PRIVACY POLICY

Last Updated: 01/12/2025

This Privacy Policy (“Policy”) describes how Exotic Goa (“we”, “our”, “us”) collects, uses, discloses, and protects personal information obtained through our publicly accessible website on the main domain and through our internal employee management system hosted on a secure subdomain.

By accessing our website or using our internal system, you agree to the terms of this Policy.

1. Scope

This Policy applies to the following:

1.1 Public Website (Main Domain)

• View information about our services
• Access our contact details
• Submit inquiries through a contact form containing: Name, Phone Number, Email, and Message

1.2 Internal Management System (Subdomain)

A restricted-access system used solely by authorized employees for internal operations, including:

• Attendance and leave management
• Sales tracking and entry of sales-related inquiries
• Bulk communication to guests/clients
• General HR-supportive functions (excluding payroll or any financial data handling)

Access requires secure credentials and Two-Factor Authentication (2FA).

2. Information We Collect

2.1 Information from Website Visitors

When you voluntarily contact us via the website, we may collect:

• Full Name
• Phone Number
• Email Address
• Message or Inquiry Details

We do not collect any other personal information unless provided voluntarily.

2.2 Information from Employees (Internal System)

For access control and internal operations, we may collect:

• Employee Name
• Email Address
• Phone Number (for authentication)
• Login timestamps, access logs, and activity logs
• Attendance records
• Leave requests and related data
• Sales inquiries entered by employees (customer names, phone numbers, emails, enquiry details)
• Communication metadata related to bulk messaging (no financial data)

No payroll, salary, bank details, or financial information is stored.

2.3 Information Related to Clients/Guests

Employees may store or process limited information for communication or sales purposes:

• Name
• Email Address
• Phone Number
• Inquiry data (e.g., interest, requirement description)

This information is used strictly for operational or communication purposes.

3. Purpose of Processing

We use personal information only for legitimate business purposes, including:

3.1 Website Visitors

• Responding to inquiries
• Providing requested information
• Improving communication and website experience

3.2 Employees

• Providing secure access to internal systems
• Managing attendance and leave requests
• Recording and tracking sales inquiries
• Enabling communication with clients/guests
• Maintaining internal operational logs

3.3 Clients/Guests

• Responding to service inquiries
• Providing updates, reminders, or service-related communication
• Maintaining communication records for service continuity

We do not use personal data for unauthorized marketing.

4. Legal Basis (Where Applicable)

Depending on jurisdiction, processing is based on:

• Consent (website contact form submissions)
• Legitimate interest (internal operations, security, communication)
• Contractual necessity (service-related communication)
• Compliance with law (if required)

5. Data Sharing and Disclosure

We do not sell or rent personal information.

We may share data only with:

• Trusted service providers required for hosting, email, or authentication
• Authorities where required by law, subpoena, or governmental request
• Internal personnel strictly on a need-to-know basis
• Security or audit teams for compliance and monitoring

No third parties receive data for advertising or marketing.

6. Data Security

We implement reasonable and industry-standard measures, including:

• HTTPS encryption
• Secure server infrastructure
• 2FA for employee system access
• Access controls and permission-based data visibility
• Regular monitoring and logging of system access
• Periodic security reviews

Despite these safeguards, no system is entirely risk-free.

7. Data Retention

We retain information only for as long as necessary:

• Website inquiries: until resolved or no longer required
• Employee HR and attendance data: duration of employment and administrative requirements
• Sales and communication records: operational necessity
• System logs: per compliance and security best practices

Deletion requests may be submitted subject to legal allowances.

8. Your Rights

You may request:

• Access to your personal data
• Correction or update
• Deletion (where applicable)
• Withdrawal of consent
• Restriction of processing

Contact us at seby@exoticgoa.in for such requests.

9. External Links

Our website may include links to external pages. We are not responsible for their content or privacy practices.

10. Children’s Privacy

Our website is not intended for use by individuals under 13. We do not knowingly collect information from children.

11. Updates to This Policy

We may update this Policy periodically. The latest version will always be available on our website.

12. Contact Information

For any privacy-related concerns, contact us at:

Seby Naronha, Exotic Goa
Email: seby@exoticgoa.in
Phone: +91 98229 71391
Website: exoticgoa.in
Address: F4, 1st Floor, Osia Mall Building, Near KTC Bus Stand, Margao, Goa - 403601