PRIVACY POLICY

1. ABOUT THIS PRIVACY POLICY

Data Fiduciary

For Personal Data processed by us to operate the Services, Vyavastha is generally the Data Fiduciary under the Digital Personal Data Protection Act, 2023 and applicable rules made under it (the “DPDP Law”). This means that we determine the purposes and means for which such Personal Data is processed.

A Vendor may independently process information received from us for fulfilling an enquiry, quotation, or booking. The Vendor may have separate legal responsibilities for such processing. We require Vendors to use customer information only for legitimate marketplace and service-fulfilment purposes and in accordance with their legal obligations.

Definitions

• Client or Customer: an individual who uses the Services to discover, enquire about, compare, or book event-related services.
• Vendor: an independent event-service provider listing or offering services through Vyavastha.
• Personal Data: any data about an individual who is identifiable by or in relation to that data.
• Processing: an operation performed on Personal Data, including collection, storage, use, disclosure, sharing, updating, or deletion.
• Data Principal: the individual to whom Personal Data relates.
• Service Provider: a third party that processes information for or on behalf of Vyavastha to help provide the Services.

2. INFORMATION WE COLLECT

Account and Contact Information

• Name, email address, mobile number, profile image, and account identifiers.
• Authentication and verification information, including OTP status, login information, Google sign-in identifiers where you choose Google sign-in, and security events.
• Information you provide when contacting customer support or communicating with us.

Event and Booking Information

• Event type, event date, guest count, budget, event location, venue information, requirements, preferences, and service details.
• Enquiries, quotations, booking details, cancellation requests, refund requests, complaints, and transaction-related communications.
• Saved vendors, favourites, reviews, ratings, messages, and other information you submit through the Services.

Location Information

If you choose to use a location-based feature, such as finding nearby Vendors, selecting a venue location, using a map, or providing an event address, we may process the address, city, state, pincode, and location coordinates you provide. We request device-location permission only where the relevant feature requires it. You may disable device-location permission through your device or browser settings.

Payment and Transaction Information

When you make a payment, we may receive transaction information such as payment status, amount, currency, order or booking identifiers, refund status, and payment-method type from our payment service provider. Payment card, bank-account, UPI, or other sensitive payment credentials may be processed directly by the payment provider and may not be stored by Vyavastha in full.

Device and Usage Information

• IP address, browser type, device type, operating system, app version, language, and approximate location derived from technical information.
• Pages, screens, features, links, and content viewed or used.
• Access times, session information, crash reports, diagnostic information, and security logs.
• Cookies, device identifiers, and similar technologies, subject to applicable law and your choices.

Images and User-Submitted Content

If you upload a profile image, event reference image, review image, or other content, we may collect and process that content. Please do not upload identity documents, financial information, confidential information, or photographs of identifiable individuals unless you have the necessary permission and the upload feature specifically requests it.

Information from Other Sources

We may receive information from Vendors, payment providers, authentication providers, email or OTP providers, mapping providers, fraud-prevention providers, customer-support providers, and other service providers when necessary to operate the Services.

3. HOW WE USE YOUR INFORMATION

We process Personal Data only for specified, clear, and legitimate purposes connected with the Services, including the following:

• Account management: to create, verify, authenticate, maintain, secure, and support your customer account.
• Service discovery: to show relevant Vendors, event services, packages, locations, availability, prices, ratings, and reviews.
• Enquiries and quotations: to forward your enquiry and relevant requirements to selected Vendors and help them respond.
• Bookings: to create and manage bookings, confirmations, cancellations, refunds, invoices, notifications, and related records.
• Payments: to process booking advances, payments, refunds, and transaction reconciliation through authorised payment providers.
• Communications: to send OTPs, account alerts, booking updates, payment updates, support replies, service notices, and security notifications.
• Customer support: to respond to requests, investigate complaints, resolve disputes, and provide assistance.
• Safety and fraud prevention: to detect, prevent, investigate, and respond to fraud, abuse, spam, unauthorised activity, security events, and violations of our Terms.
• Service improvement: to monitor performance, troubleshoot errors, improve user experience, analyse usage, and develop new features.
• Legal compliance: to comply with applicable laws, tax requirements, court orders, regulatory requests, and lawful government directions.
• Marketing and recommendations: to send promotional communication or provide personalised recommendations where permitted and where any required consent has been obtained.

4. LEGAL BASES AND CONSENT

Consent

Where we rely on your consent, we will provide a clear notice describing the Personal Data and specified purpose involved. Consent should be voluntary, specific, informed, and unambiguous. You may withdraw consent using the method provided in the relevant notice, through available account controls, or by contacting us.

Withdrawal of consent will not affect processing carried out before withdrawal. If you withdraw consent that is necessary for a particular feature, we may no longer be able to provide that feature. We will not make the withdrawal process unnecessarily difficult compared with the process used to provide consent.

Other Permitted Grounds

Depending on the circumstances and applicable law, we may process Personal Data where necessary to provide a service requested by you, perform or administer a contract or transaction, respond to your request, comply with a legal obligation, protect the Services and users, prevent fraud or abuse, or pursue another lawful purpose recognised by applicable law.

Separate Notices

We may provide an additional short notice at the point of collection—for example, during account registration, enquiry submission, payment, location use, photo upload, or marketing opt-in. That notice forms part of the information provided to you about the relevant processing activity.

5. HOW WE SHARE YOUR INFORMATION

Sharing with Selected Vendors

When you submit an enquiry, request a quotation, contact a Vendor, request a callback, or make a booking, we may share information reasonably necessary for that Vendor to respond to and fulfil your request. This may include your name, mobile number, event date, event type, location, guest count, budget range, requirements, and relevant enquiry or booking information.

You should understand that a Vendor may contact you directly regarding the enquiry or booking. Vendors must handle the information they receive in accordance with applicable law and our contractual or platform requirements.

Public Information

Information that you choose to post publicly, such as a display name, rating, review, profile image, or other public contribution, may be visible to other users and may be copied or shared by them. Do not post information that you want to keep private.

Legal and Business Disclosures

• Service providers: hosting, databases, media storage, image delivery, email, SMS, OTP, maps, analytics, payments, support, security, and other providers that help us operate the Services.
• Legal requirements: courts, law-enforcement agencies, regulators, tax authorities, or government authorities where disclosure is required or legally permitted.
• Protection of rights: advisers, insurers, investigators, or relevant authorities where reasonably necessary to protect users, the public, Vyavastha, or our legal rights.
• Corporate transactions: a successor, purchaser, investor, or professional adviser in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to applicable law.

6. VENDORS AND THIRD-PARTY SERVICES

We may use third-party providers to process Personal Data on our behalf. Depending on the features you use, these may include hosting and database providers, Cloudinary or another media-storage provider, Google Maps or another mapping provider, email/SMS/OTP providers, Google sign-in, payment gateways such as Razorpay, analytics providers, customer-support tools, fraud-prevention tools, and infrastructure providers such as Vercel, Hostinger, or other providers actually used by Vyavastha.

The providers actually used may change as our Services develop. We aim to share only the information reasonably necessary for the provider to perform its function and require appropriate confidentiality and security obligations where appropriate.

Please replace the examples above with the actual providers used by the production application. Do not list a provider that does not process customer information for Vyavastha.

7. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to operate the Services, maintain sessions, remember preferences, protect accounts, prevent fraud, measure performance, and understand how the Services are used.

Types of Technologies

• Strictly necessary technologies: required for login, authentication, security, session management, load balancing, and core features.
• Functional technologies: used to remember choices and improve features such as language, location, or preferences.
• Analytics technologies: used to understand usage, performance, errors, and product improvement.
• Marketing technologies: used for promotional measurement or personalised advertising only where permitted and where required consent has been obtained.

Where required by law, non-essential cookies or similar technologies will be used only after consent. You may manage cookies through our cookie controls, your browser, or device settings. Some features may not function correctly if strictly necessary technologies are disabled.

Please publish a separate Cookie Policy if the Services use analytics, advertising, pixels, or other non-essential tracking technologies.

8. PAYMENTS AND TRANSACTIONS

Payments may be processed through authorised third-party payment providers. We may share information necessary to initiate, authenticate, complete, reconcile, refund, or dispute a transaction, including your name, contact information, booking identifier, amount, currency, and transaction details.

We do not intend to store complete payment-card numbers, card security codes, or complete banking credentials unless expressly stated in a separate notice. Such information is generally collected and processed by the relevant payment provider under its own privacy policy and security controls.

Payment records, invoices, refunds, chargebacks, and transaction information may be retained for accounting, tax, fraud prevention, dispute resolution, and legal compliance.

9. USER CONTENT, REVIEWS, AND IMAGES

Your Content

You may be able to submit reviews, ratings, messages, profile information, event references, photographs, or other content through the Services. You remain responsible for ensuring that you have the rights, permissions, and consents necessary to upload or share that content.

Public Reviews and Contributions

Content that you choose to publish publicly may be displayed to other users. Please avoid including private contact details, identity documents, financial information, health information, or information about another person without permission.

Licence to Operate the Services

You grant Vyavastha a non-exclusive, worldwide, royalty-free licence to host, store, reproduce, format, resize, optimise, display, moderate, and distribute your submitted content only as reasonably necessary to operate, promote, secure, and improve the Services, subject to our Terms and applicable law.

For images displayed in public marketplace listings, we may apply technical transformations such as resizing, compression, format conversion, or a Vyavastha watermark. This does not transfer ownership of your content to Vyavastha.

Removal of Content

We may restrict, remove, or disable content that violates our Terms, infringes rights, contains unlawful or harmful material, exposes another person’s Personal Data, or creates a security, privacy, fraud, or legal risk.

10. DATA SECURITY

We use reasonable technical and organisational safeguards designed to protect Personal Data against unauthorised access, use, alteration, disclosure, loss, misuse, or destruction. These safeguards may include access controls, authentication controls, HTTPS/TLS where supported, restricted access, logging, monitoring, backups, vulnerability management, and service-provider security measures.

No website, application, network, or storage system is completely secure. You are responsible for keeping passwords, OTPs, and account credentials confidential and for notifying us promptly if you suspect unauthorised access.

We do not promise that the Services will be immune from every security incident. If a Personal Data breach occurs, we will take steps required by applicable law, including appropriate investigation, containment, remediation, and notifications where required.

11. DATA RETENTION AND DELETION

We retain Personal Data only for as long as reasonably necessary for the purposes described in this Policy, including account administration, bookings, payment and tax records, customer support, fraud prevention, dispute resolution, enforcement of agreements, security, and legal compliance.

Different Retention Periods

Retention periods depend on the type and purpose of the information. Account information may be retained while your account remains active. Booking, payment, tax, complaint, and dispute records may be retained for longer where required by law or reasonably necessary to establish, exercise, or defend legal claims.

When Personal Data is no longer required, we may delete it, anonymise it, or aggregate it. Information may remain temporarily in encrypted backups until those backups are securely overwritten according to our backup cycle.

Account Deletion

You may request account deletion by contacting us at support@vyavastha.in or through [ACCOUNT SETTINGS / PRIVACY REQUEST LINK]. Deleting your account may not immediately delete information that we must retain by law, information required for an active or completed booking, transaction records, dispute records, fraud-prevention records, or information lawfully held by another party.

12. CROSS-BORDER PROCESSING

Some service providers may store or process Personal Data outside India. Where cross-border processing occurs, we will take reasonable steps to use appropriate contractual, technical, and organisational safeguards and comply with applicable Indian law and restrictions notified by the Government of India.

The location of processing may change as we change infrastructure or service providers. We will update our notices or provider information where required.

13. YOUR RIGHTS AND CHOICES

Subject to applicable law, identity verification, and any lawful limitations, you may have the right to request information about Personal Data processed by us, correction of inaccurate or incomplete information, erasure where the information is no longer necessary or where otherwise permitted, withdrawal of consent, grievance redressal, and nomination of another individual in circumstances recognised by applicable law.

How to Make a Request

Send your request to support@vyavastha.in or use [ACCOUNT SETTINGS / PRIVACY REQUEST LINK]. Please describe your request clearly and provide enough information for us to identify your account safely. We may need to verify your identity before fulfilling a request.

We may refuse, limit, or defer a request where permitted or required by law, including where fulfilling it would affect the rights of another person, compromise security, interfere with fraud prevention, or require retention of records.

If you are dissatisfied with our response, you may use our grievance process and, where applicable, escalate the matter to the competent authority under applicable law.

14. CHILDREN'S PRIVACY

The Services are intended for individuals who are at least 18 years old. We do not knowingly permit children to create or use customer accounts without the consent and involvement of a parent or lawful guardian where required by applicable law.

If you believe that a child’s Personal Data has been provided to us without appropriate consent, contact support@vyavastha.in. We will review the matter and take appropriate steps under applicable law.

We will not knowingly undertake processing of children’s Personal Data that is prohibited by applicable law, including prohibited tracking, targeted advertising, or processing likely to cause a detrimental effect, where such restrictions apply.

15. MARKETING AND COMMUNICATIONS

We may send service-related messages that are necessary for your account, enquiry, booking, payment, security, or support. You generally cannot opt out of essential transactional communications while using the related feature.

Where permitted and where required consent has been obtained, we may send promotional messages, offers, recommendations, surveys, or event-related information by email, SMS, phone, push notification, or other available channels.

You may opt out of promotional communications by using the unsubscribe option in the message, changing available account preferences, or contacting support@vyavastha.in. Opting out of marketing does not stop essential service or transaction messages.

16. THIRD-PARTY LINKS

The Services may contain links, integrations, maps, payment pages, or content operated by third parties. Those third parties may collect and process information under their own privacy policies. We are not responsible for the privacy, security, content, or practices of third-party services that we do not control.

Review the privacy policy of any third-party service before providing information or completing a transaction through that service.

17. CHANGES TO THIS POLICY

We may update this Privacy Policy when our Services, data practices, providers, or legal obligations change. We will publish the updated version with a revised “Last updated” date.

Where required by law, we will provide additional notice or obtain fresh consent for a material change. Your continued use of the Services after the effective date of an update will be subject to the updated Policy, except where applicable law requires a different process.

18. CONTACT AND GRIEVANCE REDRESSAL

For questions, consent withdrawal, Personal Data requests, account deletion, or privacy complaints, contact us using the details below.

Grievance Officer

• Email: grievance@vyavastha.in
• Address: Raipur, Chhattisgarh 492001, India

We will acknowledge and address grievances within the timelines and process required by applicable law and our published grievance mechanism. Please include sufficient information for us to identify the relevant account, transaction, request, or complaint.