Privacy

Policy

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, Decor Town acts as a Data Fiduciary. We are responsible for determining the purpose and means of processing your personal data.

Data Fiduciary: Decor Town Registered Address: Mansarovar, Jaipur Email: [email protected] Phone: +91-9799047673

When you submit an enquiry through our website, we collect the following personal data:

- Full Name - Mobile Number - Email Address (optional) - Occasion Type - Event Date - Theme Preference (optional) - Additional Notes (optional)

For internal team members using the admin dashboard, we additionally collect email address, IP address, device information, and geolocation data for session security purposes. The dashboard is not accessible to the general public.

We do not collect any personal data from visitors who browse the website without submitting an enquiry form. We do not process children's personal data. Our services are not directed at individuals under 18 years of age.

Under Section 4 of the DPDP Act, we process your personal data only for lawful purposes with your consent. The specific purposes are:

- To respond to your enquiry and provide information about our event decoration services - To communicate with you regarding your event requirements - To improve our services based on customer needs - To maintain records of enquiries for operational purposes - To authenticate and secure internal team accounts on the admin dashboard - To detect and prevent unauthorized access

We collect consent at the point of data collection through a clear consent checkbox on our enquiry form. You may withdraw consent at any time (see Section 8).

We do not process personal data for any purpose beyond what is specified above. If we need to process your data for a new purpose, we will seek fresh consent before doing so.

In compliance with Section 5 of the DPDP Act and Rule 3 of the DPDP Rules 2025, we provide clear notice at the time of collecting your personal data. This notice includes:

- The specific personal data being collected - The purpose for which the data is being processed - How you can exercise your rights as a Data Principal - How you can file a complaint with the Data Protection Board of India

Your personal data is stored securely on cloud-hosted databases with industry-standard encryption and access controls. In compliance with Section 8 of the DPDP Act, we implement reasonable security safeguards including:

- Encryption of data in transit (TLS/SSL) - Encrypted password storage using bcrypt hashing (12 salt rounds) - httpOnly, secure cookies for authentication tokens - Two-factor authentication (TOTP) for admin accounts - Account lockout after 3 failed login attempts - Session management with device tracking and remote revocation - OAuth CSRF protection via state parameter validation - Parameterized database queries to prevent injection attacks

In the event of a personal data breach that is likely to cause harm to a Data Principal, we will notify the Data Protection Board of India and affected individuals as required under Section 8(6) of the DPDP Act.

In accordance with Section 8(7) of the DPDP Act, we retain personal data only for as long as necessary to fulfill the purpose for which it was collected:

- Enquiry data: Retained for up to 24 months from the date of submission, or until the purpose is fulfilled, whichever is earlier - Admin account data: Retained for the duration of the account's active use - Session data: Retained for up to 30 days after the session expires

Upon expiry of the retention period, or upon your request for erasure, your data will be securely deleted. When consent is withdrawn, we will erase your personal data within 30 days unless retention is required by law.

We do not sell, trade, or share your personal data with any third parties for marketing purposes. Your data may be shared only with the following categories, each acting as a Data Processor under valid contractual agreements:

- Our internal team members who handle enquiries and event coordination - Cloud service providers (database hosting, Neon/PostgreSQL) - Media storage providers (Cloudinary — for image processing) - IP geolocation services (ipapi.co — for session security, admin users only) - Email service providers (SMTP — for transactional emails only)

We do not transfer personal data outside India. All data processors are contractually bound to process data only as instructed by us and to maintain appropriate security measures as required under Section 8(2) of the DPDP Act.

Under Sections 11-14 of the DPDP Act, 2023, you have the following rights:

- Right to Access Information (Section 11): You may request a summary of your personal data being processed and the processing activities. - Right to Correction & Erasure (Section 12): You may request correction of inaccurate or incomplete personal data, or erasure of data that is no longer necessary for the purpose it was collected. - Right to Withdraw Consent (Section 6(4)): You may withdraw your consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing done before withdrawal. - Right to Grievance Redressal (Section 13): You may raise a complaint with our Grievance Officer. If unsatisfied with the resolution, you may file a complaint with the Data Protection Board of India. - Right to Nominate (Section 14): You may nominate another individual to exercise your rights in case of your death or incapacity.

To exercise any of these rights, contact our Data Protection Officer (see Section 10). We will process your request within 30 days.

Our website uses the following cookies and tracking technologies:

- Authentication Cookies: httpOnly session cookies for admin login (essential, no consent required under DPDP Act for legitimate use) - Google Analytics: Used to understand website traffic and user behavior (anonymous, aggregated data) - Meta Pixel: Used for measuring advertising effectiveness

Analytics and tracking cookies are loaded only on public pages and do not collect personal data that can identify individual visitors. Admin authentication cookies are strictly functional and expire after 24 hours.

In compliance with Section 13 of the DPDP Act and Rule 7 of the DPDP Rules 2025, we have appointed a Grievance Officer who can be contacted for any data protection concerns:

Grievance Officer: Decor Town Email: [email protected] Phone: +91-9799047673 Address: Mansarovar, Jaipur

We will acknowledge your request within 48 hours and provide a resolution within 30 days. If you are not satisfied with the resolution, you may file a complaint with the Data Protection Board of India at https://www.dpboard.gov.in.

Under Section 15 of the DPDP Act, as a Data Principal you have certain duties:

- You must not submit false or misleading personal data - You must not impersonate another person while providing personal data - You must not suppress any material information while submitting data - You must not register a false or frivolous complaint with the Data Protection Board

Violation of these duties may result in penalties as specified under the DPDP Act.

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable laws, or the DPDP Rules. Any material changes will be communicated through a prominent notice on our website. The updated effective date will be displayed at the top of this page. We encourage you to review this page periodically.