Privacy Policy

This Privacy Policy explains how The Rustic (“we”, “us”) handles personal data when you visit https://therustic.in, enquire, book, stay at The Rustic Jibhi or The Rustic Shoja, use our cafés, or apply to volunteer. We are the Data Fiduciary for this data under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and also follow the Information Technology Act, 2000 and the rules made under it.

1. Who we are

RUSTIC COMFORTS LLP (trading as The Rustic) runs The Rustic Jibhi (Khasra no. 1022/821/695/94, Khata Khatoni No. 282/306, Jibhi, Himachal Pradesh 175123) and The Rustic Shoja (Shoja, toward Jalori Pass, Himachal Pradesh 175123), India. Contact: reservation@therustic.in · +91 95107 33999.

2. What we collect and why

• Enquiries (WhatsApp, phone, email, or the contact form): your name, contact details and message — used only to reply to you.
• Bookings: name, phone, email, dates, property, room type, number of guests and any requests you share — used to confirm and manage your stay.
• Check-in: government photo ID details for every guest, and for foreign nationals passport and visa details — collected because Indian law requires lodging providers to register guests (including Form C reporting for foreign nationals).
• Payments: amount, UPI or payment-link reference and invoice details — used for accounting and tax compliance. We never ask for card numbers, CVV, UPI PINs or passwords.
• Stay records: dietary or medical notes you choose to share, incident and damage reports, feedback — used to look after you and handle safety, complaints and claims.
• CCTV: we record video (no audio) in the lobby, common areas and café at both properties, for the safety of guests, visitors and staff and to prevent theft and damage. There are no cameras in bedrooms, dorms or bathrooms. Signs mark the recorded areas.
• Volunteer and artist applications: dates, skills, portfolio or social links you send — used only to assess and arrange your application.
• Website: our hosting provider automatically processes technical data (IP address, browser type, pages requested, time) to deliver the site and protect it from abuse. We do not use analytics, advertising trackers or cookies on this website — see the Cookie Policy.

We only collect what we need for these purposes. Please don’t send ID documents, bank details or other sensitive information unless we ask for it at check-in.

3. Legal basis

We process personal data either with your consent (for example, when you tick the consent box on our contact form) or for a “legitimate use” permitted by Section 7 of the DPDP Act — such as when you voluntarily give us information for a specific purpose like a booking, when the law requires it (guest registration, tax records), or in a medical emergency. We do not use your data for marketing unless you have separately agreed to it, and you can stop marketing messages at any time.

4. Who we share it with

We do not sell or rent personal data, and we do not share it for advertising. We share only what is needed with:

• Service providers that help us operate: WhatsApp (Meta) and our email provider for communications, UPI apps, banks and payment-link providers for payments, and our website host (Vercel) for the website.
• Online travel agencies (e.g. Booking.com, MakeMyTrip), if you booked through them — they handle your data under their own privacy policies.
• Government and law-enforcement authorities where Indian law requires it (for example guest registration, Form C, tax, a lawful order, or CCTV footage requested by police to investigate an incident).
• Our accountant or legal advisers, where needed, under a duty of confidentiality.

5. Transfers outside India

Some of our service providers (for example WhatsApp and our website host) may store or process data on servers outside India. Such transfers are permitted under the DPDP Act except to countries the Government of India restricts, and we will follow any such restriction.

6. How long we keep it

• Enquiries that do not lead to a booking: deleted within 12 months of our last conversation.
• Booking, guest-registration, invoice and payment records: kept for as long as Indian tax, accounting and lodging laws require, then deleted.
• Incident, damage or dispute records: kept until the matter and any related legal claim is resolved.
• CCTV footage: overwritten automatically on a rolling basis, unless we need to keep a clip to investigate an incident or a legal claim.
• Website technical logs: kept by our host for a short operational period.

7. Security and breaches

We use reasonable safeguards, such as limiting access to guest records to staff who need it. No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

8. Your rights

• Access: ask for a summary of the personal data we hold about you and who we have shared it with.
• Correction and erasure: ask us to correct, complete, update or delete your data. We may keep records the law requires us to keep.
• Withdraw consent: where we rely on consent, you can withdraw it at any time, as easily as you gave it. This does not affect processing already done.
• Grievance redressal: complain to us, and if you are not satisfied, to the Data Protection Board of India.
• Nomination: nominate someone to exercise these rights on your behalf in the event of your death or incapacity.

To use any of these rights, email reservation@therustic.in with “Privacy request” in the subject. We may need to confirm your identity. We aim to respond within 30 days.

9. Grievance Officer

Grievance Officer · Email: reservation@therustic.in · Phone: +91 95107 33999 · Address: The Rustic Jibhi (Khasra no. 1022/821/695/94, Jibhi) · The Rustic Shoja (Shoja, Jalori Pass Rd), Himachal Pradesh 175123.

10. Children

Our website and contact form are for adults (18+). We do not knowingly collect personal data from children through the website. Guests under 18 may stay only with a parent or legal guardian, who provides any details needed and consents on their behalf. If you think a child has sent us personal data, contact us and we will delete it.

11. Cookies

This website does not set cookies or use tracking technologies. See the Cookie Policy for details.

12. Changes to this policy

If we change this policy we will update the “Last updated” date on this page. If a change significantly affects how we use data you have already given us, we will tell you and, where required, ask for your consent again.