Privacy Policy & DPDP Act 2023 Compliance
Effective Date: August 21, 2026 • Governs personal data processing, storage, and rights under Indian Law.
Chat contents are encrypted via Web Crypto API. Chat messages are never shared with organizers.
Granular, unbundled consents recorded in immutable audit logs with purpose-specific withdrawal rights.
Your personal contact and identity documents are never sold, rented, or monetized to third-party ad networks.
1. What We Collect
We collect and process the following categories of personal data:
- Identity & Contact Data: Name, verified 10-digit mobile number, email, date of birth, gender, and public display alias.
- Verification Data: Truecaller 1-Tap verification token status and/or Google Auth identifiers.
- Marketplace Activity Data: Pass listings, requirements, reviews, trade ratings, and perceptual ticket dHash watermarks.
- Technical & Security Data: IP address, browser user-agent, device metadata, and security audit logs used to detect fraud syndicates.
2. Why We Collect It (Processing Purposes)
Your personal data is processed solely for specified, lawful purposes:
- To verify user identity and prevent anonymous scalping or fraudulent ticket listings.
- To facilitate peer-to-peer matchmaking between buyers and sellers of Garba festival passes.
- To maintain platform trust, calculate Trust Scores, and administer the Trust & Safety Escalation Policy.
- To comply with applicable statutory obligations under Indian law.
3. Legal Basis & Segmented Consent
We process personal data based on your explicit, informed, and unbundled affirmative consent granted at specific action gates (onboarding, transacting, listing). Every consent grant is logged in public.consent_logs with an exact purpose key, timestamp, and version string.
6. Data Retention & Auto-Purge Schedules
To respect data minimization under Section 8(7) of the DPDP Act 2023, data is retained strictly as required:
- Active listings & transaction messages: Purged 30 days following festival completion (November 19, 2026).
- Audit logs & consent trails: Retained for statutory compliance up to 180 days, then irreversibly anonymized.
7. Your Rights under the DPDP Act 2023
As a Data Principal, you hold statutory rights including:
- Right to Access: View all personal data held about you in your Profile settings.
- Right to Correction & Erasure: Modify profile info or request account erasure.
- Right to Grievance Redressal: Direct escalation to our designated Grievance Officer.
- Right to Nominate: Designate an individual to exercise rights in the event of death/incapacity.
8. Grievance Redressal & Support Contact
Under the DPDP Act 2023, our grievance and data rights support team is reachable via our Grievance Redressal Portal or by emailing support@makemynavratri.com.