01 · Controller
Who is responsible
Utkal Institute of Hotel Management & Tourism (“UIHMT”, “we”) is the intended data controller for enquiries submitted through this website. Address: At-Debidwar (Near Biraja Temple), Unit-14, District Jajpur, PIN 755007, Odisha, India.
Review needed: confirm the legal entity name, controlling authority and an official privacy contact address.
02 · Information collected
Information we may collect
- Enquiry details you type: full name, email, phone number with country code, subject, category, course interest, preferred contact method and message.
- Consent status and the page from which the enquiry was prepared.
- Basic technical information typically processed by a web host, such as IP address, request time, user agent and referrer.
- Optional form-provider security data, such as spam scores, only if a provider is enabled.
This site does not ask for passwords, payment card numbers, Aadhaar numbers, passport scans, marksheets or other sensitive identity documents. Do not include them in the message field.
03 · Purpose & basis
Why information is used
Enquiry information is intended to respond to questions about courses, admissions, fees, campus visits and website corrections; to communicate using the method you choose; and to keep appropriate records of the enquiry.
Review needed: identify the lawful basis or consent model applicable to the institute, and explain any legitimate interests, contractual steps or legal obligations. Consent must be specific, informed and capable of withdrawal where required by law.
04 · Enquiry forms
How enquiry forms work
By default, this static website does not transmit or store your form contents on a server. After validation, it displays a clear “not sent” state and offers a real mailto: link, copy action and downloadable text file. If you use the email link, your own email provider processes the message.
A trusted HTTPS form endpoint can be configured later. Only then will the form attempt a network submission, and a success message is shown only when that service confirms receipt with {"ok":true}. See the deployment guide.
Client-side validation is a usability feature, not a security boundary. A production endpoint must validate, rate-limit and filter submissions server-side.
05 · Cookies & analytics
Cookies, local storage and analytics
This build installs no advertising trackers, analytics scripts, profiling cookies or marketing pixels by default. It does not use local storage for tracking. The optional Google Maps embed is a third-party service that may set cookies or process IP addresses according to Google’s policies.
Review needed: if analytics are added, choose a privacy-conscious configuration, disclose it here, and implement any consent banner required by applicable law.
06 · Third parties
Third-party services
- Website host/CDN: serves static files and may keep technical access logs.
- Google Maps: displays the contact-page map and processes requests when the iframe or optional Maps JavaScript API loads.
- Email client/provider: processes enquiries you choose to send with the generated mail link.
- Form provider or backend: processes submissions only if a documented endpoint is configured.
No third-party chat widget, advertising network, social pixel or remarketing tag is installed by default. External links are protected with noopener and noreferrer.
07 · Retention
How long data is kept
Policy to be supplied by the institution. A reasonable policy should define separate retention periods for unanswered enquiries, admission records, email correspondence, server logs and backups; state who approves deletion; and explain any legal retention obligations.
08 · Security
Security measures
The production site should use HTTPS, restricted administrator access, secure form endpoints, server-side validation, spam controls, encrypted backups and a documented patch process. Browser keys for Google Maps must be restricted by HTTP referrer and enabled only for required APIs.
No system can guarantee absolute security. Client-side JavaScript alone cannot securely store confidential enquiries or authenticate administrators.
09 · Your rights
Rights and choices
Depending on applicable law, you may be able to request access, correction, deletion, restriction, portability or withdrawal of consent, and to object to certain processing. You may also have the right to complain to a competent authority.
To make a request, contact the institute using the details below. The institute may need to verify your identity before acting. Legal review needed: confirm applicable rights, response timelines, exemptions and the official grievance process.
10 · Students under 18
Children and young applicants
Prospective hospitality students may be under 18. The institute should define when parent or guardian consent is required, how it is recorded, and what special safeguards apply to younger applicants' data.
11 · Transfers
International data transfers
Third-party email, hosting, form and mapping providers may process data outside India. The institute must identify actual providers, locations, transfer safeguards and contractual terms before adopting this policy.
12 · Changes
Changes to this policy
When this template becomes an approved policy, changes should include a clear effective date and a short explanation of material updates. The institute should keep prior versions for accountability.
13 · Contact
Privacy enquiries
Use the published email uihmt2020@gmail.com or the contact page to ask about personal data. A dedicated privacy officer or official postal contact should be added if required by law.
14 · Review checklist
Items requiring sign-off before launch
- Confirm the legal entity and authorised signatory.
- Verify actual hosting, email, form and map providers.
- Define retention periods and deletion workflow.
- Choose and document lawful bases and consent handling.
- Confirm children’s data safeguards and international transfers.
- Test the rights-request process and response timeline.
- Have qualified legal counsel review the final wording.