PRIVACY POLICY
INTRODUCTION
This Privacy Policy governs how DLF Club and Hospitality and its affiliates (hereinafter referred to as "DLF", "we", "us" or "our") collect, use, store, disclose, and Process the Personal Data of its Users through the DLF Hospitality App ("Platform"). The Platform is a service application that connects the community of Platform Users with the club management, facility management company and all other service providers appointed by the facility management company including security personnel (collectively defined as "Operators" herein) to interact through the Platform, with a view to inter alia improving access to services, safety and security and convenience of the Users (collectively "Services"). This Privacy Policy also outlines the privacy practices adopted by DLF, the rights available to Users in relation to their Personal Data, and the choices Users may exercise regarding such Personal Data.
Please read this Privacy Policy carefully prior to accessing our Platform or availing the Services. The provisions contained in this Privacy Policy supersede all previous notices and statements regarding DLF's privacy practices with respect to the Services. For any questions or concerns regarding this Privacy Policy, you may contact us at the details provided in the "Support and Grievances" section.
This Privacy Policy applies to all Personal Data provided by Users while accessing the Platform or using the Services, as well as Personal Data obtained by DLF about such Users from Third Parties, in each case in accordance with Applicable Laws and subject to the User's consent where required.
If any information provided or uploaded by you violates the provisions of this Privacy Policy or the Terms of Use, DLF reserves the right to remove such information and restrict or revoke your access to the Platform without incurring any liability. Please note that the Services and Operators are subject to their own respective rules and regulations. For further information on these Services, refer to the Terms of Use.
DEFINITIONS AND INTERPRETATIONS
For the purposes of the Privacy Policy:
- "Account" means a user account created on the Platform by DLF on the basis of the Personal Data furnished by the User, which Account shall be associated with the User's Profile;
- "Applicable Laws" means all applicable data protection and privacy laws, rules, and regulations in force in the relevant jurisdiction governing the processing of Personal Data, including, where applicable, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023, read with the Digital Personal Data Protection Rules, 2025, as may be amended from time to time;
- "Personal Data" means any data that relates to an identified or identifiable individual who is identifiable by or in relation to such data;
- "Platform" means the DLF Hospitality App operated by DLF;
- "Processing" means, in relation to Personal Data, a wholly or partly automated operation or set of operations including operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, dissemination by transmission or otherwise making available, restriction, erasure or destruction;
- "Profile" means the user profile associated with a User's Account on the Platform;
- "Third Party" means any person or entity other than DLF, the User and the Operators; and
- "User", "you" and "your" means any natural or legal person who accesses or uses the Platform.
Terms appearing in capitalized form but not defined herein shall carry the meaning assigned to them in the Terms of Use. In the event of any conflict between this Privacy Policy and the Terms of Use, the relevant capitalized terms shall bear the meaning attributed to them under the Applicable Laws governing the User.
PURPOSE, COLLECTION AND USE OF PERSONAL DATA
All Personal Data collected by DLF is collected through the following means:
- Directly from you, for example when you use the Platform, the Services, when you complete a physical membership form or when you contact us through phone, email or use our contact us feature.
- Indirectly from you when, for example, your IP address, device data, browsing data and other information is collected while the User is interacting with the Platform.
- When you are a recipient of Services provided by the Operators or the Platform.
- When you provide Personal Data on the Platform to enable identity verification.
- When you reach out to the customer support teams or when a support ticket is created on the Platform.
- When you provide feedback to the Operators by using the Platform.
- Web forms and surveys on the Platform.
- Off-site services and events that relate to the Platform or the Services, or that are conducted by the Operators.
- API is embedded in the Platform.
- Any other interaction initiated by you by using the Platform or with the Operators.
If you submit any Personal Data of another person on the Platform, you hereby confirm that you have obtained free, specific, informed, unconditional, and unambiguous consent from such person to share their Personal Data on the Platform, have made available this Privacy Policy to them, and that such Personal Data is true and accurate.
This Personal Data is collected and Processed for the following purposes:
| Sr. No. | Purpose Name | Personal Data Collected | Usage |
|---|---|---|---|
| Account Creation and Identity Verification | Full name, title/salutation, email address, phone number, date of birth, place of birth, gender, apartment number, owner/tenant status, residency status (whether currently residing), NRI/foreign national status, marital status, anniversary date, nationality, passport details, PAN card details, Aadhaar/driving licence details, Visa/FRRO details (for foreign nationals), present residence address, permanent address, specimen signature, photographs, possession letter/lease agreement, relationship to primary member; spouse details (name, date of birth, place of birth, nationality, NRI status, anniversary date, passport details, PAN card number, Aadhaar/driving licence number, occupation, designation, employer/organisation name and address, phone number, email, specimen signature); parent details (name, date of birth, residence, identity proof details); dependant/children details (name, date of birth, sex, nationality, photograph, government ID number (for family members added via the Platform)); and for corporate applicants: authorised signatory details, and nominee details (name, designation). | Used to create a user account and profile, verify user identity, administer club memberships, verify residency and nationality status, avoid fraud or identity theft, and enable personalised Services. | |
| Profile and Listing Information | Email address, phone number, profile picture, blood group, gender, alternate mobile number, alternate email address, primary occupation, designation, name of employer/organization, medical practitioner status, interests and preferences, and any additional profile information voluntarily provided by the User. | Used to enable access to certain Platform features such as booking a facility or creating a listing, and to personalise Services and tailor offerings based on member interests and preferences. | |
| Communications with Authorised Operators | Correspondence content, communication metadata, and any additional information provided by the user | Used by the Platform to collect and retain all correspondence with Operators in order to perform its Services. | |
| Visitor / Guest Information (Gate & Visitor Management) | Name, phone number, resident flat to be visited, vehicle number (if any), entry/exit time, identity proof, and photograph of the Guest | Used for security purposes to control access to the society for third-party vendors, delivery executives, guests (including domestic help) through the Platform. | |
| Customer Support and Grievance Handling | Name, contact details, support ticket details, customer support calls recordings, chats and data that may get collected via any attachments submitted on the Platform | Used to assist users when User contact customer support, investigate and address queries, and monitor and improve customer support responses. May also be used for staff training, quality assurance, or to retain evidence of a specific transaction or interaction. | |
| Feedback and Survey Data | Responses, ratings, and any additional information voluntarily provided by the user via feedback forms, surveys, or off-site events | Used to measure consumer interest and satisfaction in Services and improve Platform functionality. | |
| Usage Data | |||
| Device and Platform Usage Data | Operating system, hardware and software versions; foreground/background device operations; unique identifiers and device IDs; GPS location (if permitted); IP address; type of mobile device, pages visited, time and date of visit, time spent on pages, and other diagnostic data. | Used to provide automatic updates and additional security, verify identity as a device holder, analyses device behavior, and improve the Platform and provide an enhanced customized user experience. Also used to analyse Platform usage and improve functionality. | |
| Cookies Data | Small data files placed on the user's device, including third-party cookies, storing preferences, settings, and session data | Used to reduce frequency of password entry, analyse Platform and user engagement, personalise services, assist with sign-in, deliver relevant advertisements, and analyse Platform operations. | |
| Information Collected from Third Parties | Personal correspondence sent by the user to Operators via the Platform (e.g., emails or letters); correspondence sent by third parties (e.g., third-party service providers regarding payment of dues, service tickets) about the user's activities | Collected into a User-specific file on the Platform and by Operators to reflect such correspondence accurately on the Platform. | |
| Payment-Related Services | |||
| Financial and Billing Management | Financial information including service bills, settlement of accounts, payment disbursal/collection details | Used by the Platform and Operators under relevant contractual arrangements to manage payments and financial information, including issuance of service bills, settlement of accounts with facilities and other Operators, and payment disbursal/collection from users/residents. | |
| Payment Processing | Personal Data as required by authorized third-party payment service providers to facilitate financial transactions | Used to facilitate payment processing on the Platform. The Platform and Operators do not directly collect financial transactional data; they only validate and maintain the status and success of transactions in the relevant ledger for financial Services. Users are subject to the terms and privacy policy of the applicable third-party payment service provider. | |
| Additional Purposes | |||
| Analytics and Trend Analysis | Personal Data and behavioral/interaction data generated by use of the Platform | Used to conduct trend analysis to study usage patterns of the Platform, to provide customized Services, prevent fraud, prevent illegal activity, understand and improve how Users interact with the Platform, customize Services, and analyse User behavior and quality of Services. | |
| Marketing and Promotional Communications | Name, email address, phone number, and preferences | Used to provide Users with newsletters, information, products or Services that they request or which may be of interest to them, and to periodically communicate regarding new features, benefits, contests, feature usage guidance, compliance requirements, and offerings. | |
| Fraud Detection and Security | Personal Data and behavioral/interaction data generated by use of the Platform | Used for detection and prevention of fraud, identity theft, spam, abuse, security incidents, and other harmful activity; conducting security investigations and risk assessments; and automated restriction or suspension of access where a safety risk is detected. | |
| Disclosure to Law Enforcement and Regulatory Authorities | Personal Data as required by law or court order | Disclosed to law enforcement officials, government authorities, or the police in exercise of their functions or pursuant to a court order or where required to comply with a legal obligation or an order from a government or statutory authority, without prior notice or consent. | |
| Corporate Transactions (M&A / Business Transfers) | Personal Data as relevant to the transaction | Personal Data may be disclosed to a prospective seller or buyer of a business or assets or shared with a new entity in the event of a merger, amalgamation, reorganization, or restructuring. Any receiving entity shall be bound by this Policy with respect to the information received. | |
EFFECTS OF NOT PROVIDING PERSONAL DATA
DLF collects Personal Data only to the extent necessary to fulfil the purposes outlined in this Privacy Policy, provide the Services to you, and comply with its obligations under Applicable Laws. Failure to provide the requisite Personal Data may result in certain features of the Platform or the Services being restricted, unavailable, or otherwise inaccessible. For instance, withholding your email address will not allow the relevant Operator to contact you and send you an update regarding your Service request.
DISCLOSURE TO THIRD PARTIES
We will share your Personal Data only on a need-to-know basis with the categories of Third Parties as listed in this Privacy Policy, including our Operators, associates, affiliates, vendors, and service providers, for the facilitation of Services. We will share your Personal Data with the following categories of Third Parties and for the purposes as described below:
| Party Type | Purpose of Disclosure |
|---|---|
| Third-party communication service providers | To facilitate the delivery of transactional and operational communications to users, including service updates, notifications, alerts, and other non-promotional messages relating to the Services |
| Third-party technology and infrastructure service providers | To support the technical infrastructure and operational functionality of the Platform for the purpose of enabling and administering the Services |
| Group companies and authorized Operators | To help provide Services to users |
| Law enforcement officials, government authorities | Where there is a duty to or permission to disclose Personal Data by law |
| Prospective seller or buyer of a business or assets | Where DLF or any of its group companies sell or buy any business or assets, Personal Data may be disclosed to the prospective seller or buyer of such business or assets |
HOW LONG DO WE RETAIN YOUR PERSONAL DATA
The Platform and Operators will retain your Personal Data only for as long as is necessary to fulfil the purpose for which it was collected or to provide a Service you have requested or for which you have given your consent, except where retention is otherwise necessary to comply with legal obligations under Applicable Laws (including in connection with pending litigation), to resolve disputes, or to enforce agreements. At the expiry of such periods, your Personal Data will be deleted in compliance with Applicable Laws. Upon expiry of the applicable retention period, or upon fulfilment of the purpose for which Personal Data was collected (whichever is earlier), and subject to any overriding legal or regulatory obligation, we shall ensure the secure destruction of such Personal Data. Our retention guidelines are applicable even when you are no longer using the Platform or availing the Services.
YOUR PRIVACY CONTROLS
We are committed to ensuring that you remain in control of the Personal Data we collect and how it is used. You may exercise the following privacy controls in relation to your Personal Data. When you are signed in to the Platform as a registered User, you may review, manage, or update your Personal Data through your Account settings. For example, you may edit your date of birth, alternative email address, and blood group. You may also reach out to the designated representative of the relevant club to request the modification or deletion of your Personal Data held by us, subject to verification and in accordance with Applicable Laws. All registered Users have the option to opt out of receiving notifications from the Platform. Please note that this opt-out may not apply to essential communications, including important notices and updates relating to the Services. Users may separately opt out of receiving promotional and marketing messages served by the Operators in accordance with Applicable Laws. Your device may have controls that determine what device-level information is shared with us. Please refer to your device manufacturer's instructions for further information on managing such settings. In addition, you have certain rights under Applicable Laws in relation to your Personal Data shared with us; for further information regarding the same, please refer to the "Your Rights" section below.
HOW DO WE KEEP YOUR DATA SECURE
The Platform, the Operators, and we have implemented reasonable physical, administrative, and technical safeguards to help protect your Personal Data from unauthorized access, use, and disclosure, which include:
- Storing Personal Data on secure cloud servers with appropriate firewalls.
- All Personal Data is encrypted during transit and at rest using Secure Sockets Layers (SSL) or TLS-based encryption, or equivalent industry-standard encryption protocols.
- Implementation of multi-factor authentication system to access your Account and Profile.
- Role-based access controls are implemented to limit Operator access to your Personal Data on a strict need-to-know basis, consistent with the purposes for which such Personal Data has been collected.
- Anti-malware and intrusion detection systems are utilised to guard against unauthorised access to our network.
- Wherever possible your Personal Data is anonymized or pseudonymized to uphold your privacy.
- Periodical review of our information collection, storage, and processing practices, including physical security measures, to prevent unauthorized access to our systems.
An incident response plan has been implemented to quickly respond to any suspected breach or compromise of Personal Data.
In addition, we have implemented necessary information security practices and certifications, including:
ISO/IEC 27001:2022: The Platform is certified under ISO/IEC 27001:2022, an internationally recognised standard for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).
SOC 2 Compliance: The Platform is SOC 2 compliant, in accordance with applicable trust service criteria for security, availability, processing integrity, confidentiality, and privacy.
You acknowledge that as a registered User on the Platform, you are responsible for maintaining the security of your Account, including your Account login credentials and passwords, and that you should not provide these credentials to any unauthorized person or Third Party. If it comes to your knowledge or if you have reason to believe that your Account credentials have been stolen or been made known to others, you must contact us immediately at grievance.hospitality@dlf.in. You acknowledge that you are responsible for all acts done using your Account login credentials. We are not responsible if someone else accesses your Account on account of your failure to maintain the security of your Account credentials. If we determine, at our sole discretion, that you are engaged in malicious activity on the Platform, such as privacy violations, illicit data mining, profiling, or the unauthorized transmission of User data, we shall block your access to the Platform and your Account may not be retrievable thereafter.
CHILDREN
If you are categorized as a child under Applicable Laws and use the Platform and the Services, then we shall presume that you are registered as a dependent by a registered Account holder on the Platform and are using the Platform and the Services only under the guidance and involvement of such registered Account holder (in such cases, a parent or legal guardian). Whenever a child uses the Platform, it shall be presumed that such use is under the guidance and supervision of the parent or legal guardian who registered them as a dependent user on the Platform. Please note that the Operators and we shall not be held liable for any misuse of the Platform or the Services by such child or for any use or access by such child that occurs outside the scope of the Platform.
COOKIE POLICY
DLF uses cookies and similar tracking technologies on the Platform to enhance your browsing experience, analyse Platform traffic, personalize content, and serve relevant advertisements. Cookies are small text files placed on your device that enable the Platform to recognize your browser and capture certain information relating to your usage patterns. For detailed information regarding the types of cookies used, the purposes for which they are deployed, the data collected through such cookies, and how you may manage or disable cookies, please refer to our Cookie Policy.
YOUR RIGHTS
Users have certain rights in relation to their Personal Data in accordance with Applicable Laws, which include:
- Right to Access: Users have the right to access Personal Data held by us, our processing activities, and the Third Parties with whom Personal Data has been shared, along with a description of such data.
- Right to Rectification: Users have the right to review, update, rectify, correct, or complete inaccurate Personal Data and ensure it is accurate, true, updated, and complete.
- Right to Erasure: Users have the right to request the erasure or deletion of their Personal Data.
- Right to Withdraw Consent: Users have the right to withdraw their consent for the processing of their Personal Data at any time, such withdrawal shall not affect the legality of processing carried out prior to such withdrawal.
- Right to Grievance Redressal: Users have the right to raise a grievance in accordance with the "Support and Grievances" section below.
- Right to Nominate: Users have the right to nominate another individual to act on their behalf in the event of death or incapacity.
- Right to Register Complaint: Users have the right to make a complaint with the Data Protection Board of India.
Users may exercise these rights by contacting us in accordance with the "Support and Grievances" section of this Policy. We will endeavor to respond to all legitimate requests within ninety (90) days from receipt of such request and may contact you for additional details in order to process your request. For your protection, we may require that the request be sent from the email address associated with your Account, and we may need to verify your identity before implementing your request.
TERMINATION
All Users may uninstall the Platform from their mobile devices at any time. However, please note that the deletion of the Account and Profile may be carried out by you through the user profile section on the Platform, or by us or authorized Operators, upon verification and confirmation that you are no longer a resident with us. Upon receiving or processing such a request, all Personal Data corresponding to the specific Account, including but not limited to Profile details and transactional data, will be deleted.
There may be scenarios where we are unable to execute Account deletion, such as where there exist outstanding disputes, transactions suspected to be fraudulent, or unresolved claims attached to your Account. Upon resolution of the obstruction preventing deletion, the relevant Personal Data is promptly deleted and cannot be retrieved thereafter.
Notwithstanding anything contained herein above, we may continue to retain certain Personal Data if deemed necessary for regulatory compliance, legitimate business interests such as fraud prevention, enhancing User safety and security, or to fulfil our legal and contractual obligations subject to Applicable Laws.
TERMS OF USE
Your use of the Platform is also governed by our Terms of Use. You are free to use the Platform only if you agree with our policies and practices encapsulated in this Privacy Policy read in conjunction with the Terms of Use.
MODIFICATION TO PRIVACY POLICY
DLF may update this Privacy Policy from time to time. DLF will notify you of any material changes by way of a pop-up notification on the Platform, prior to the change becoming effective, and will update the "Last Updated" date at the top of this Privacy Policy. We encourage you to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on the Platform. Unless stated otherwise, this Privacy Policy applies to all Personal Data that we hold about you.
SUPPORT AND GRIEVANCES
We support and encourage all Users to contact us for questions, concerns, or suggestions relating to our Terms of Use and this Privacy Policy or practices involving the usage of Personal Data. For any grievances or complaints, you may reach out to our designated Grievance Officer whose details are given below:
Name: Ms. Kanchan Mishra
Email: grievance.hospitality@dlf.in