Maya Sojourns
Privacy & Data
How Maya Sojourns handles personal information, the legal bases it relies on, and the rights you hold over what we keep.
Maya Sojourns
How Maya Sojourns handles personal information, the legal bases it relies on, and the rights you hold over what we keep.
This notice explains what Maya Sojourns does with personal information, why, on what legal footing, and what you can require of us. It is written to satisfy Articles 13 and 14 of the General Data Protection Regulation and the notice duties of India's Digital Personal Data Protection Act 2023, and it is written to be read rather than to be survived.
Maya Sojourns designs and hosts private, tailor-made journeys, and operates from India. For the information described here we are the data controller, meaning we decide why it is held and what is done with it.
Maya Sojourns is a brand of Advita Novum OPC Private Limited, a company registered in India under CIN U49220AP2025OPC123041, with its registered office at Samikya Apartments 306, Green Industrial Zone, Gambheeram, Visakhapatnam 530052, India. Telephone +91 74165 04680.
Written correspondence about privacy reaches us at hello@mayasojourns.com.
Representative in the European Union under Article 27 to be appointed and named here.
Grievance officer for the purposes of the Digital Personal Data Protection Act 2023 to be named here.
This notice covers the website at mayasojourns.com and the correspondence that follows from it: enquiries, the advisor channel, Field Notes, and the planning conversation that comes after an Introduction. It applies wherever you are, because we hold everyone to the same standard rather than sorting visitors by passport.
Only what you hand us, and only what the conversation needs.
From An Introduction: your name, an email address, your country of residence, and what draws you to a sojourn in your own words. If you choose to answer the optional second step, also where you would like to go, the season, and who is travelling. Once your letter reaches us, we send one short receipt to the address you gave. It says only that the letter arrived and that the Custodian will reply, and it is the only automated message we send.
From the Contact form: your name, an email address, and your message.
From the Advisor Channel: your name and organisation, an email address, and the context of your enquiry.
From Field Notes: an email address, and a record that you asked to receive it.
From planning a sojourn, once a conversation is under way: travel dates, the people travelling with you, dietary needs, accessibility requirements, and the practical details a journey requires. Some of this can touch on health or belief. We ask for it only when it is needed to arrange something properly, we keep it to the people arranging that thing, and you are free to withhold any of it and accept that we will plan around the gap.
From the website itself: a record of which categories of storage you allowed, held anonymously, as described in the Cookie Policy. Our server also records a one-way cryptographic hash of the network address a form was sent from. It is not the address itself, cannot be reversed into one, exists only to stop automated abuse of the forms, and is discarded on the schedule in section 11.
We do not buy lists, we do not enrich what you give us from outside sources, and we do not build a profile of you from your behaviour.
Almost always from you, typed into a form or written in an email. Occasionally from an advisor or an existing guest who introduces you, in which case they give us your name and a way to reach you, and you will hear from us directly rather than being added to anything.
Every use below rests on a specific lawful basis, named so you can hold us to it.
| What we do | Why | Legal basis |
|---|---|---|
| Answer an Introduction or an enquiry | You asked us to, and the answer is the first step of a possible agreement | Steps taken at your request before entering a contract, GDPR Art 6(1)(b) |
| Plan and run a sojourn | It cannot be arranged without the details | Performance of a contract, Art 6(1)(b) |
| Arrange food, access or care around a health or belief need | You told us so the arrangement would suit you | Your explicit consent, Art 9(2)(a), on top of the contractual basis |
| Send Field Notes | You asked for it | Consent, Art 6(1)(a), withdrawable at any time |
| Keep the forms free of automated abuse | Otherwise the channel becomes unusable | Legitimate interests, Art 6(1)(f) |
| Keep a record that you consented | The law puts the burden of proving it on us | Legal obligation, Art 6(1)(c), with Art 7(1) |
| Keep financial records of a completed sojourn | Tax and accounting law requires it | Legal obligation, Art 6(1)(c) |
Where we rely on consent, it is asked for separately, never bundled into something else, and never assumed from silence. Sending an enquiry does not sign you up to anything: the only way onto Field Notes is to ask for it deliberately.
You can withdraw consent whenever you like, and it is no harder than giving it. Unsubscribe from any Field Notes dispatch, change your storage choices through , or tell us through Your Data. Withdrawing stops the thing going forward. It does not unwind what was lawfully done while the consent stood.
Only in two places: keeping the forms usable against automated abuse, and keeping our own records of correspondence so that a conversation picked up months later still makes sense. In both we weighed our interest against your privacy, kept the data minimal, and concluded a reasonable person would expect it. If you disagree in your case, object under section 14 and we will look again rather than reciting the policy back at you.
There are none. Every decision about whether a sojourn suits you is made by a person, in conversation. Nothing here is scored, ranked, or sorted by a machine.
Nobody, beyond what a journey physically requires.
We do not sell, rent, licence or trade personal information. We do not share it for advertising. We do not pass it to data brokers. There is no arrangement under which anyone pays us for access to our guests.
The people who do see it are the ones who have to: our web host, which stores the site and the correspondence it receives; our email provider; and, once a sojourn is agreed and only for that sojourn, the specific hosts, guides, custodians and properties involved, who receive the minimum needed to receive you properly. Each is bound to use it only as instructed.
Named list of processors, and their signed Article 28 agreements, to be confirmed.
We would also disclose information where the law compels it, such as a valid court order. If that ever happens we will tell you, unless telling you is itself unlawful.
Maya Sojourns operates from India. Its guests write from everywhere, so information does cross borders: what you send us is received, read and stored in India.
India has not been granted an adequacy decision by the European Commission. Personal information moving from the EU or EEA to India therefore needs a specific safeguard, ordinarily the Commission's Standard Contractual Clauses, together with an assessment of whether conditions in the receiving country undermine them in practice. We say this plainly rather than leaving it unsaid, because it is the part of this notice a European reader has most reason to care about.
The precise transfer mechanism for the India leg, and the accompanying transfer impact assessment, are being confirmed. A copy of the safeguards relied on will be provided on request.
Only as long as the reason for holding it lasts.
An enquiry that does not become a sojourn is kept for two years from the last exchange, because conversations here often resume after a long pause, and is then deleted.
Records of a sojourn that took place are kept for the period tax and accounting law requires, counted from the end of the financial year in which it completed.
A Field Notes subscription is kept until you unsubscribe, and the record of the unsubscribe is kept afterwards so we do not write to you again by accident.
Consent records are kept as long as the consent stands and for a period afterwards, because their purpose is to prove what was agreed and when.
The hashed form-submission address is kept for ninety days and then removed.
These periods are proposed and subject to confirmation. Where you ask for erasure we act sooner, as described below.
The site is served over an encrypted connection. Correspondence sits in a store that is not reachable from the web and is protected at the server level as well as by its own access rules. The administrative tool that can read or erase a person's records requires a separate credential and writes down every action taken through it, so any access can be reconstructed afterwards. Access is limited to the people who need it.
No system is perfect. If a breach ever occurs that is likely to put your rights at risk, we will tell the relevant supervisory authority within seventy two hours and tell you without undue delay, in plain language, including what we know and what we are doing about it.
This site is not directed at children and we do not knowingly collect information about anyone under sixteen through it. Where a child travels as part of a family sojourn we hold only what the arrangement requires, provided by the accompanying adult. If you believe we hold a child's information that we should not, write to us and it will be removed.
These are yours by law, not by our permission. Exercising any of them is free, and never counts against you.
You may ask what we hold about you and receive a copy of it, along with the explanation of why we hold it and who has seen it. GDPR Article 15.
You may have anything inaccurate corrected, and anything incomplete completed. Article 16.
You may ask us to delete what we hold. We will, unless a specific law requires us to keep a particular record, such as the financial trace of a completed sojourn. Where something must be kept we will say exactly what, and why, and delete the rest. Article 17.
You may ask us to stop using something while a dispute about its accuracy or our basis for holding it is resolved. We keep it, but leave it alone. Article 18.
You may object to anything we do on the basis of legitimate interests, and we stop unless we can show compelling grounds that override your interests. Against direct marketing there is no balancing at all: you object, we stop. Article 21.
You may have what you gave us in a structured, machine-readable form, to keep or to pass to someone else. Article 20.
Whenever you like, as easily as you gave it. Article 7(3).
If the Digital Personal Data Protection Act 2023 applies to you, it gives you comparable rights of access, correction, erasure and grievance redressal, together with the ability to nominate someone to act for you.
Use Your Data, which walks through it, or write to hello@mayasojourns.com.
We will ask you to confirm the request from the email address the records are held under, by clicking a link we send there. That is the whole of the identity check. We ask for it because handing someone's correspondence to a stranger who typed their address would be the worse failure, and we deliberately do not ask for passports or identity documents, since collecting more information in order to protect information makes no sense.
You will have an answer within one month. If a request is genuinely complex we may take up to two further months, and if so we will tell you inside the first month and explain why.
If we have handled something badly, tell us first and we will try to put it right. That is not a precondition for anything.
You may complain to a data protection supervisory authority at any time. In the EU or EEA, to the authority in the country where you live, where you work, or where the problem happened. In India, to the Data Protection Board.
Lead supervisory authority to be named once the European representative is appointed.
When it changes materially we raise the version number, change the date at the top, and where the change affects something you consented to we ask you again rather than relying on the old answer. Past versions are available on request.
Covered in full by the Cookie Policy, including the complete list of what this site stores. The short version is that no cookies are set, nothing is sent to any other company, and the three stored values are listed there by name.