Privacy Policy

This policy explains how NaatyaBhoomi collects, uses and protects your personal data, and the rights you have over it. It is written to comply with the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

Who we are

NaatyaBhoomi.com (“we”, “us”) is the Data Fiduciary for personal data processed through this website. It is founded and curated by Mridula Sriram, Bengaluru, India. For any question about your personal data, write to contact.naatyabhoomi@gmail.com, our designated contact for data protection questions.

What we collect, and why

• Bookings: name, email address, phone number and seat selections — used to process your ticket order, deliver tickets by email, contact you about show changes, and maintain attendance records.
• Payments: handled entirely by Razorpay. Card and banking details never touch our servers. We store only the payment reference id and amount.
• Sign-in (optional): if you sign in with Google, we store your name, email and profile picture to recognise your account.
• Community forum: your display name and posts/replies, published publicly on the basis of the consent you give when posting.
• Contact form: name, email and message, used only to respond to your enquiry.
• Food pre-orders: name, email, optional phone, seat numbers and the items you ordered, used to pass your order to the stall and confirm your pickup code. No payment data: you pay the stall directly.
• Reviews and feedback: star rating, comment and an optional display name. Published only after moderation. If you ask for a follow-up we also store your email, never shown publicly.
• Festival frame: nothing is collected or uploaded. Photos and videos are captured, badged and shared entirely on your device.
• Workshop interest: name, email and optional phone, experience level and city, kept solely to contact you about the Humour Theatre workshop when dates, venue and fees are announced.
• Carpool board: for verified ticket holders, your area, departure window and seat count appear publicly without your name. Contact details are shared with another participant only after both of you approve an exchange by email; a decline shares nothing in either direction.
• Basic usage data: pages visited and device type, in aggregate, to keep the site working and improve it.

We process booking and payment data to perform the contract you enter when buying a ticket. Everything else rests on your consent, which you may withdraw at any time (see below). We do not sell your personal data or use it for targeted advertising.

Service providers

We share the minimum data necessary with these processors, each bound by contractual confidentiality obligations: Razorpay (payments), Supabase (database hosting, servers in India/US), Vercel Inc. (website hosting, US), Resend (ticket emails) and Google (optional sign-in). Where data leaves India, transfers are made to providers offering protections no weaker than those required under the DPDP Act.

How long we keep data

• Paid bookings: retained as financial records, anonymised on request.
• Expired or failed bookings: deleted after 12 months.
• Contact enquiries: deleted after 24 months.
• Community posts: until you ask us to remove them.
• Sign-in accounts: until you ask us to delete them.
• Food pre-orders: deleted 90 days after the festival.
• Reviews and feedback: deleted after 24 months; unpublished drafts on request.
• Workshop interest: deleted 12 months after the workshop is announced if you do not register, or on request any time.
• Carpool listings and exchange requests: deleted 30 days after the last show.

Your rights

You may, at any time:

• Access a summary of the personal data we hold about you and how we use it;
• Correct or complete inaccurate or incomplete data;
• Erase your data, unless we must keep it for legal purposes (paid booking records are kept as anonymised financial evidence);
• Grieve, that is, raise a complaint about how we handle your data;
• Nominate another individual to exercise these rights on your behalf.

Exercising your rights

Email contact.naatyabhoomi@gmail.com with the subject line “[Privacy Request]”, describing what you would like done. We will acknowledge within 72 hours and respond fully within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India once established under the DPDP Act.

Children

The community forum is restricted to users aged 18 or above, confirmed at the point of posting. Ticket purchases by persons under 18 should be made by a parent or guardian. We do not knowingly process children’s data for any tracking, behavioural monitoring or targeted advertising, and we never will.

Withdrawal of consent and deletion

Where we rely on consent (community posting, sign-in, contact form), you can withdraw it at any time using the contact above; withdrawal does not affect processing already completed. After withdrawal we stop the relevant processing and delete the data per the retention table above.

Security and breach notification

We apply reasonable security safeguards including encrypted transport, signature-verified payments, access tokens on ticket pages, least-privilege database rules and rate limiting. If a personal data breach occurs, we will intimate affected users and the Data Protection Board of India without undue delay as required by law.

Changes to this policy

Material changes will be announced on this page with a new “last updated” date. The date above always reflects the current version.