Privacy Policy

This Policy applies to all personal data processed through this website, the MPT Central Reservations booking engine, our transactional email and messaging channels, and any offline correspondence that arises from a booking created online. It applies to every visitor, whether or not a reservation is completed.

Where a resort is operated on MPT’s behalf by an approved operating partner, that partner processes a limited subset of your booking data strictly to deliver your stay. Such partners are bound by contract to the standards described in this Policy.

This Policy does not govern third-party websites that you may reach through links published here, including the Government of Madhya Pradesh tourism portals. Those sites publish their own privacy notices and you should read them separately.

• “Personal data” means any data about an individual who is identifiable by or in relation to such data.
• “Sensitive personal data” includes financial information such as payment instrument details, and any government identity numbers collected at check-in.
• “Data principal” means the guest or website visitor to whom the personal data relates.
• “Data fiduciary” means MPT, which determines the purpose and means of processing.
• “Processing” means any operation performed on personal data, including collection, storage, use, disclosure and erasure.

We process personal data on the basis of the consent you give when you submit the booking form, on the basis of necessity for the performance of the reservation contract, and, in limited cases, to comply with legal obligations applicable to a State Government company.

• To create, confirm, amend and cancel reservations and to allocate inventory at the chosen resort.
• To issue booking confirmations, payment receipts, reminders, vouchers and cancellation or refund notices.
• To answer enquiries and provide reservations support before, during and after a stay.
• To process payments, verify receipts and calculate refunds, including discounts applied through valid voucher codes.
• To detect, investigate and prevent fraudulent bookings, chargeback abuse and misuse of the booking engine.
• To generate aggregated, non-identifying statistics on occupancy, demand and website performance.
• To meet audit, taxation and record-keeping requirements applicable to MPT.

Cookies are small text files placed on your device. We use only strictly necessary cookies and local browser storage to keep the booking form working across steps and to remember your selections. We do not use analytics, advertising or tracking cookies, and we do not track you across websites.

You may block or delete cookies in your browser settings at any time. Blocking strictly necessary cookies may prevent the booking form from retaining your selections between steps. We honour browser-level “reduced motion” and accessibility preferences and do not use them for profiling.

We share personal data only where it is necessary and only to the extent required:

• With the MPT resort or approved operating partner delivering your stay, to register your arrival and prepare your room.
• With payment service providers and banks, to authorise, settle, reconcile or reverse a transaction.
• With email and messaging service providers, to deliver transactional communications relating to your booking.
• With auditors, legal advisers and government authorities, where disclosure is required by law, regulation, court order or a lawful investigation.

Card and bank credentials are captured within the secure environment of our payment partners and are not stored in our booking database in raw form. Records retained by us are limited to the transaction reference, amount, instrument type, masked identifier, status and timestamp, which are required for reconciliation and refunds.

Payment documents that you upload, such as a screenshot of a completed transfer, are stored in a private storage location that is not publicly addressable. Access is granted only through short-lived signed links issued to authorised reservations staff.

• All traffic to and from this website is encrypted in transit using TLS.
• Database access is protected by row-level security so that a booking record can be read only by the guest who holds the matching Booking ID and PNR, or by authorised staff.
• Guest lookups from the public site are routed through a controlled server endpoint rather than direct database access.
• Administrative access is restricted by role, logged, and reviewed; privileged credentials are never embedded in the website code.
• Backups are encrypted at rest and restoration is tested periodically.

No method of transmission or storage is completely secure. While we apply reasonable security practices as contemplated by Rule 8 of the SPDI Rules, 2011, we cannot guarantee absolute security and you share information with us at your own discretion.

Booking records, invoices and payment references are retained for eight financial years to satisfy audit and taxation requirements. Enquiry and abandoned-booking data is retained for twelve months. Diagnostic logs are retained for ninety days. No analytics or visitor-tracking data is collected, so none is retained.

When a retention period expires, records are deleted or irreversibly anonymised so that they can no longer be linked to an identifiable individual.

• Right of access — obtain a summary of the personal data we hold about you and the purposes of processing.
• Right to correction — have inaccurate or incomplete data corrected or completed.
• Right to erasure — request deletion of data that is no longer necessary, subject to statutory retention.
• Right to withdraw consent — withdraw consent for optional processing at any time, without affecting processing already carried out.
• Right to grievance redressal — escalate a complaint to our grievance contact and, thereafter, to the competent authority.
• Right to nominate — nominate another individual to exercise your rights in the event of death or incapacity.

To exercise a right, write to crs@mptourism.online from the email address used for the booking and quote your Booking ID. We respond within thirty days. We may seek proportionate verification before acting on a request that would disclose or delete personal data.

This website is not directed at children. Reservations must be made by an individual aged eighteen years or above. Where a child accompanies a guest, we collect only the number and age of children, which is necessary to allocate occupancy and to apply the correct tariff. We do not knowingly collect other data about a child and will delete any such data brought to our attention.

Personal data is processed on infrastructure selected for reliability and security. Where a service provider processes data outside India, the transfer is permitted only to jurisdictions not restricted by the Central Government, is governed by contractual data protection commitments, and is limited to the minimum data required to deliver the service.

Transactional messages relating to a live reservation — confirmations, payment receipts, reminders, cancellation notices and refund updates — are part of the service and are not marketing.

Promotional messages about seasonal offers or new properties are sent only with consent and always carry an unsubscribe link. Unsubscribing takes effect immediately and does not affect transactional messages for an active booking.

In the event of a personal data breach that is likely to result in harm, we will notify affected data principals and the competent authority without undue delay, describing the nature of the breach, the likely consequences, the measures taken to contain it, and the steps you may take to protect yourself.

Complaints regarding the handling of personal data may be addressed to the Grievance Officer, MPT Central Reservations, Apeejay House, 3rd Floor, Dr. V. B. Gandhi Marg, Fort, Mumbai 400001, or by email to crs@mptourism.online. Complaints are acknowledged within forty-eight hours and resolved within thirty days.

We may revise this Policy to reflect changes in law, technology or our booking operations. The revision date is shown at the top of this page. Material changes will be highlighted on the website for a reasonable period. Continued use of the website after a revision constitutes acceptance of the revised Policy.