Who We Are
Resell Holidays is a service provided by Nattar Innovators LLP, registered under the Limited Liability Partnership Act, 2008. We operate the platform at www.resellholidays.com, which helps pre-owned holiday membership holders (Club Mahindra Holidays, Sterling Holidays) find buyers through our Assisted Resell Service.
2nd Floor, 7th Cross, North East Extension, Trichy – 620018, Tamil Nadu, India
📞 76 0380 0484 | ✉ support@resellholidays.com
For all privacy-related queries, you may contact our team at support@resellholidays.com. We will respond within 7 business days.
What Data We Collect
We collect only the data necessary to provide our Assisted Resell Service. The categories of data we collect are:
| Category | Data Points | Purpose |
|---|---|---|
| Identity | First name, membership name | To identify you and your membership |
| Contact | Mobile number, email address, alternate contact, postal address | OTP login, mandate delivery, transfer updates |
| Membership | Membership type, category, membership number, expiry date, balance years/weeks, maintenance status | Valuation calculation, buyer matching |
| Financial | Agreed selling price, estimated value, ASF dues status | Transaction processing, payment |
| Technical | IP address, submission timestamp, session data, browser type | Security, fraud prevention, audit trail |
| Behavioural | Pages visited, time spent, actions taken on site | Service improvement, analytics |
We do not collect Aadhaar numbers, PAN numbers, bank account details, biometric data, or other sensitive information through the online valuation or seller mandate forms. Where such information is reasonably required for membership verification, the official transfer process, or payment to the seller, it may be collected separately and handled with appropriate confidentiality and security safeguards.
How We Collect Your Data
We collect your data through the following means:
- OTP Login Form: Your mobile number is collected when you initiate the OTP-based login process
- Valuation Form: Membership details, name, category, expiry, and maintenance status are collected when you submit the valuation form
- Mandate Form: Email address, membership number, address, and alternate contact are collected when you sign the seller mandate
- Automatically: IP address, session data, and browser information are captured automatically when you visit our website
- Communications: If you contact us via email or phone, we retain those communications for support and audit purposes
How We Use Your Data
Your data is used strictly for the purposes for which it was collected:
- OTP verification: To authenticate your identity before accessing the valuation form
- Valuation: To calculate the estimated market value of your holiday membership
- Buyer matching: To identify suitable buyers for your membership category and price range
- Mandate processing: To record your consent and the terms of the sale agreement
- Transfer coordination: To communicate with you and coordinate the online name transfer process
- Payment processing: To confirm your bank details and process payment after transfer completion
- Legal compliance: To maintain transaction records as required by Indian law
- Service improvement: Aggregated, anonymised usage data helps us improve our platform
Data Storage & Security
Your data is stored on secure servers hosted by Hostinger, located within their global infrastructure. We implement the following security measures to protect your data:
- Encrypted transmission: All data between your browser and our server is transmitted over HTTPS (TLS encryption)
- OTP security: One-time passwords are hashed using bcrypt before storage and are never stored in plain text
- Session protection: Login sessions expire after 30 minutes of inactivity
- CSRF protection: All forms are protected against Cross-Site Request Forgery attacks
- Prepared statements: All database queries use PDO prepared statements to prevent SQL injection
- Access control: Database access is restricted to authorised team members only
- Rate limiting: OTP requests are rate-limited to 3 per 10 minutes per mobile number to prevent abuse
Data Retention
We retain your data for as long as necessary to fulfil the purpose for which it was collected, and to comply with applicable legal obligations:
- OTP session data: Deleted immediately after session expires (30 minutes)
- Valuation records: Retained for 3 years from the date of submission for audit purposes
- Mandate records: Retained for as long as reasonably necessary for transaction administration, record-keeping, dispute resolution, and compliance with applicable legal obligations
- Completed transaction records: Retained for the period reasonably necessary to meet applicable tax, accounting, contractual, record-keeping, and other legal requirements
- Incomplete or withdrawn mandates: Retained for 1 year then securely deleted
After the applicable retention period, your data is securely deleted or anonymised so that it can no longer be linked to you.
Your Rights
Subject to applicable law, including the Digital Personal Data Protection Act, 2023 and the rules thereunder as and when applicable, you may have rights regarding your personal data, including the following:
- Right to access: You may request a copy of the personal data we hold about you
- Right to correction: You may request correction of inaccurate or incomplete data
- Right to erasure: You may request deletion of your data, subject to our legal retention obligations
- Right to withdraw consent: You may withdraw your consent to data processing at any time — this does not affect the lawfulness of processing before withdrawal
- Right to grievance redressal: You may raise a complaint about how we handle your data
Please note that certain rights may be limited where we are required to retain data by law, or where deletion would affect our ability to complete a transaction you initiated.
Cookies
Our platform uses a small number of essential cookies and browser session storage to function correctly:
- PHP Session cookie: Used to maintain your login state after OTP verification. Expires when you close your browser or after 30 minutes of inactivity
We may use analytics and advertising measurement technologies, such as Google Analytics or Google Ads conversion tracking, to understand website usage, measure campaign performance and improve our service. We do not use membership details, documents, selling price or other transaction information for advertising profiling.
Our main WordPress website (www.resellholidays.com) may use standard WordPress cookies for its functionality. These are separate from the sell platform and do not affect your privacy in relation to the resale service.
Children's Privacy
Our services are intended for adults aged 18 years and above only. We do not knowingly collect personal data from children under 18.
If you believe a minor has submitted data through our platform without parental consent, please contact us immediately at support@resellholidays.com and we will promptly delete the data.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Display a notice on our website for 30 days after a material change
- Where feasible, notify registered users via their mobile number or email
Your continued use of our service after any update to this policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically.
The current version of this policy is always available at www.resellholidays.com/privacy-policy/
Contact for Privacy Queries
If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us through any of the following:
- Email: support@resellholidays.com (subject: "Privacy Request")
- Phone: 76 0380 0484 (Monday to Saturday, 10 AM – 6 PM IST)
- Post: Nattar Innovators LLP, 2nd Floor, 7th Cross, North East Extension, Trichy – 620018
We are committed to resolving privacy concerns promptly and fairly. Where applicable under law, if you are not satisfied with our response, you may pursue the grievance or complaint mechanisms available under applicable data protection law.
Privacy Questions?
We take your privacy seriously. Reach out and we'll respond within 7 business days.