Privacy Policy

1 Legal Framework

This Privacy Policy is prepared in compliance with the following Indian laws and regulations:

2 Who We Are — Data Fiduciary

This Policy applies to all users of FestBooking — Customers (event bookers), Vendors (service providers), and visitors to our website. It covers data collected through our website (festbooking.in), vendor dashboard, customer portal, and any related mobile applications.

3 Personal Data We Collect

3.1 Data Provided by Customers

3.2 Data Provided by Vendors

3.3 Automatically Collected Data

When you visit our website, we automatically collect:

• IP address and approximate location derived from IP
• Browser type, version, and language preference
• Pages visited, time spent, click patterns, and referral source
• Device type, operating system, and screen resolution
• Cookie identifiers (see Section 8)

4 How We Use Your Data

5 Legal Basis for Processing

We process your personal data on the following legal grounds:

• Consent (Section 6, DPDP Act 2023): For account creation, marketing communications, location access, and cookie placement. You may withdraw consent at any time — withdrawal does not affect processing done before withdrawal.
• Contractual necessity: Processing necessary to fulfil the booking service contract between us, or between Vendor and Customer.
• Legal obligation (Section 7(b), DPDP Act 2023): KYC, TDS, GST compliance, responding to court orders, law enforcement requests.
• Legitimate uses (Section 7, DPDP Act 2023): Fraud prevention, security monitoring, platform analytics (using aggregated/anonymised data).
• Vital interest: In rare emergencies where processing is necessary to protect life.

Where we rely on consent, you will be presented a clear, specific, and informed consent notice before data collection. Consent is recorded with timestamp, version of notice, and the specific data category consented to.

6 Sensitive Personal Data or Information (SPDI)

The following categories of data collected by FestBooking qualify as SPDI under the IT Rules, 2011:

• Financial information: Bank account numbers, IFSC codes, UPI IDs, payment card details (masked)
• Biometric data: Photographs used in Aadhaar/PAN verification
• Identity documents: Aadhaar number (stored as last 4 digits only after verification), PAN number
• Location data: Precise GPS coordinates (only with explicit consent)

For SPDI, we implement additional safeguards:

• Collection only with explicit prior written consent
• Stored with AES-256 encryption at rest
• Access restricted to authorised personnel on a need-to-know basis
• Never transferred to third parties without explicit consent, except where required by law
• Deleted upon account closure (subject to statutory retention requirements)

7 Aadhaar & KYC Data

7.1 What We Collect and Why

For vendor KYC verification (mandatory under PMLA 2002 and RBI KYC Master Directions 2016), we collect a photograph of the Aadhaar card and PAN card. This is for offline visual identity verification only — we are NOT an Aadhaar Authentication Agency and do NOT use UIDAI's authentication API.

7.2 What We Do NOT Do With Aadhaar

• We do NOT store the full 12-digit Aadhaar number in our database
• We do NOT use Aadhaar for biometric authentication
• We do NOT share Aadhaar images or numbers with any third party (except as required by law enforcement with valid court order)
• We do NOT use Aadhaar for any purpose other than KYC verification of vendors

7.3 Masking and Storage

Upon verification of the Aadhaar card photo, we redact the first 8 digits and store only the last 4 digits (e.g., XXXX-XXXX-4321) as a reference. The original Aadhaar card photograph is encrypted and stored in a separately secured data store with restricted access.

8 Cookies & Tracking Technologies

8.1 Types of Cookies We Use

8.2 Local Storage

In addition to cookies, we use browser localStorage to maintain session data (e.g., booking in progress, selected vendors, location consent) within your browser session. This data is not transmitted to our servers unless you actively proceed with a booking.

8.3 Managing Cookies

You can manage cookie preferences at any time through your browser settings. Note that disabling strictly necessary cookies will prevent login and booking functionality. You may also use your browser's private/incognito mode to browse without persistent cookies.

9 Sharing & Disclosure of Personal Data

9.1 Sharing Within the Platform

When a Customer makes a booking, the following data is shared with the relevant Vendor:

• Customer name and mobile number (for coordination only)
• Event date, location, and service requirements
• Booking confirmation ID

Vendors are contractually prohibited from using this data for any purpose other than delivering the booked service.

9.2 Third-Party Service Providers (Data Processors)

All Data Processors are bound by data processing agreements ensuring DPDP Act 2023 compliance.

9.3 Legal Disclosures

We may disclose personal data without your prior consent when required by:

• A valid court order or judicial warrant under the Code of Criminal Procedure, 1973
• A government direction under Section 69 of the IT Act, 2000 (national security / public order)
• Tax authorities under the Income Tax Act, 1961 or GST laws
• The Enforcement Directorate or Financial Intelligence Unit under PMLA, 2002
• Any other competent authority under applicable Indian law

We will attempt to notify you of such disclosure to the extent permitted by law.

9.4 Cross-Border Data Transfers

10 Data Localisation

In compliance with the Reserve Bank of India's circular on "Storage of Payment System Data" (6 April 2018) and the DPDP Act 2023:

• All payment data (UPI transaction IDs, payment references, bank account details) of Indian users is stored exclusively on servers located within India.
• All personal data of Indian users processed through FestBooking is stored within the territory of India.
• Our cloud hosting infrastructure is hosted on India-region data centres.
• Any international system used for analytics or communication receives only anonymised or pseudonymised data with no personally identifiable information.

11 Data Retention

After the retention period expires, personal data is securely deleted or irreversibly anonymised. Anonymised/aggregated data may be retained indefinitely for statistical purposes.

12 Security Measures

We implement the following security safeguards to protect your personal data:

• Encryption in transit: All data transmitted between your device and our servers uses TLS 1.2 / 1.3 (HTTPS). HTTP access is permanently redirected to HTTPS.
• Encryption at rest: All databases and file storage containing personal/SPDI data use AES-256 encryption.
• Access controls: Role-based access control (RBAC) — employees access only the minimum data necessary for their role. All admin access is logged.
• Password security: User passwords are stored as salted bcrypt hashes (cost factor ≥ 12). Plain-text passwords are never stored.
• Two-factor authentication: Available for all vendor and admin accounts (OTP-based).
• Vulnerability management: Regular OWASP Top 10 security reviews, dependency audits, and penetration testing.
• Data backup: Daily encrypted backups with geographically separate storage within India.
• Employee training: All personnel handling personal data are trained on data protection obligations under DPDP Act 2023 and SPDI Rules 2011.
• Vendor/processor audits: Third-party Data Processors are audited for security compliance annually.
• Incident response plan: Documented procedure for detecting, containing, and reporting data breaches (see Section 16).

13 Children's Privacy

FestBooking is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals below 18 years of age without verifiable parental or guardian consent.

If you are a parent or guardian and you believe your child has provided personal data on our Platform without consent, please contact us immediately at privacy@festbooking.in. We will promptly delete such data upon verification.

We do not engage in behavioural tracking, targeted advertising, or profiling of any user below 18 years of age, in compliance with Section 9 of the DPDP Act 2023.

14 Your Rights as a Data Principal

How to Exercise Your Rights

To exercise any of the above rights, submit a written request to our Data Protection Officer at dpo@festbooking.in or use the Privacy Settings in your account dashboard. We will respond within 30 days of receiving your request. We may verify your identity before processing the request. Requests are free of charge for up to 2 requests per year per user.

15 Grievance Redressal

16 Data Breach Notification

In the event of a personal data breach that is likely to result in harm to Data Principals, FestBooking will:

• Notify the Data Protection Board of India within the timeframe prescribed by the Board's rules (currently being notified under DPDP Act 2023).
• Notify affected users via email and/or SMS to their registered contact details without undue delay.
• The notification will include: nature of the breach, categories and approximate number of individuals affected, likely consequences, measures taken or proposed to address the breach, and contact information for more details.
• Maintain a breach register documenting all incidents (including those not meeting the notification threshold) for internal accountability.

We also maintain cyber insurance in compliance with best practices for digital platforms.

17 Third-Party Links & Embedded Content

Our website may contain links to third-party websites (e.g., payment gateways, social media pages, government portals). Clicking such links takes you to a website governed by that third party's privacy policy, not ours.

We are not responsible for the privacy practices, content, or security of any third-party website. We recommend you review the privacy policy of any external site before providing personal data to it.

Embedded content from third parties (such as maps, social share buttons, or videos) may collect your IP address and set cookies independently. Such processing is governed by the respective third party's privacy policy.

18 Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes:

• We will update the "Last Updated" date at the top of this Policy.
• We will notify registered users via email to their registered address at least 14 days before the change takes effect.
• For significant changes affecting your rights, we will seek fresh consent as required under the DPDP Act 2023.
• Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

Previous versions of this Policy are archived and available upon request from privacy@festbooking.in.

19 Contact Us & Data Protection Officer

For any privacy-related queries, requests, or complaints, you may contact us through any of the following channels: