Privacy Policy

Privacy Policy

Effective 3 September 2026

This notice explains how Tracetex 360 Innovations Private Limited ("PujaSathi", "we") handles personal data, in line with the Digital Personal Data Protection Act, 2023 and the Rules made under it. For that Act, we are the Data Fiduciary and you are the Data Principal.

1. What we collect, and why

| Data | Why we need it | Basis | |---|---|---| | Name, email, phone, WhatsApp, language | To create your account and contact you about your bookings | Your consent, and performance of our contract | | City, state, country, designation | To match committees with advertisers by location | Consent | | Committee or business details, logo, website, social links | To build your public listing | Consent | | Photographs of your pandal and installed branding | To show advertisers what they are buying, and to prove display | Contract performance | | PAN, bank account number, IFSC, identity documents | To pay committees, verify identity, and deduct tax as the law requires | Legal obligation and contract | | Payment records, booking history, messages on the platform | To operate the marketplace and resolve disputes | Contract performance | | GPS coordinates when installation proof is uploaded | To evidence where branding was installed | Contract performance | | IP address, device and usage data | Security, fraud prevention, and improving the service | Legitimate use |

We do not collect PAN or bank details unless you choose to apply for an advance payment or need to receive a payout. Listing a festival requires none of it.

2. Who can see your data

Advertisers and committees never see each other's phone number, email, WhatsApp, GSTIN or billing address. This is enforced technically, not merely by policy. Each side sees only the other's business or committee identity — name, city, type, logo, verification status. All communication runs through the platform.

| Who | What they see | |---|---| | The other party to your booking | Your committee or business identity only. No contact details. | | The public | Your published listing: festival details, photographs, prices, committee name and city | | PujaSathi staff | What is needed to operate the platform and resolve disputes | | Payment processor (Razorpay) | Payment and settlement data, including bank details for payouts | | Government authorities | Tax records and anything else the law requires |

Your PAN, bank account number and identity documents are never shown to any other user. They are stored in restricted storage that only you and authorised PujaSathi staff can reach.

We do not sell your personal data. We do not share it with advertisers or data brokers for marketing.

3. Processors we use

• Supabase — database and file storage
• Razorpay — payment processing and settlement (regulated by the RBI)
• Email and messaging providers — to send you notifications

These providers process data on our instructions and are bound to protect it. Some may process data outside India; where they do, we require appropriate safeguards.

4. How long we keep it

| Data | Retention | |---|---| | Account and profile | While your account is open, then 1 year | | Bookings, payments, payouts, invoices | 8 years after the financial year, as tax and company law require | | KYC documents, PAN, bank details | 8 years after the last transaction, as law requires | | Proof of installation and dispute records | 3 years after the booking closes | | Platform messages | 3 years | | Server and security logs | 1 year |

When a retention period ends we delete the data or irreversibly anonymise it.

5. Your rights

Under the DPDP Act you may:

• Access a summary of the personal data we hold about you and how we process it
• Correct data that is inaccurate, and complete data that is incomplete
• Erase data where we no longer need it and no law requires us to keep it
• Withdraw consent at any time — though this may mean we can no longer provide the service
• Nominate another person to exercise these rights if you die or become incapacitated
• Complain to us, and then to the Data Protection Board of India

To exercise any of these, email grievance@pujasathi.com. We respond within 30 days. We may need to verify your identity first.

Note that we cannot delete records the law requires us to keep — tax and payment records in particular.

6. Security

• All traffic is encrypted in transit (HTTPS).
• Access to your data is restricted at the database level, per user and per record.
• KYC documents and installation proofs are held in private storage, reachable only through short-lived signed links.
• Payment card details never touch our servers — they go directly to our payment processor.
• Every administrative action on money or verification is written to an audit log.

No system is perfectly secure. If a breach occurs that is likely to affect you, we will notify you and the Data Protection Board within 72 hours of becoming aware of it.

7. Children

PujaSathi is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

8. Cookies

We use only what is necessary: a session cookie to keep you signed in, and your language preference. We use privacy-respecting analytics to count visits. We do not use advertising or cross-site tracking cookies.

9. Changes

We will notify registered users by email of material changes at least 7 days before they take effect.

10. Grievance Officer

Debtanu Dey Tracetex 360 Innovations Private Limited Durgapur, West Bengal, India grievance@pujasathi.com · +91 93820 85396

Complaints are acknowledged within 48 hours and resolved within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

PujaSathi is a product of Tracetex 360 Innovations Private Limited. The English version of this notice is the operative version.