Privacy Policy | Tanishq Birthday Creation

At Tanishq Birthday Creation, we are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, and protect your information in compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data Fiduciary Information

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, Tanishq Birthday Creation acts as a Data Fiduciary. We are responsible for determining the purpose and means of processing your personal data.

Data Fiduciary:

Registered Address:

Email:

Phone:

2. Personal Data We Collect

When you submit an enquiry through our website, we collect the following personal data:

Full Name
Mobile Number
Email Address (optional)
Occasion Type
Event Date
Theme Preference (optional)
Additional Notes (optional)

For internal team members using the admin dashboard, we additionally collect email address, IP address, device information, and geolocation data for session security purposes. The dashboard is not accessible to the general public.

We do not collect any personal data from visitors who browse the website without submitting an enquiry form. We do not process children's personal data. Our services are not directed at individuals under 18 years of age.

3. Purpose & Lawful Basis for Processing

Under Section 4 of the DPDP Act, we process your personal data only for lawful purposes with your consent. The specific purposes are:

To respond to your enquiry and provide information about our event decoration services
To communicate with you regarding your event requirements
To improve our services based on customer needs
To maintain records of enquiries for operational purposes
To authenticate and secure internal team accounts on the admin dashboard
To detect and prevent unauthorized access

We collect consent at the point of data collection through a clear consent checkbox on our enquiry form. You may withdraw consent at any time (see Section 8). We do not process personal data for any purpose beyond what is specified above. If we need to process your data for a new purpose, we will seek fresh consent before doing so.

4. Notice at Point of Collection

In compliance with Section 5 of the DPDP Act and Rule 3 of the DPDP Rules 2025, we provide clear notice at the time of collecting your personal data. This notice includes:

The specific personal data being collected
The purpose for which the data is being processed
How you can exercise your rights as a Data Principal
How you can file a complaint with the Data Protection Board of India

5. Data Storage & Security

Your personal data is stored securely on cloud-hosted databases with industry-standard encryption and access controls. In compliance with Section 8 of the DPDP Act, we implement reasonable security safeguards including:

Encryption of data in transit (TLS/SSL)
Encrypted password storage using bcrypt hashing (12 salt rounds)
httpOnly, secure cookies for authentication tokens
Two-factor authentication (TOTP) for admin accounts
Account lockout after 3 failed login attempts
Session management with device tracking and remote revocation
OAuth CSRF protection via state parameter validation
Parameterized database queries to prevent injection attacks

In the event of a personal data breach that is likely to cause harm to a Data Principal, we will notify the Data Protection Board of India and affected individuals as required under Section 8(6) of the DPDP Act.

6. Data Retention & Erasure

In accordance with Section 8(7) of the DPDP Act, we retain personal data only for as long as necessary to fulfill the purpose for which it was collected:

Enquiry data: Retained for up to 24 months from the date of submission, or until the purpose is fulfilled, whichever is earlier
Admin account data: Retained for the duration of the account's active use
Session data: Retained for up to 30 days after the session expires

Upon expiry of the retention period, or upon your request for erasure, your data will be securely deleted. When consent is withdrawn, we will erase your personal data within 30 days unless retention is required by law.

7. Data Sharing & Data Processors

We do not sell, trade, or share your personal data with any third parties for marketing purposes. Your data may be shared only with the following categories, each acting as a Data Processor under valid contractual agreements:

Our internal team members who handle enquiries and event coordination
Cloud service providers (database hosting)
Media storage providers (Cloudinary — for image processing)
IP geolocation services (ipapi.co — for session security, admin users only)
Email service providers (SMTP — for transactional emails only)

We do not transfer personal data outside India. All data processors are contractually bound to process data only as instructed by us and to maintain appropriate security measures as required under Section 8(2) of the DPDP Act.

8. Your Rights as a Data Principal

Under Sections 11-14 of the DPDP Act, 2023, you have the following rights:

Right to Access Information (Section 11): You may request a summary of your personal data being processed and the processing activities.
Right to Correction & Erasure (Section 12): You may request correction of inaccurate or incomplete personal data, or erasure of data that is no longer necessary.
Right to Withdraw Consent (Section 6(4)): You may withdraw your consent at any time by contacting us.
Right to Grievance Redressal (Section 13): You may raise a complaint with our Grievance Officer. If unsatisfied, you may file a complaint with the Data Protection Board of India.
Right to Nominate (Section 14): You may nominate another individual to exercise your rights in case of death or incapacity.

9. Cookies & Tracking Technologies

Our website uses the following cookies and tracking technologies:

Authentication Cookies: httpOnly session cookies for admin login (essential, no consent required under DPDP Act for legitimate use)
Google Analytics: Used to understand website traffic and user behavior (anonymous, aggregated data)
Meta Pixel: Used for measuring advertising effectiveness

10. Data Protection Officer / Grievance Officer

In compliance with Section 13 of the DPDP Act and Rule 7 of the DPDP Rules 2025, we have appointed a Grievance Officer who can be contacted for any data protection concerns:

Grievance Officer: Tanishq Birthday Creation
Email: tanishqbirthdaycreations@gmail.com
Phone: +91-9785346311
Address: A-58, Shyam Mitra Mandal Nagar, Murlipura, Jaipur, Rajasthan 302039

We will acknowledge your request within 48 hours and provide a resolution within 30 days. If you are not satisfied with the resolution, you may file a complaint with the Data Protection Board of India at https://www.dpboard.gov.in.

11. Duties of Data Principal

Under Section 15 of the DPDP Act, as a Data Principal you have certain duties:

You must not submit false or misleading personal data
You must not impersonate another person while providing personal data
You must not suppress any material information while submitting data
You must not register a false or frivolous complaint with the Data Protection Board

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable laws, or the DPDP Rules. Any material changes will be communicated through a prominent notice on our website. The updated effective date will be displayed at the top of this page. We encourage you to review this page periodically.

By using our website and submitting the enquiry form, you consent to the collection and use of your data as described in this policy. If you have any questions, please contact us.