Privacy Policy

How we collect, use and protect your data

Last updated: 07 July 2026 · Governed by the laws of India

1. Who we are

This Privacy Policy is published by Xeneva Hospitality Private Limited ("Xeneva", "we", "our", or "us"), a company incorporated in India having its registered office at Top Floor Office No 502, 1/56-D, Lalita Park, Laxmi Nagar, East Delhi, Delhi — 110092. GSTIN: 07AAACX5779N1ZI. This Policy applies to the website xenevaservices.com and all related services.

This Policy is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, the Consumer Protection (E-Commerce) Rules 2020, and the Digital Personal Data Protection Act 2023 (DPDP Act).

2. Information we collect

Information you provide

  • Account & contact information: name, email address, phone number, billing/service address.
  • Booking information: the services you select, quantities, preferred dates and any special requests.
  • Payment information: processed by our PCI-DSS compliant payment partner (MMADPay). Xeneva does not store full card or banking details on its servers.
  • Communications: messages, queries, feedback and any other content you share with us.

Information collected automatically

  • Device and browser information, IP address, approximate location, pages visited and referral URLs.
  • Cookies and similar technologies (see Section 8 below).
  • Anonymised usage analytics through Google Analytics 4.

3. How we use your information

  • To process and confirm your bookings and payments.
  • To send booking confirmations, status updates, refund/cancellation communications and service-related emails.
  • To provide customer support and resolve grievances.
  • To comply with legal, tax and regulatory obligations (including GST invoicing).
  • To improve our platform, services and user experience.
  • To prevent fraud, abuse and unauthorised access.
  • To send marketing communications — only with your explicit consent and with an opt-out option in every message.

4. Legal basis for processing

We process your personal data based on one or more of the following: (a) your consent, freely given and specific; (b) the necessity of performing the contract (your booking); (c) our legitimate interests (fraud prevention, platform improvement) where they are not overridden by your rights; and (d) compliance with a legal obligation.

5. Sharing your information

We do not sell your personal data. We share it only with:

  • Assigned consultants (the expert delivering your booked session) where it is required to prepare for and fulfil your consultation.
  • Payment processors (MMADPay) for processing transactions.
  • Service providers (email, hosting, analytics) under appropriate confidentiality terms.
  • Government, regulatory or judicial authorities when required by law or by valid legal process.

6. Data retention

We retain personal data only for as long as necessary for the purposes set out in this Policy, or as required by law (typically a minimum of 8 years for financial and tax records). After this period, your personal data is anonymised or securely deleted.

7. Security of your data

We use industry-standard technical and organisational measures to protect your personal data — including HTTPS/TLS encryption in transit, encryption at rest for sensitive fields, access controls, logging, regular security reviews, and PCI-DSS-compliant payment infrastructure. No method of transmission over the internet is 100% secure, but we work continuously to minimise risk.

8. Cookies and tracking

We use cookies to keep your booking session active, remember preferences, secure your account, and analyse traffic. You can disable cookies in your browser settings, but parts of the website may not function correctly. We use Google Analytics 4 (GA4) for anonymised usage analytics; you may opt out via your browser settings or the GA4 opt-out tool.

9. Your rights under the DPDP Act

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you.
  • Correct or update inaccurate or incomplete data.
  • Withdraw consent for processing based on consent.
  • Erase your personal data, subject to legal retention requirements.
  • Nominate another individual to exercise your rights in case of incapacity or death.
  • Lodge a grievance with our Grievance Officer.

To exercise these rights, please contact care@xenevaservices.com.

10. Children's privacy

Our services are not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently done so, please contact us so we can take corrective action.

11. International data transfers

Your data is primarily stored and processed in India. Some service providers (email, analytics, cloud hosting) may process limited data outside India under appropriate safeguards.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the website or by email where required. The "Last updated" date at the top reflects the most recent version.

13. Grievance Officer (per IT Rules 2021)

Name: Krishna
Email: grievance@xenevaservices.com
Phone: +91 87962 91844
Address: Top Floor Office No 502, 1/56-D, Lalita Park, Laxmi Nagar, East Delhi, Delhi — 110092

The Grievance Officer will acknowledge your complaint within 24 hours and resolve it within 15 days as per the IT Rules 2021.

14. Governing law & jurisdiction

This Privacy Policy and any disputes related to it are governed by the laws of India. Courts in Delhi shall have exclusive jurisdiction.