Your datarights

As a Data Principal under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access: a summary of the personal data we hold about you, what we do with it, and who we have shared it with (organisers of events you registered for, and our subprocessors).
• Correction and completion: fix inaccurate or incomplete data and update it. Most profile details you can edit yourself in the app.
• Erasure: have data erased when it is no longer needed for the purpose you gave it for, or when you withdraw consent.
• Withdraw consent at any time, as easily as you gave it.
• Nominate a person to exercise these rights for you if you die or become incapable.
• Grievance redressal: have your complaints answered, and then go to the Data Protection Board of India if you are not satisfied.

• You, for your own data.
• A parent or lawful guardian, for a child or a person with a disability under their care.
• Your nominee, with proof of death or incapacity.
• Someone you authorise in writing, with your consent and their identity.

To protect your data from people pretending to be you, send requests from the email or phone number on your account. If that is not possible, we may ask you to confirm a one-time code or give details only the account holder would know. We ask for no more than we need, and we never ask for your password or payment details.

• We acknowledge every request within 48 hours.
• We complete access, correction and consent requests within 15 days, and erasure within 30 days (account deletion has a 30-day grace period you can cancel).
• If we need longer, we tell you why and when, and never exceed the 90 days the DPDP Rules allow.
• Requests are free.

We will explain any part of a request we cannot complete. The usual reasons are:

• the law requires us to keep it, for example payment, refund, payout and tax records (kept up to eight years, without your contact details once your account is closed);
• it is needed to resolve an open dispute, refund or fraud investigation;
• it is also another person’s data, such as a team registration, where we limit what we share or erase to protect them;
• we cannot verify the request.

Data an organiser already received for an event they ran is held by that organiser too. On request, we pass your erasure or correction to them and remove what we hold on our side.

The DPDP Act also asks Data Principals not to impersonate others, not to suppress material information, and not to file false or frivolous complaints. Please give accurate information when you make a request.

Use the Privacy Request Center, or write to privacy@unifesto.app. If you are unhappy with how we handled it, contact the Grievance Officer, Vinay Buddolla, at grievance@unifesto.app (see the Grievance Redressal Policy).