Privacy Policy

1. Introduction & Data Fiduciary Identity

Shata Events Private Limited (“Shata”, “we”, “us”, or “our”) operates the Shata event booking ecosystem, accessible via shata.in, theshata.com, mobile applications on Android and iOS, and related digital channels. We are committed to processing your personal data lawfully, ethically, and transparently in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable Indian data privacy regulations.

2. Principle of Data Minimization & Information We Collect

We adhere strictly to the principle of Data Minimization: we collect only personal data that is strictly necessary to deliver, coordinate, and fulfill your event services.

• Identity & Contact Details: Full name, verified mobile number, and email address (for booking confirmations, partner coordination, and OTP logins).
• Event Logistics & Specifications: Event category (e.g. wedding, birthday, corporate), scheduled event date, venue location / city, estimated guest headcount, and service preferences.
• Billing & Transaction Details: Invoiced service amounts, transaction reference identifiers, GST details (if business customer). Note: Shata does NOT store raw credit/debit card numbers or CVVs. All payments are processed through RBI-authorized payment aggregators (e.g. Razorpay).
• Partner Credentials: Government-issued ID (PAN/Aadhaar verified via encrypted API pipelines for KYC), business registration certificates, portfolio media, and bank account details solely for milestone payout disbursement.
• Technical & Log Data: Minimal device telemetry (device OS version, app release, anonymized IP address) for fraud prevention, server security, and crash debugging.

3. Lawful Grounds & Purposes of Processing

We process your personal data solely for explicit, lawful purposes:

• Contract Performance: Connecting you with verified local event professionals, arranging doorstep consultations, scheduling deliverables, and releasing milestone payments.
• Identity Verification: Verifying user phone numbers via OTP and screening partner KYC to ensure a trusted, fraud-free community.
• Customer Support: Resolving service queries, handling rescheduling, and facilitating dispute redressal.
• Statutory Compliance: Maintaining accounting, tax (GST), and audit records as mandated by Indian law.

4. Data Sharing & Third-Party Audit

Zero-Sale Policy: Shata strictly NEVER sells, rents, monetizes, or trades your personal information to third-party data brokers, marketers, or advertisers.

We only share necessary personal data with vetted third parties under strict confidentiality and security obligations:

• Assigned Event Partners: Only details strictly relevant to your booking (name, event date, venue city, specific service requests) are shared with the verified professional chosen for your event.
• Payment Processors: RBI-licensed payment gateways (e.g., Razorpay / Cashfree) operating under PCI-DSS Level 1 certification.
• Infrastructure Providers: Enterprise cloud hosting located within Indian data centers (e.g., AWS / Google Cloud Mumbai/Hyderabad regions), secured with 256-bit encryption.
• Statutory Authorities: Disclosed strictly if mandated by a valid court order or statutory requirement under Indian law.

5. Age Consent & Protection of Children’s Data

In strict compliance with Section 9 of the DPDP Act, 2023 and child privacy standards:

• Shata is designed strictly for adults aged 18 years and older who possess the legal capacity to enter binding contracts.
• We do not knowingly collect, process, or solicit personal data from children under 18 years of age without verifiable parental or legal guardian consent.
• When an event is organized for a minor (such as a first birthday, cradle ceremony, or school graduation), the booking, account, and all consent must be managed exclusively by the parent or legal guardian.
• If a parent or guardian discovers that a child has provided us with personal data without consent, they may email privacy@shata.in or submit a Data Deletion Request for immediate, permanent erasure.

6. Marketing Communications & One-Click Unsubscribe

We respect your communication preferences. We strictly separate operational transactional messages from promotional updates:

• Promotional Emails: Every marketing or newsletter email sent by Shata contains a prominent, functional, one-click Unsubscribe link at the bottom. Requests are honored immediately.
• SMS & WhatsApp Updates: Promotional campaigns include clear opt-out instructions (such as replying STOP).
• Transactional Messages: Critical security OTPs, partner arrival alerts, and booking invoices cannot be opted out of, as they are essential for service execution.

7. Data Security Safeguards

We apply rigorous technical and organizational measures to safeguard your information against unauthorized access, loss, or alteration:

• Encryption in Transit: TLS 1.3 protocol with 256-bit encryption for all browser and app communications.
• Encryption at Rest: Industry-standard AES-256 encryption across databases and backups.
• Role-Based Access: Stringent access controls ensuring only authorized operational staff can access customer files on a need-to-know basis.

8. Retention & Right to Erasure

We retain personal data only for the period necessary to fulfill the purposes outlined in this policy, or as mandated by statutory tax and corporate regulations (typically 7 years for GST invoices). Upon closing your account or submitting a valid deletion request, all active personal data is permanently scrubbed from our production databases within 30 days.

Submit Data Deletion Request

9. Your Rights as a Data Principal (DPDP Act)

You have statutory rights under the DPDP Act 2023:

• Right to Access: Request a summary of personal data processed by Shata.
• Right to Correction: Update inaccurate or incomplete details in your profile.
• Right to Erasure: Request permanent deletion of your data when no longer needed.
• Right to Grievance Redressal: Direct recourse to our Grievance Officer and the Data Protection Board of India.

10. Statutory Grievance Redressal Officer

In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines) Rules, 2021 and the DPDP Act 2023, you may contact our designated Grievance Officer: