Privacy Policy

TETHYS HIMALAYA PRIVACY NOTICE:

A Covenant of Respect and Confidentiality

Effective Date: November 15, 2025

At TETHYS HIMALAYA, our philosophy is built upon an unwavering commitment to respect and trust. We view the sharing of your Personal Data not as a transaction, but as an act of profound confidence in our stewardship. This Privacy Notice is our Covenant—a detailed expression of how TETHYS HIMALAYA (referred to herein as “TETHYS HIMALAYA,” “we,” “us,” or “our”) meticulously handles, protects, and manages the information required to orchestrate your unique and exceptional experience.

This commitment to the highest standard of privacy applies to all data scrupulously gathered when you honor us with your engagement via:

Our online portal (https://tethyshimalaya.com/, the “Website”).
Your physical presence at our serene property and your enjoyment of our dedicated services (e.g., dining, wellness, and concierge assistance).
Private, confidential correspondence exchanged through email, phone, or secure messaging platforms regarding your anticipated stay preferences.
Engagement with our brand across various social media and digital channels.
Information received in trust from reputable third parties who facilitate your journey (e.g., global reservation systems, esteemed travel advisors).

By choosing TETHYS HIMALAYA, you acknowledge and consent to the responsible data practices detailed in this comprehensive Notice.

Table of Contents

Personal Data: The Information We Handle with Care
Sources of Collection: How Data Enters Our Trust
The Foundation for Processing: Why We Tenderly Utilize Your Data
Limited Disclosure and Secure Sharing
Your Autonomy: Managing Your Privacy Rights
Data Integrity, Retention, and Security
Reaching Our Data Protection Team
Regional Affirmation: European Residents (EU/EEA/UK)
Regional Affirmation: North American Residents (USA)
Regional Affirmation: Asian Residents (People’s Republic of China)
Global Affirmation: Commitment to Africa, South America, and Oceania

Personal Data: The Information We Handle with Care

Personal Data” is any distinct piece of information linked to an identifiable individual. We meticulously gather the following categories, strictly limiting collection to only what is necessary:

Category of Personal Data	Examples of Information Entrusted to Us
Identification and Official Contact	Full legal name, title, preferred salutation, confidential contact details (email, mobile number, mailing address), official government ID numbers (e.g., passport for necessary identity verification), and nationality.
Transaction and Financial Integrity	Payment mechanism details (always encrypted and delegated to certified, PCI-compliant processors), precise records of your reservations, and related billing and settlement histories.
Guest Profile and Service Customization	Confirmed travel dates, bespoke room preferences, names of your accompanying party, preferred language, and any special, vital requests necessary to plan your stay (e.g., arrival time, airport transfer needs).
Health and Safety Data (Highly Sensitive)	Specific, critical data crucial for your personal safety and well-being, such as confirmed food allergies, essential dietary requirements, or mobility needs. This data is only gathered when strictly essential for service delivery and safety.
Digital Footprint and Security Assurance	Technical data (IP address, OS, browser type), on-property Wi-Fi session usage, and discreet image/audio captured by CCTV systems placed exclusively in public access areas for the preservation of safety.
Communication Preferences	Your explicit choices regarding receiving updates, private promotions, and invitations from TETHYS HIMALAYA, ensuring total respect for your personal boundaries.

Sources of Collection: How Data Enters Our Trust

We receive Personal Data through interactions initiated directly by you or via trusted partners facilitating your stay:

Direct Engagement: Data provided when you utilize the booking engine or contact forms on our Website.
Physical Presence: Information gathered during the reservation, check-in, or when you interact with our staff and resort facilities (Spa, Dining, Concierge).
Secured Messaging: Exchanges conducted via phone, email, or digital chat, which may be securely logged for quality control and documentation purposes (with prior notice).
Third-Party Facilitation: Data forwarded to us by your trusted travel advisor, corporate booker, or the online platform used to arrange your reservation.
On-Site Technology: Information generated by your voluntary connection to our secure, dedicated Wi-Fi networks and via our necessary security systems.

The Foundation for Processing: Why We Tenderly Utilize Your Data

We assure you that all data utilization is based on a clear, lawful justification and is carried out with professional due diligence and ethical oversight:

Purpose of Processing	Description	Legal Basis
Contractual Service Delivery	Managing the reservation cycle, confirming payments, providing the bespoke accommodation requested, and managing accurate billing records.	Necessary for the performance of a contract with you.
Safety, Customization, and Comfort	Utilizing preference and sensitive data (e.g., allergies) exclusively to ensure your personal safety and to tailor the hospitality experience to meet your needs perfectly.	Our Legitimate Interests (service excellence) and, for sensitive data, your Explicit Consent.
Protection of Premises and People	Utilizing CCTV and related monitoring data solely to secure the property and ensure the protection and well-being of all guests, visitors, and employees.	Legal Compliance and Legitimate Interests (security and risk mitigation).
Respecting and Managing Communications	Sending personalized marketing materials, confidential surveys, or updates, only based on your prior agreement or our established, existing relationship.	Your Consent (where required) or Legitimate Interests (customer relations).
Adherence to Law and Regulation	Providing required information to governmental agencies, security bodies, or tax authorities as strictly mandated by local Indian laws or other binding jurisdictions.	Compliance with a Legal Obligation.

Your Autonomy: Managing Your Privacy Rights

Your autonomy and control over your Personal Data are principles we uphold unequivocally.

Marketing Withdrawal: You are entirely free to withdraw your consent for promotional communications at any time by using the dedicated unsubscribe link provided in every marketing email. Please note this withdrawal does not affect essential service-related notifications (e.g., booking confirmations).
Exercising Statutory Rights: To inquire about, correct, delete, or place restrictions on the use of your data, we ask that you confidently address your request to our Data Protection Team via the contact details in Section 7. We will handle your request promptly and with the necessary verification steps to ensure your confidentiality.

Data Integrity, Retention, and Security

Retention Period: We retain Personal Data only for the duration strictly necessary to fulfill the operational and legal purposes for which it was gathered. Guest transaction and stay records are generally retained for up to seven (7) years to comply with mandatory local Indian laws for financial record-keeping.
Security Protocol: We maintain stringent organizational, physical, and technical security measures—including access controls, encryption, and continuous monitoring—to protect your data from loss, misuse, or unauthorized access.
International Data Transfers: The resort and primary operations are based in India. Consequently, your data will be processed and stored on systems located here. For international residents, by engaging with our services, you acknowledge this transfer. We ensure that your data remains protected by the principles outlined in this Notice during and after transfer.

Reaching Our Data Protection Team

TETHYS HIMALAYA operates as the primary data controller for the processing activities outlined here. We stand ready to address your questions and uphold your rights.

Detail	Information
Primary Data Controller	TETHYS HIMALAYA
Official Address	KHATONI NO 54 MIN 54, KHASRA NO 170/169/157/147, KHEWAT NO 17 MIN 17, PATWAR NAINA TIKKAR, TEHSIL-PACHAD MANGAD, Sirmaur, Himachal Pradesh, 173024, India
Data Protection Contact Email	[email protected] , 9805642641
European Representative (Placeholder)	Contact details for our designated EU/EEA representative will be provided here as legally required by GDPR.

Regional Affirmation: European Residents (EU/EEA/UK)

If you are a resident of Europe (European Union, European Economic Area, or the United Kingdom), your rights under the GDPR are fully affirmed and honored:

Core Data Rights: You retain the right of Access (to obtain copies), Rectification (to correct inaccuracies), Erasure (to be forgotten), Restriction of processing, Objection to processing, and Data Portability (to transfer data).
Process Assurance: We will respond to all valid requests professionally and typically within one calendar month.
Supervisory Authority: You retain the unqualified right to lodge a complaint with your relevant local Data Protection Authority (DPA) or the UK Information Commissioner’s Office (ICO).

Regional Affirmation: North American Residents (USA)

This section addresses the requirements of various U.S. state privacy legislation (including those in California, Virginia, and others):

Individual Rights: Residents have the right to Know (confirm processing and access data), Delete (subject to legal exceptions), Correct inaccuracies, and Opt-Out of the “Sale” or “Sharing” of Personal Data for targeted advertising.
Targeted Advertising: While TETHYS HIMALAYA does not sell data for monetary profit, we fully honor your right to Opt-Out concerning the sharing of data for cross-context behavioral or targeted advertising.
Non-Discrimination: We guarantee you will experience no discriminatory treatment for choosing to exercise these privacy rights.

Regional Affirmation: Asian Residents (People's Republic of China)

We affirm our strict compliance with the Personal Information Protection Law (PIPL) of the People’s Republic of China:

Sensitive Data: We classify payment card information, health details, and detailed stay records as Sensitive Personal Information under PIPL, affording it the maximum level of security and oversight.
Cross-Border Transfer: For service continuity, data may be transferred outside the PRC (to India). We will obtain your separate, explicit consent for this transfer and ensure compliance with PIPL’s strict requirements for cross-border data protection.
Data Rights: All rights under PIPL, including the right to access, rectification, and to withdraw consent, can be exercised by contacting our team via Section 7.

Global Affirmation: Commitment to Africa, South America, and Oceania

We extend our commitment to fundamental fairness, security, and transparency to all our valued guests residing in Africa, South America, and Oceania.

For all residents outside the specific regions mentioned in Sections 8, 9, and 10, we assure you the following non-negotiable data protections:

Right to Access: You have the right to request confirmation of data processing and to obtain a copy of the Personal Data we hold about you.
Right to Correction: You have the right to request the prompt correction of any inaccurate or incomplete Personal Data.
Universal Security: Your data is protected by the same high-level organizational and technical security standards applied globally, regardless of your continent of origin.

All requests to exercise these fundamental rights can be confidently submitted to our Data Protection Team via Section 7.

Updates to This Privacy Notice

The “Effective Date” at the beginning of this document reflects when this version was put into effect. We reserve the right to respectfully revise this Notice to reflect changes in our practices or evolving legal obligations. We encourage periodic review of this document, and any material changes will be communicated through our Website.