Privacy Policy

How we handle your information

This Privacy Policy explains how The Coonoor Club ("the Club", "we", "us", or "our") collects, uses, stores, and protects your personal information when you use the Coonoor Club member app and member portal (together, the "Service"). The Service lets members book rooms, order food and beverages within the Club, and add money to their member account to spend inside the Club. By creating an account or using the Service, you agree to the practices described in this policy.

1. Who We Are

The Coonoor Club is a private members' club established in 1885, located at Club Road, Coonoor – 643 101, The Nilgiris, Tamil Nadu, India (Reg. No. 22 of 1991). The Club is the entity responsible for your personal data (the "data fiduciary").

2. Information We Collect

a. Information you provide

• Account & identity: full name, email address, mobile number, membership number, membership category, and membership date.
• Profile: a profile photo, if you choose to upload one.
• Room bookings: check-in/check-out dates, number of guests, guest names, and any special requests.
• Food & bar orders: items ordered and the delivery location within the Club (table, room, or other Club area).
• Member account & wallet: money you add to your member account, your account balance, top-up history, and spending within the Club.
• Billing: dues, invoices, and payment records.

b. Information collected automatically

• Device & usage data: device type, operating system, app version, and basic log data.
• Session data: a secure session token is stored on your device to keep you signed in. We do not use tracking or advertising cookies.

c. Information we do not collect

We do not store your card, UPI, or bank details. When you add money to your member account or pay dues, the payment is handled directly by our payment processor (see Section 4).

3. How We Use Your Information

We use your information only to operate the Club's services, specifically to:

• Create and secure your member account and verify your membership status.
• Process room bookings and food & bar orders, and deliver them to the correct location in the Club.
• Add money to your member account, maintain your balance, and record your spending within the Club.
• Maintain your billing account, dues, and payment history.
• Show you Club events, notices, and account information.
• Respond to your requests and provide member support.
• Keep the Service secure and comply with our legal and accounting obligations.

We do not sell your personal information, and we do not use it for third-party advertising.

4. Payments & Third-Party Services

To run the Service we rely on trusted third-party providers who process certain data on our behalf. Each handles data under its own privacy and security terms:

• Razorpay — processes payments when you add money to your member account or pay dues. Your card/UPI/bank details are entered directly with Razorpay and are governed by Razorpay's privacy policy. We only receive a confirmation and a payment reference.
• Supabase — database, authentication, and file storage for member records, bookings, orders, and account balances.
• Cloudinary — hosting of member profile images you upload.
• Vercel — hosting of the web portal.

If you download the app from the Google Play Store, Google may also collect certain data in accordance with Google's own privacy policy.

5. Where Your Data Is Stored (International Transfers)

Our database and storage are hosted on servers located outside India (currently in the Asia-Pacific region). By using the Service, you consent to your personal data being transferred to and processed in these locations, subject to appropriate safeguards and the terms of our service providers.

6. Data Retention

We keep your personal information and account records for as long as you remain a member and for a reasonable period afterwards, as required to meet legal, accounting, and audit obligations. When data is no longer needed, we securely delete or anonymise it.

7. How We Protect Your Data

Access to member data requires authentication, and the database enforces access controls so members can view only their own information. Data is transmitted over encrypted (HTTPS) connections. While we take reasonable measures to protect your data, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you may:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal data, subject to our legal retention obligations.
• Withdraw consent where processing is based on consent.
• Raise a grievance about how your data is handled.

To exercise any of these rights, contact us using the details in Section 11.

9. Children's Privacy

The Service is intended for Club members and authorised users. Accounts for minors are managed by a parent or guardian member. We do not knowingly collect personal data directly from children without appropriate consent.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify members through the app or portal. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.