Privacy Policy

This website, thehavengoa.com, is operated by:

Galgibag Hub and Tours Private Limited, trading as The Haven Goa, is responsible for the personal information collected through this website and decides why and how it is used.

We welcome guests from India, the United Kingdom, Europe and the United States, so more than one privacy law may be relevant. Which one applies to you depends on where you are and on whether that law applies to a business like ours — something that turns on facts we cannot judge from a website visit. Where a given law does apply, our role under it would be:

• Data fiduciary, under India's Digital Personal Data Protection Act, 2023.
• Data controller, under the UK GDPR.
• Data controller, under the EU GDPR.
• Business or controller, or the equivalent role, under a United States state privacy law that applies to us.

Listing these does not mean all of them apply to you, or that each one applies to us. It means that where one does, we intend to meet it. This policy covers thehavengoa.com only. It does not cover other websites we link to.

Most information reaches us because you chose to send it, by submitting a form. Some technical information is processed automatically whenever any website is served.

• Enquiry and registration forms: your name and email address, plus any optional details you choose to give — a phone number, your location, preferred timing, group size or how you would be attending, the experience you are interested in, and anything you write in the message field.
• Your registration itself: when you register interest in an experience, we record which experience you chose, because that is what you have asked us to contact you about.
• Details attached to a submission: the page you submitted from, your browser's user-agent string, the referring page, your IP address, and the time of submission. These help us respond in context and limit automated spam.
• Essential technical processing: our hosting provider processes standard server request logs, which include IP addresses, in order to serve the site, keep it available and protect it from abuse. This happens for every visitor and does not depend on consent.
• Analytics, only with your permission: pseudonymous and aggregated information about pages visited, coarse location, device and browser type, and non-identifying interaction events such as which call to action was used.

Please do not send us sensitive information through a general enquiry form unless it is genuinely necessary. The message field is free text, so it is worth a moment's thought: there is no need to tell us about health conditions, dietary requirements, religious or political views, or anything similar in order to ask a question about the venue.

Planning an actual stay can be different. If you go on to make a booking, we may need details such as dietary requirements, accessibility needs, or a health or medical consideration relevant to an activity — because we cannot look after you properly without them. Where that happens we will ask for it directly, use it only for that booking and the arrangements around it, share it only with the people who need it to deliver the stay, keep it no longer than the booking and our legal obligations require, and handle it with the additional care that applicable law expects for information of that kind.

We do not ask for or store payment details on this site. We do not create accounts or passwords. We do not buy personal information, and we do not combine your details with data from other sources.

We configure and test our analytics so that names, email addresses, phone numbers and form contents are not intentionally sent. Session replay is set to Strict masking, so text and form entries are masked in your browser before anything is transmitted.

We do not sell personal information, and we do not use it for targeted or cross-context behavioural advertising.

Where the basis is consent, you can withdraw it at any time. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

India

The table above sets out the position under the UK and EU GDPR, which use their own vocabulary of legal bases. Indian law is framed differently, so we describe it separately rather than borrowing terms that do not belong to it. Where India's Digital Personal Data Protection Act, 2023 and its Rules apply, we process personal data on the basis of your consent, or on another legitimate use permitted by that Act.

We use Google Analytics 4 and Microsoft Clarity to understand which parts of the site are useful. Neither is loaded, and neither collects anything, until you actively accept analytics in the cookie banner. If you do nothing, or reject non-essential storage, no analytics script is requested and no analytics cookie is set.

Rejecting analytics does not reduce what you can do here. Every page, form and link works exactly the same either way, and we do not ask again for six months.

With your consent, these tools may process pages viewed, approximate location derived from your IP address, device and browser details, and interaction data such as which call to action was used and how far down a page you scrolled.

We configure and test our analytics so that names, email addresses, phone numbers and the contents of forms are not intentionally sent to either provider. Clarity is configured with Strict masking, so text and form entries are masked in your browser before anything is transmitted, and we do not intentionally use Clarity to capture what you type into an enquiry or registration form.

You can change your decision at any time through “Cookie settings” in the footer of every page. Our cookie policy lists each item these tools store and how long it lasts.

These providers process information on our instructions so that the site can operate:

• Vercel — Hosts the website and processes technical request logs
• Supabase — Stores enquiry and registration submissions
• Resend — Delivers our internal notification email, and a confirmation email to you only if that option is enabled
• Google (Google Analytics 4) — Website analytics — loaded only after you accept
• Microsoft (Clarity) — Interaction analytics — loaded only after you accept

We disclose personal information only to the service providers described above, professional advisers where necessary, or authorities where required by law.

We are based in India and our providers operate globally, so your information may be processed in India, the United States, the European Economic Area and other locations where those providers run their infrastructure.

Some laws require a specific safeguard before personal information leaves their jurisdiction. Where that applies, we rely on a lawful transfer mechanism made available by the provider or otherwise available to us under applicable law. Depending on the provider and the route the data takes, such a mechanism might be an adequacy decision or adequacy regulations, the Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum, or another mechanism the law recognises.

We list those as examples rather than as claims. We do not assert that any particular one is in place for any particular provider, because which mechanism applies is a matter of record between us and that provider. If you want to know what applies to a specific provider, email namaste@thehavengoa.com and we will tell you what is in place.

• Enquiries and registrations: retained for 24 months after our last meaningful contact with you, unless we need to keep them longer for an active booking, a legal obligation or a dispute.
• Experience-update consent: retained until you withdraw consent, or 24 months after your last meaningful engagement, whichever comes first.
• Analytics — Google Analytics: user-level event data is retained for 14 months, after which Google deletes it. Aggregated reporting totals are not affected by that deletion.
• Analytics — Microsoft Clarity: session recordings and heatmaps are retained for the period that applies under Clarity's service configuration and Microsoft's own retention practice, after which Microsoft deletes them. We do not state a figure here because we have not verified one.
• Booking and business records: where a booking goes ahead, the related records may be kept longer than 24 months where we need them for tax, accounting, contractual or other legal obligations, and for as long as those obligations require.

Analytics retention periods describe how long the provider keeps the data it has collected. They are a different thing from how long a cookie stays in your browser, which is listed separately in our cookie policy.

You can ask us to delete your details sooner at any time.

Submissions are sent over an encrypted connection and stored in a database that is not publicly readable. Access is limited to the people who need it in order to respond to you. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Wherever you live, you can email namaste@thehavengoa.com to ask what we hold about you, to have it corrected or deleted, or to withdraw consent. We will ask for enough information to be satisfied of your identity before we act, so that we do not disclose information to the wrong person. We do not charge for this, and we will respond within the period required by the law that applies to you.

Analytics is off until you accept it. You can change your decision at any time using the “Cookie settings” link in the footer of every page.

Withdrawing consent stops analytics collection from that moment and prevents the analytics tags loading again. Our consent system also removes the analytics storage it controls from your device — the cookies and browser-storage entries listed in our cookie policy.

We should be straightforward about the limit of that. Anything already sent to Google or Microsoft before you withdrew stays with them until their own retention period expires. Clearing it from your browser does not reach back and delete it from their systems. If you want that data removed, contact us and we will tell you what can be done and how to approach the provider.

To stop receiving updates about an experience you registered interest in, email us and we will remove you. That is a separate thing from analytics consent, and stopping one does not affect the other.

Sending us an enquiry does not sign you up to anything. Contacting us about the venue does not add you to a general mailing list, because we do not run one from this website.

Registering interest in an experience is a request, not a subscription. By submitting that form you are asking us to contact you about the one experience you selected — its future dates, availability and registration. We treat that as a service communication you have requested rather than as marketing, which is why there is no consent box to tick: the request is the act of submitting, and you can simply not submit.

We use your details only for the experience you chose. We will not send you anything about other experiences, and there is no general newsletter to be added to. Ask us to stop at any time and we will remove you.

Replies to your enquiry, and messages about a booking you have made, are service communications rather than marketing. We will send those whether or not you have asked for experience updates, because they are how we answer you.

This website is meant for adults arranging or asking about retreats. It is not designed for children to submit their own personal information, and we ask that they do not. Where an enquiry involves a child, a parent or guardian should make it.

If a child has sent us information directly without the parental involvement that applicable law requires, please contact us and we will deal with it — in most cases by deleting it.

Where a family booking legitimately requires information about a child — names and ages for accommodation, or a dietary or accessibility need — we process it for that booking, for accommodation and safeguarding, and for delivering the stay, in accordance with applicable law and with the same care we apply to any sensitive information.

Where applicable law requires us to appoint a representative in the United Kingdom or European Economic Area, the representative's contact details will be published here and made available to affected individuals.

Please contact us first — we would rather put something right directly. You also have the right to complain to the data protection authority in your country.

We may update this policy if our services change, if we add or replace a provider, if the technology behind the site changes, or if the law that applies to us changes.

The current version always appears on this page, with the date it took effect shown at the top. If a change materially affects how we use information you have already given us, we will take reasonable steps to tell you rather than relying on you noticing a new date.

For anything in this policy — a question, a request about your information, or a complaint — write to us:

This is also the address to use for a privacy request or a grievance under Indian law.