Privacy Policy

We collect only the information needed to run our community's cultural celebrations. Depending on what you choose to do on the platform, this may include:

• Your name
• Phone number
• Email address
• Tower & flat number
• Volunteer details (skills, availability, assigned role)
• Event participation (nominations, performance entries)
• Payment references (UTR, transaction id, receipt number)
• Contribution records (amount, date, contributor, event)
• Uploaded documents (bills, invoices, approvals, scripts)
• Child participant information (where a minor takes part, with guardian consent)

Wherever the platform asks for any of the above, the form clearly flags that personal information is being collected, so you always know when and why your details are requested.

We collect personal information for clearly defined purposes only:

• Event participation — registering nominations and performance entries
• Volunteer coordination — planning, rostering and assigning teams
• Contributions & receipts — recording contributions and issuing receipts
• Community communication — confirmations, reminders and announcements
• Compliance & audit — maintaining financial and statutory records

We practise data minimisation: we ask only for what a given task genuinely needs. We do not reuse your information for unrelated purposes, and we do not sell it to anyone.

Your information is used to run the celebration and to keep our community informed and accountable. Concretely, we use it to:

• Confirm your residency and coordinate event logistics
• Manage volunteer teams and recognise contributions
• Process contributions and issue you a receipt
• Send you event-related confirmations, reminders and announcements you have opted into
• Maintain transparent, auditable financial records of the shared community fund

We do not use your details for advertising, profiling or any automated decision-making.

Every piece of information on the platform is labelled by visibility, so it is always clear who can see what:

• Public — open to anyone, e.g. event schedules, published galleries (with consent) and the transparency dashboard totals.
• Residents-only — visible to logged-in residents of the society, e.g. participation lists and tower/flat details.
• Admin-only — visible to a small set of authorised committee members, e.g. phone numbers, payment references and child participant details.

We share data with external parties only where strictly necessary — for example, a payment gateway to process a contribution — and only to the extent required for that purpose.

We keep personal information only as long as it is needed:

• Active personal data is kept until about one season after your last activity, then archived or deleted.
• Financial and payment records are kept for 8 years to meet audit and statutory requirements.
• Child participant data is deleted within 90 days of the event, unless a specific record must be retained.

Once a retention period ends, data is securely deleted or irreversibly anonymised.

Under the DPDP Act, 2023 you (the Data Principal) have the right to:

• Access — ask for a summary of the personal data we hold about you
• Correction — have inaccurate or incomplete data corrected or updated
• Erasure — request deletion of data no longer needed for its purpose
• Withdraw consent — at any time, as easily as you gave it
• Raise a complaint — write to us and have your concern addressed
• Nominate — appoint someone to exercise your rights in case of death or incapacity

To exercise any of these, email us at onecommunityonecelebration@gmail.com. We respond to data-rights requests within 7 working days.

Consent is always explicit and opt-in. It is never pre-ticked or assumed. For each form, we capture your consent against a specific, versioned consent notice, so there is a clear record of exactly what you agreed to and when.

You can withdraw consent at any time by emailing us at onecommunityonecelebration@gmail.com. Withdrawing consent does not affect anything we lawfully did before you withdrew it, and some records (such as financial entries) may still need to be retained for audit.

We take special care with the data of minors. A child may participate in events only with verifiable parental or guardian consent.

• A separate media consent (for photos, video, the website and social media) is collected in addition to participation consent.
• By default, a child's name, contact details and photographs are NOT made public.
• Child data is retained only as long as needed and is deleted within 90 days of the event unless a record must be kept.

We apply practical, layered safeguards to keep your data safe:

• HTTPS everywhere, so information is encrypted in transit
• Role-based access, so people only see what their role requires
• Restricted financial access, limited to authorised committee members
• Audit logging of sensitive actions, for accountability
• Incident management, so any breach is contained, reviewed and reported

For any privacy question, request or complaint, email us — this is our single point of contact for privacy and data-protection matters:

• Email: onecommunityonecelebration@gmail.com
• We acknowledge privacy requests within 48 hours and respond within 7 working days.