Data Processing

For an ordinary guest booking, Arnav Harmony Farm is the data controller. You give us your details to make a booking with us, and we decide what to do with them — within the limits set out in our Privacy Policy. A data processing agreement is not the right instrument for that relationship, and we would be misdescribing it if we offered you one.

The roles reverse in one situation: when a company books an event, offsite or group stay and sends us a list of attendees. Those people gave their details to their employer, not to us. For that list the company is the controller and we act as processor on its instructions. That is what the terms below cover.

Where we handle attendee data on a corporate client’s behalf, we undertake to:

• Process the data only to deliver the booked stay or event, and on the client’s documented instructions.
• Use it for nothing else — no marketing to attendees, and no addition to any list of our own.
• Keep it confidential, and share it only with staff who need it to run the event.
• Apply the technical measures described in our Security Policy, including encryption at rest for phone numbers and free-text notes.
• Use only the sub-processors listed below, and tell the client before adding another.
• Help the client respond to an attendee exercising their rights — access, correction or deletion.
• Notify the client without undue delay if we become aware of a breach affecting their data.
• Return or delete the attendee list at the end of the engagement, except where tax law requires us to keep the transaction record.
• Allow the client to verify our compliance on reasonable notice.

These are the third parties that can hold guest data on our behalf. The list is short by design:

• Supabase — the database and authentication behind bookings and guest accounts.
• Vercel — website hosting, plus cookie-less page analytics.
• Razorpay — payment processing. They act as an independent controller for payment data under their own terms, not as our processor.
• Google (Gmail) — the mailbox our booking and enquiry correspondence arrives in.

We do not sell guest data, and we do not share it with advertising networks or data brokers. Cookies and browser storage are covered by our Cookie Policy.

Some of these providers operate infrastructure outside India. Where data is transferred internationally, it is done under the provider’s own contractual safeguards. We ask each provider to keep data in the region closest to our guests where they offer the choice.

If you are booking on behalf of an organisation and your procurement process requires a signed DPA — or a security questionnaire completed — email us on the address below with the document and we will work through it with you. We would rather sign your paper than hand you a generic template that does not describe what actually happens.