Privacy Policy
Last updated 30 April 2026
1. Who we are
This privacy policy applies to Gepton Hotel (the "hotel", "we", "us"), located at Sector 28, Gurugram, Haryana 122009, India. We are the data controller for information you share with us through this website, at the front desk, in correspondence, or during a stay.
2. What we collect
We collect only what we need to welcome, host and communicate with you:
- Identification: full name, date of birth (at check-in), government-issued ID as required by Indian law.
- Contact: email, phone, address.
- Reservation: dates of stay, preferences, special requests, card details held for guarantee only.
- Account: sign-in credentials (passwords are hashed, never stored in plain text), login history.
- Technical: IP address, browser type, pages visited — used for security and service improvement.
- Optional: dietary preferences, pillow choice, celebrations you are staying for.
3. How we use it
To fulfil your reservation, to communicate about your stay, to remember your preferences, to comply with tax and registration requirements, and — if you have opted in — to send you the occasional Gepton Letter. We do not sell your personal data. We do not share it with third parties for marketing.
4. Legal bases (GDPR) and DPDPA (India)
We rely on contract necessity to deliver your stay, legal obligation for ID and tax records, legitimate interests for security and service quality, and consent for marketing. Under India's Digital Personal Data Protection Act, 2023 (DPDPA) you have rights of access, correction, erasure, grievance redressal and nomination. Our Data Protection Officer is reachable at dpo@gepton.com.
5. How long we keep it
Reservation and financial records: seven years (tax rules). Account data: for as long as your account is active, plus one year. Marketing data: until you unsubscribe. CCTV in public areas: 30 days.
6. Where your data is stored
On servers physically located in India, operated by Hostinger International. We use industry-standard TLS encryption in transit, hashed passwords (Argon2id) at rest, and role-based access internally.
7. Your rights
You may, at any time: access the personal data we hold about you; correct it; ask us to delete it; object to processing; withdraw consent for marketing; lodge a complaint with the Indian Data Protection Board or your local EU Supervisory Authority.
8. Children
Accounts on this website are intended for adults of 18 years or older. Children staying with their guardians are of course welcome at the hotel.
9. Changes to this policy
We will post any updates to this page and mark them with a new date. Material changes will also be communicated by email to account holders.
10. Contact
Questions, requests or complaints: dpo@gepton.com · +91 124 555 1000 · Gepton Hotel, Sector 28, Gurugram.