Privacy Policy

Welcome to the website privacy notice of Hotel Sonia. Hotel Sonia respects your privacy and is committed to protecting your personal data. This privacy notice sets out information about how we treat your personal data, including when you visit our website (www.hotelsonia.co.in).

Table of Contents

1.Important information and who we are

2.The data we collect about you

3.How your personal data is collected

4.How we use your personal data

5.Cookies

6.Disclosures of your personal data

7.Data security

8.Data retention

9.Additional Information For Website Visitors from the European Economic Area (the “EEA”)

Purpose of This Privacy Notice

This privacy notice aims to give you information about how Hotel Sonia collects and processes your personal data, including any data you may provide through this website when you make a booking reservation, purchase another service, subscribe to our newsletter or consent to receive marketing communications.

This privacy notice should be read together with any other data privacy notice or fair processing notices we may provide to you from time to time in connection with our processing of your personal data for specified purposes.

About Us

This privacy notice is issued on behalf of Brookfield and its group of affiliated entities and references to Hotel Sonia, “we”, “us” or “our” in this privacy notice, are referring to the relevant entity within Hotel Sonia responsible for processing your personal data. We will let you know which entity is the data controller of your personal data (or recipient of personal data as otherwise identified) when you make a reservation or purchase another service with us. Unless you are otherwise notified, Hotel Sonia is the data controller and responsible for the processing of your personal data in connection with this website.

Contacting Us

If you have any questions regarding this privacy notice or if you would like to exercise any of your rights in relation to your personal data, you can do so by contacting our data protection office (“DPO”) at any time by email to: anand@hotelsonia.co.in 

Additional contact information:

Full name of legal entity: Hotel Sonia

Postal address: Hotel Sonia, Delhi-Nainital Highway, Rudrapur, Uttarakhand, 263153

Telephone number: +91 9837038888

Changes to the Privacy Notice and your duty to inform us of the Changes

We keep our privacy notice under regular review. This version was last updated on May 30, 2023.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us

Types of Personal Data

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed or cannot be revealed and which is classified as anonymous data.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identifier, title, date of birth, gender, nationality and passport or identification card details.
• Contact Dataincludes billing address, home and business address, email addresses and telephone numbers.
• Financial Dataincludes bank account and payment card details
• Transaction Data includes details about payments to and from you and other details of booking reservations, services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile Data  includes your username (identifier email address used to log-in) and password, booking reservations, purchases or orders made by you, your interests, preferences (such as for specific destinations, room types or other requests), feedback, survey responses, company information, The Sonia DISCOVERY membership or other loyalty program information.
• Usage Data includes information about how you use our website and services.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences. We may also use and share information which does not directly or indirectly reveal your identity including statistical or demographic data (Aggregated Data) for any purpose. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

We may in certain circumstances collect and process Special Categories of Personal Data about you including disability and health records relevant to your visit (such as food allergies, health condition requirements and hotel accessibility requirements) and religious information relevant to your visit (such as dietary requirements), in which case we shall only do so in accordance with applicable law (which may require that we obtain your consent).

Failure to Provide Personal Data

In certain circumstances, we need your personal data to perform our obligations to you in connection with the services you request from us (for example, to fulfill your booking reservation or to provide you with other services) or in order to comply with certain legal requirements. If you fail to provide information to us, we may not be able to provide you with the services you desire. We will of course notify you if this is the case.

Your personal data is made available to us through various methods, including:

• Direct interactions. You may give us your Identity, Contact, Financial, Transaction, Profile and Marketing and Communications Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
• Make a booking reservation;
• Directly provide it to us at one of Hotel Sonia properties;
• Create an account on our website;
• Subscribe to our newsletter or other publications;
• Request marketing communications be sent to you;
• Enter a competition, promotion or survey; or
• Give us feedback or contact us.
• Cookies and similar technologies. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please refer to our cookie policy for further details.
• Third parties. We will receive personal data about you from various third parties as set out below:
• Identity, Contact, Financial, Transaction and Profile Data from third parties such as travel agents or other booking partners booking comparison websites, airline or car rental partners or loyalty program partners;
• Identity, Contact, Financial, Transaction, Profile and Marketing and Communications Data received from our “Associated Hotels” (i.e., hotels or resorts owned by third-party entities which are not part of Hotel Sonia but which operate under the Hotel Sonia name.
• Identity, Contact, Financial, Transaction and Profile Data from Hotel Sonia DISCOVERY loyalty program;
• Technical Data from the following parties:

(a)  Analytics and search information providers such as Google & Bing  and

(b)  Advertising networks such as search engines and social channels

• Contact, Financial and Transaction Data from providers of technical, payment and delivery services such as
• Identity and Contact Data from data brokers or aggregators.

Our website does not offer products or services for use by minors. If you are under 18 years of age, you may use our website only with the involvement of a parent or guardian. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us at anand@hotelsonia.co.in for any concern related to the child’s personal data. 

Purposes for which we will use your Personal Data

We will only use your personal data for the purposes described below, unless we reasonably consider that we need to use it for another purpose and which is compatible with the original purpose. You can contact us for more information in connection with the purposes for which your personal data is processed at any time.

Purpose/ActivityTypes of personal data usedTo register you as a new guest/customer(a) Identity (b) Contact (c) ProfileTo process and fulfil your booking reservation including:

• Managing payments, fees and charges
• Invoicing and collecting money owed to us

(a) Identity (b) Contact (c) Financial (d) Transaction (e) ProfileTo manage our relationship with you which will include:

• Communicating with you before, during and after your visit
• Sharing your information with the hotel or resort in which you are staying
• Providing guest and concierge services
• Ensuring your preferences and interests as a guest are recorded for future visits
• Responding to enquiries or complaints
• Notifying you about changes to our terms or privacy notice
• Asking you to leave a review or take a survey

(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications (f) ProfileTo enable you to partake in a promotion, prize draw, competition or complete a survey(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and CommunicationsTo administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)(a) Identity (b) Contact (c) TechnicalFor website delivery, optimisation and advertising online, including: 

• Delivery of online advertising to you
• Measuring the effectiveness of the advertising we serve to you
• Using data analytics to improve our website, services, marketing, guest and customer relationships and experiences

(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) TechnicalEmail marketing (including to make suggestions and recommendations to you about services that may be of interest to you and to send you details of promotional offers)(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Marketing and Communications

Additional Information about Marketing

• You may receive marketing communications from us if you have so requested, or if you have made booking reservations or purchased other services from us and you have not opted out of receiving such marketing. If you are an EEA visitor, we will only send you marketing communications in compliance with applicable EU laws, which may require that we have received your express opt-in consent.
• We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.
• You can ask us or third parties to stop sending you marketing messages at any time by logging into the website and checking or unchecking relevant boxes to adjust your marketing preferences, by following the opt-out links on any marketing message sent to you, or by contacting us at any time. Where you opt out of receiving these marketing messages, we may continue to communicate with you in connection with your booking reservations, enquiries, or other transactions as such communications are necessary in connection with our provision of services to you and are not marketing.

Our website uses cookies and similar technologies for a variety of purposes. You may choose to refuse all or some cookies, which may cause some parts of this website to become inaccessible or not function properly.

We may share your personal data with the parties set out below for the purposes described in section 4, above.

• Members of Hotel Sonia.
• Service providers based in India, USA, European Union and parts of Asia who provide website, IT and system administration services.
• Professional advisers including lawyers, bankers, auditors and insurers based in India, USA, European Union and parts of Asia who provide consultancy, banking, legal, insurance and accounting services.
• Tax authorities, regulators and other authorities based in India, USA, European Union and parts of Asia who require reporting of processing activities in certain circumstances.
• Other third parties including booking partners, travel agents, marketing and PR companies, customer service companies, market researchers, data analytic companies, booking comparison websites, airline or car rental partners and loyalty program partners based in India, USA, European Union and parts of Asia
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

Third-Party Links

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

 We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

The following information is relevant for visitors to the website located in the EEA. This section provides information about the lawful bases that we rely upon to process your personal data, your legal rights in relation to our processing of your personal data [and data transfers out of the EEA]. This information is intended to supplement the rest of this privacy notice.

Lawful Bases for Processing

We rely on the following lawful bases when we process your personal data:

• Our legitimate interests – this means our legitimate interests in managing our business, website, hotels, resorts and Associated Hotels efficiently and effectively to enable us to give you the best service and the best and most secure experience (and for other legitimate interests described in the table below). We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data on this basis where our interests are overridden by the impact on you. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
• For the performance of a contract with you – this means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
• To comply with a legal obligation – this means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to (such as regulatory, tax, accounting or reporting requirements).

We have set out below the lawful basis for processing we rely on to process your personal data for specific purposes/activities set out in section 4 above. We have also identified what our legitimate interests are where appropriate.

In some cases, more than one lawful basis is available to us (in which case we have provided the details of all such bases). If you would like to understand more about the legal basis that applies in connection with the processing of your personal data in a particular circumstance, please contact us at any time.

Email marketing (including to make suggestions and recommendations to you about services that may be of interest to you and to send you details of promotional offers)Necessary for our legitimate interests (to develop our services and grow our business)

Purpose/ActivityLawful basis for processing including basis of legitimate interestTo register you as a new guest/customerPerformance of a contract with youTo process and fulfil your booking reservation including:(a) Performance of a contract with you· Managing payments, fees and charges(b) Necessary for our legitimate interests (to recover debts due to us)· Invoicing and collecting money owed to us To manage our relationship with you which will include:(a) Performance of a contract with you· Communicating with you before, during and after your visit(b) Necessary to comply with a legal obligation· Sharing your information with the hotel or resort in which you are staying(c) Necessary for our legitimate interests (to keep our records updated and to study how guests/customers use our services)· Providing guest and concierge services · Ensuring your preferences and interests as a guest are recorded for future visits · Responding to enquiries or complaints · Notifying you about changes to our terms or privacy notice · Asking you to leave a review or take a survey To enable you to partake in a promotion, prize draw, competition or complete a survey(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to study how guests/customers use our services, to develop them and grow our business)To administer and protect our business and this website(including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
(b) Necessary to comply with a legal obligationFor website delivery, optimisation and advertising online, including: Necessary for our legitimate interests (to study how guests/customers use our services, to develop them, to grow our business and to inform our marketing strategy)· Delivery of online advertising to you · Measuring the effectiveness of the advertising we serve to you · Using data analytics to improve our website, services, marketing, guest and customer relationships and experiences 

In certain, limited circumstances we may rely on your consent to process your personal data. Where we rely on consent, we will provide you with information about our intended processing activities at the moment of consent collection. You may withdraw your consent to processing at any time, by contacting us. If you receive marketing communications from us, you can opt-out of receiving such communications at any time.

Your Legal Rights

You have the following rights under data protection laws in the EEA in relation to your personal data:

• Access – the right to request confirmation of whether we process personal data relating to you and, if so, to request a copy of that personal data;
• Correction – the right to request that we rectify or update your personal data that we hold about you which is inaccurate, incomplete or outdated, although we may need to verify the accuracy of the new data that you provide to us.
• Erasure – the right to request that we delete or remove your personal data where it is no longer necessary that we retain it You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of rassure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Restriction of Processing – the right to request that we restrict the processing of your personal data (i) if you want us to establish the data’s accuracy; (ii) where our processing of the data is unlawful but you do not want us to erase it; (iii) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Withdraw consent – in the limited circumstances where our processing of your personal data is based on your consent, the right to withdraw your consent at any time, although withdrawal of consent (i) does not invalidate the consent-based processing that occurred prior to such withdrawal or processing that is not based on consent, and (ii) means that we will no longer be able to perform such consent-based processing activities, and may result in us being unable to provide certain services to you;
• Portability – the right to request that we provide a copy of your personal data to you or to a third party you have chosen in a structured, commonly used and machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Object to Processing – the right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Lodge a Complaint – You have the right to make a complaint at any time to the relevant data protection supervisory authority in the EEA country where you are located. We would, however, appreciate the opportunity to address any concerns before you approach your relevant data protection supervisory authority, so please feel free to contact us in the first instance.

If you wish to exercise any of the rights set out above, please contact us as detailed in the Contact Details section above. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. 

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

International Transfers  

When you provide us with your personal data through your use of the website, you transfer such personal data directly to us in India. We may transfer your personal data to other jurisdictions from time to time, including where we need to share your personal data with other entities that make up Hotel Sonia and to our external third parties (in each case, to fulfil the purposes we have described in this privacy notice). In connection with such transfers, we take all reasonable steps to ensure appropriate security measures are in place to secure your personal data

In the event that we transfer your personal data from a location within the EEA, we ensure that  safeguards are implemented in compliance with EEA legal requirements, including that:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries; or
• We may make such transfers subject to specific contractual requirements approved by the European Commission. For further details, see European Commission: Model contracts for the transfer of personal data to third countries; or
• Where we make a transfer to the US, we may be able to make the transfer under the EU-US Privacy Shield mechanism. For further details, see European Commission: EU-US Privacy Shield.

Please contact us if you want further information about transfers of your data, including the mechanisms used by us when transferring your personal data out of the EEA.