for a proportionate period based on the risk, evidence needs and applicable limitation or legal requirements. When data is no longer required, we may delete, anonymize or de-identify it, subject to backup cycles and legal holds.

We use reasonable technical and organizational safeguards appropriate to the nature of the data and risks. Depending on the system, these may include encryption in transit, access controls, logging, secure cloud configurations, authentication controls, backups, monitoring, vulnerability management and restricted administrative access.

No internet service can guarantee absolute security. You are responsible for protecting your devices, OTPs, passwords and account access and should notify us if you suspect compromise.

You may update many account details through the Platform and may contact us to request access, correction, account closure, deletion/erasure of eligible data, withdrawal of marketing consent, or information about how your data is handled.

We may need to verify the requester and may retain information where deletion would conflict with an active booking, a legal obligation, fraud-prevention need, accounting requirement, dispute, legal hold or another lawful basis.

As additional DPDP rights and procedures come into force, we will provide the mechanisms required by law, including applicable rights of access to information, correction, erasure, grievance redressal and nomination.

Where processing is based on consent, you may withdraw that consent through the method we provide. Withdrawal will not invalidate processing that was lawful before withdrawal.

If the withdrawn consent is necessary to provide a requested feature, we may be unable to continue that feature. We will explain material consequences where required.

Transactional messages concerning account security, bookings, payments, cancellations, refunds or essential service information may be sent because they are necessary for the service.

Promotional email, SMS, WhatsApp or push communications will be managed in accordance with your preferences, consent and applicable communications law. You may opt out of promotional messages using the unsubscribe or preference controls provided.

Accounts and bookings are intended to be created by persons aged 18 or above. We do not knowingly allow a child to independently create a booking account.

A booking may nevertheless relate to children as guests. We ask Customers and Partners not to provide children's personal data beyond what is genuinely necessary for the booking or required by law. When the relevant DPDP child-data provisions become applicable, we will implement the required age/consent safeguards.

Partner dashboard access is role-based. A Partner should only access customer data associated with its own inquiries/bookings or other authorized operational functions.

Partners may not use venuebook.in tools to harvest customer information from unrelated listings or to build marketing lists without an independent lawful basis and appropriate consent.

Where venuebook.in processes Partner-held data only on documented instructions, contractual data-processing requirements may apply. Where venuebook.in determines its own purposes, it remains responsible for those purposes.

We maintain processes for identifying, containing, investigating and remediating security incidents. If an incident triggers a notification obligation, we will notify CERT-In, the Data Protection Board, affected individuals or other authorities as required by the law that is in force at that time.

We do not promise to notify every user of every technical event; notification will depend on the legal threshold, nature and impact of the incident and any directions from competent authorities.

The Platform may link to third-party websites, social media, maps, payment pages or other independent services. We do not control their privacy practices and encourage you to review the notices presented by those services.

We may update this Policy to reflect changes in law, technology, business operations or Platform features. The updated version will show a revised date.

Where a change materially affects how we use personal data or where law requires notice or fresh consent, we will provide an appropriate notice and, where required, obtain a new consent.