Privacy policy

This page explains what personal data Sunny Residences collects, why we collect it, how long we keep it, who else sees it, and what you can ask us to do about it. It is written to meet the Digital Personal Data Protection Act, 2023 and the rules made under it. We have tried to write it in plain language rather than legal language, because a policy you cannot read protects nobody.

If anything here is unclear, write to us and we will explain it. Contact details are in the grievance section below and at the foot of every page.

Who is responsible for your data

Sunny Residences is a hospitality and property management business operating serviced stays in GIFT City and Gandhinagar, Gujarat, India. For the purposes of the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary. That means we decide why and how your personal data is used, and we are accountable for it.

Registered name: we are confirming this detail (registered legal entity name). Write to sunnysuthar@live.co.uk and we will send it. Registered address: we are confirming this detail (full registered address with PIN code). Write to sunnysuthar@live.co.uk and we will send it. GSTIN: we are confirming this detail (GSTIN). Write to sunnysuthar@live.co.uk and we will send it. Email: sunnysuthar@live.co.uk Phone and WhatsApp: +91 96877 77713

We are a small team. The same people who answer the phone are the people who handle your data, which keeps the chain short and the accountability clear.

What this policy covers

It covers this website and everything reachable from it, including the booking request flow, the Sunny Circle membership pages, the guest portal, and Buddy, the assistant in the corner of the screen. It also covers the enquiries you send us by WhatsApp, phone or email, and the guest records we keep while you are staying with us.

It does not cover Airbnb. When you book one of our stays through Airbnb, Airbnb collects your data under its own privacy policy and passes us only what it chooses to share, usually your name, your dates, your guest count and your messages. We handle what Airbnb passes to us in the way described here, but the account, the payment and the review sit with Airbnb.

How this site works today, stated plainly

We would rather tell you this than have you assume something more elaborate is happening.

This site currently runs without a server of its own. The pages are static files. What you type into a form stays in your own browser until you choose to send it, and when you do send it, it travels by the ordinary route you picked: a WhatsApp message from your own WhatsApp account, or an email from your own email account, or, for a booking request, a record that reaches our team so we can reply and send you a payment link. The membership, guest portal and dashboard screens store their working data in your browser's local storage on your own device, which is why you can use them offline.

There is no analytics package on this site. There are no advertising tags, no pixels, no third party trackers, no fingerprinting and no profiling. We do not sell data, and we do not share it for advertising.

When we switch on a hosted booking and membership database, it will sit in an India region of Google Cloud, asia-south1 in Mumbai, and this policy will be updated before that happens, not after.

What we collect, why, and on what basis

Each heading below is a real place on this site or in our operation where you can hand us personal data. We collect the minimum each one needs and nothing extra.

Enquiry form on the home page

We collect your name, your message, and your phone or WhatsApp number if you choose to give it. The phone number is optional and the form works without it. We use this only to answer your enquiry and, if you ask us to, to follow up about a stay or about leasing your property to us. The basis is your consent, which you give with the tick box on the form. If you send the enquiry as a WhatsApp message, the message also sits in your own WhatsApp history and in ours.

Booking request

We collect the stay you chose, your dates, the number of guests, your full name, your email address, and your phone number if you give it. If you are booking for a company we also collect the company name and the GSTIN so we can raise a proper tax invoice. Your email address is required because the secure payment link that confirms the booking is sent there.

We use this to check availability, to hold the request, to send you the payment link, to confirm the stay, and to raise the invoice. The basis is your consent for the booking request itself, together with the performance of the booking once it is confirmed, and our legal obligation under GST law for the invoice.

Sunny Circle membership

We collect your full name, your email address, and whether the account is personal or business. A business account also carries the company name and the GSTIN. We use this to create and run your membership, to record qualifying nights and points, to apply member rates and offers, and to write to you about your own account. The basis is your consent, given at the point you join.

If we want to send you offers or programme news beyond what is needed to run your account, we will ask for that separately and you can turn it off at any time without losing your membership.

Guest portal, online check in and identity

To open the guest portal you enter your booking reference. During online check in we collect your expected arrival time, the number of guests, and your acceptance of the house rules. That is what we keep.

The check in form also has an optional identity document number field. In this version of the portal that number is not checked against anything and is not stored. We look at your identity document in person when you arrive, which is where the check actually happens. Please do not enter an Aadhaar number. If we later start recording an identity document, we will say so here first and ask for your consent at the point of collection.

Please do not upload scans, photographs of documents or any health information into the portal, because the portal is not built to hold them.

we are confirming this detail (whether the Form C report for foreign national guests and the local police guest register apply to your units, and the exact retention period the Gujarat rules require for the guest register). Write to sunnysuthar@live.co.uk and we will send it.

Food and beverage orders, housekeeping and laundry

We collect what you ordered, the quantities, the unit you are staying in, the time window you chose, and any note you added. Laundry collects the item counts you enter. We use this to deliver the service and to bill it to your stay. The basis is the performance of your stay.

Requests and complaints

We collect the type of request, the priority you set, and the description you write. We use it to resolve the matter and to keep a record of how it was handled. If a complaint concerns a member of staff or another guest, the record may name them. The basis is the performance of your stay and our legitimate need to run the property safely and fairly.

Buddy, the assistant on this site

Buddy is a plain keyword assistant. It is not an artificial intelligence model, it does not learn about you, and it does not send your conversation anywhere. When Buddy cannot answer a question, it saves the wording of that one question so our team can write a better answer for the next person. Nothing about who asked it is saved with it. If you type personal details into Buddy they are not needed, so please do not.

Payment

We do not take card numbers, UPI credentials, CVV codes or net banking passwords on this site, over the phone, on WhatsApp or by email. Payment happens on the payment provider's own secure page, reached through the link we email you, and the card data never touches our systems. We see only the reference, the amount and whether the payment succeeded.

we are confirming this detail (the payment provider whose hosted page issues the payment link, for example Razorpay, PayU, Cashfree or a bank payment page). Write to sunnysuthar@live.co.uk and we will send it.

Cameras on the property

we are confirming this detail (whether any CCTV operates in entrances, corridors, parking or other common areas of the buildings you operate in, who runs it, and how long recordings are held. If there is none, this section should say so plainly and be kept, because guests ask.). Write to sunnysuthar@live.co.uk and we will send it.

Cookies and what is stored on your device

This site sets no advertising cookies and no analytics cookies. It uses your browser's local storage for a small number of practical things: your light or dark theme choice, the fact that you have dismissed the cookie notice, your signed in session on the membership and guest pages, your service requests and orders while the demo runs without a server, and the questions Buddy could not answer.

All of it stays on your own device. You can clear it at any time from your browser's site data settings, and clearing it does not delete any booking you have already made with us.

If we ever add a measurement tool, we will ask for your consent before it runs and we will name it here.

Who else sees your data

We keep the list of recipients short and we do not sell data to anyone.

Our own team, meaning the housekeeping, maintenance and front of house people who need the detail to service your stay, see only what their job needs. Airbnb sees the data for bookings made through Airbnb, under its own terms. WhatsApp, which is operated by Meta, carries any message you choose to send us that way. Our email provider carries our email. The payment provider named above processes the payment. Our accountant handles GST filings and the statutory books. Our hosting provider, Google Firebase, serves the website files and, once the database is switched on, will store the records in the Mumbai region.

We also disclose data where the law requires it, for example to the police, to immigration authorities for the foreign guest report, or to a court or tax authority acting within its powers. If we ever receive such a demand we comply only with what is actually required.

If the business is sold or restructured, guest and member records may transfer to the new owner, who will be bound by this policy until it is properly replaced, and we will tell members before that happens.

Where your data is stored and whether it leaves India

Our intention is that guest and member records live in India. The hosted database, when it is enabled, will be created in the asia-south1 Mumbai region and that region cannot be changed afterwards, which is why we are fixing it now rather than later.

Some services we use route data outside India in the ordinary course of their operation. Email and WhatsApp are the obvious ones, and Airbnb operates internationally. Indian law permits the transfer of personal data outside India except to countries the Central Government has restricted, and we do not transfer data to any restricted country. If that list changes in a way that affects a service we use, we will change the service.

Your rights and how to use them

Under the Digital Personal Data Protection Act, 2023 you have the following rights, and we will honour them for anyone who asks, whether or not they are legally required to be given in a particular case.

You may ask for
, meaning a summary of the personal data we hold about you, what we are doing with it and who we have shared it with. You may ask for
of anything inaccurate,
of anything incomplete and
of anything out of date. You may ask for
of data we no longer need and that we are not required by law to keep. You may
another person to exercise these rights for you if you die or become unable to act, and you can tell us who that is by writing to the address below. You may
at any time. You may
to us and, if we do not resolve it, to the Data Protection Board of India.

Withdrawing consent is meant to be as easy as giving it, so it is one email or one WhatsApp message saying so, with no form to fill and no reason required. Two honest consequences follow. Withdrawal works from the moment we receive it and does not undo what was lawfully done before. And where the data is what makes the service possible, for example your name on a confirmed reservation or your membership email address, withdrawing consent means we cannot continue that service, so we will tell you what will stop before we act.

To use any of these rights, write to the Grievance Officer below with enough detail for us to find your record, which usually means the email address, phone number or booking reference you used. We may ask one question to confirm it is really you, because handing your data to someone else would be the worse failure.

Grievance Officer

Name: we are confirming this detail (Grievance Officer's full name and designation). Write to sunnysuthar@live.co.uk and we will send it. Email: sunnysuthar@live.co.uk Phone: +91 96877 77713 Postal address: we are confirming this detail (address for written grievances, if different from the registered address). Write to sunnysuthar@live.co.uk and we will send it.

We acknowledge every request within 3 working days and we aim to resolve it within 30 days of receiving it. If a request is complicated enough that it will take longer, we will tell you why and give you a date. If you are not satisfied with how we handled it, you may take the matter to the Data Protection Board of India.

How long we keep things

We keep each category only as long as it is useful or as long as the law tells us to, then we delete it or strip it of anything that identifies you.

Children

Our stays and this website are meant for adults. A person under 18 may stay with us as part of a booking made and supervised by a parent or guardian, and in that case we hold only the child's first name and age within the guest count, which is what the register needs.

We do not knowingly create memberships or take bookings from children. We do not track children, we do not monitor their behaviour, and we do not run targeted advertising at anyone, so the specific prohibitions in the Act on children's data are ones we meet by simply not doing any of it. If you believe a child has given us personal data, tell us and we will delete it.

How we protect your data

We keep the number of people with access small and give each person only what their role needs. Staff accounts on the operator side are individual, not shared. The site is served over HTTPS. Payment card data never enters our systems. Where records move to a hosted database, access will be enforced on the server and not merely hidden in the interface.

No system is perfect. If a breach happens that is likely to affect you, we will tell you and the Data Protection Board of India as the law requires, and we will tell you what we are doing about it rather than only that it happened.

Changes to this policy

When we change this policy we change the version number and the effective date at the top of the page. For a change that materially affects you, for example a new category of data, a new recipient or a new purpose, we will email Sunny Circle members and show a notice on the site for 30 days before it takes effect. The version in force when you booked is the one that applies to that booking.

Contact

Email sunnysuthar@live.co.uk or call or message +91 96877 77713. We are based in GIFT City and Gandhinagar, Gujarat, India.

---