Privacy Policy

We use the information we collect to:

• Process and confirm ticket bookings, and dispatch invoices and entry passes.
• Send essential event communications — schedule changes, venue confirmation, and entry guidelines.
• Respond to inquiries submitted through the Contact form.
• Send marketing newsletters and early-access ticket offers, but only if you have opted in via the subscription checkbox.
• Maintain the security, performance, and integrity of this website.

We do not sell or lease attendee data to third-party data brokers.

We share limited personal data with trusted service providers who help us run the festival and this website, including:

• Zoho Backstage — our ticketing and checkout partner, which processes payments and issues digital tickets.
• Zoho CRM / Mail, or similar platforms — used to manage newsletter subscriptions and respond to inquiries.
• Hosting & infrastructure providers — who store website data securely.
• Google (Analytics 4 & Tag Manager) — aggregate site-usage statistics, loaded only after you accept analytics cookies.
• Meta Pixel — ad measurement and audience-building, loaded only after you accept marketing cookies.

These providers only use your data to deliver the service they’re engaged for. We may also disclose data where required by law, or to protect the rights and safety of Vandora Creations LLP, our attendees, or the public.

Some of these providers — including Google and Meta — are located outside India and may process your data on servers in other countries, such as the United States. Where required, we rely on your consent and the providers' own safeguards for such transfers.

We keep booking and transaction records for as long as needed, and afterward for as long as accounting, tax, and legal rules require — typically up to 7 years for financial records. Newsletter details are kept until you unsubscribe or ask us to remove them. If you reach out through our contact form, we hold onto that only long enough to sort out your request.

We group cookies and similar technologies (including browser local storage) into three categories:

• Strictly necessary — required for the site and booking flow to work, e.g. remembering your theme, ticket quantities, and consent choice. Always active; no consent needed.
• Analytics — Google Analytics 4, loaded via Google Tag Manager, to measure aggregate traffic and page performance. Set only if you accept analytics cookies.
• Marketing — Meta Pixel, to measure our advertising and build audiences. Set only if you accept marketing cookies.

On your first visit a consent banner lets you Accept all, Reject all, or choose categories. Analytics and marketing scripts are not loaded until you consent, and Google Consent Mode is set to "denied" by default. You can change or withdraw your choice at any time using the button below, or by clearing cookies and site data in your browser. We ask again after about 6 months.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data, where it is no longer needed for the purpose it was collected.
• Withdraw consent for marketing communications at any time by using the unsubscribe link in our emails or by contacting us directly.
• Lodge a grievance with our Grievance Officer (Section 9) if you believe your data has been mishandled.

To exercise any of these rights, contact us using the details in Section 11. We will respond within a reasonable timeframe as required by applicable law.

We apply reasonable technical and organizational safeguards — including encrypted transmission (HTTPS/TLS) and restricted internal access — to protect your data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission or storage over the internet is 100% secure, and we cannot guarantee absolute security.

In accordance with the Information Technology Act, 2000 and rules made thereunder, and the DPDP Act, 2023, grievances regarding the processing of your personal data may be addressed to our Grievance Officer at the contact details listed in Section 11, using the subject line "Privacy Grievance". We aim to acknowledge grievances within 48 hours and resolve them within 30 days.