Privacy Policy

01 Introduction

Welcome to FestNest, operated by FestNest Technologies Pvt. Ltd. ("we", "us", or "our"). FestNest is India's centralized campus event discovery platform, connecting students with hackathons, cultural fests, workshops, sports events, and more across colleges and universities nationwide.

This Privacy Policy explains what personal data we collect when you use FestNest, why we collect it, how we use and protect it, and what rights you hold under the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian laws.

ℹ️ Who This Applies To

This Policy applies to all users of the FestNest platform — including students who browse and register for events, and organizers who create and manage event listings — whether accessed through our website or any future mobile application.

By creating an account or using FestNest in any way, you acknowledge that you have read, understood, and agreed to the practices described in this Policy. If you disagree with any part of it, please stop using FestNest and contact us to delete your account.

02 Information We Collect

We collect only the information necessary to provide and improve our services. Here is a plain-language breakdown:

2.1 Account & Profile Data

When you sign up, we collect:

Students

First name and last name
Email address (used to create your account)
College or university name
Course / branch (e.g., B.Tech CSE)
Year of study (e.g., 2nd Year)
Profile photo (if you choose to upload one)
Phone number (optional)

Organizers

Organization or college name
Department or branch
City of operation
Contact email address
Contact phone number
Profile or organization photo (optional)

2.2 Event & Content Data

Event details you submit: title, description, category, date, location, prizes, registration fee
Event poster images and brochure PDFs uploaded when posting events
Saved events list (events you bookmark on the platform)
Registration actions (events you register your interest in)

2.3 Technical & Usage Data

We automatically collect certain data when you interact with FestNest:

IP address and approximate geographic location (city/region level)
Browser type, device type, and operating system
Pages visited, features used, and time spent on the platform
Search queries entered on FestNest
Error logs and diagnostic data to help us fix problems
Referring URLs (how you arrived at FestNest)

2.4 Cookies & Similar Technologies

FestNest uses cookies and similar local storage technologies to keep you logged in (session token stored in localStorage), remember your preferences, and improve page performance. We do not use third-party advertising cookies or tracking pixels. You can clear cookies at any time through your browser settings; doing so will log you out of your account.

03 How We Use Your Data

We use the data we collect for these specific purposes:

🔐 Authentication & Account Management

Creating and securing your account, verifying your identity, enabling login sessions, and managing account recovery.

🎉 Event Discovery & Matching

Showing you relevant events based on your college, interests, and course. Personalizing search results and featured listings.

📣 Event Publishing (Organizers)

Processing and reviewing event submissions, publishing approved events to the public feed, and notifying organizers about approval status.

📧 Platform Communications

Sending transactional emails (account confirmation, event approval, password reset). Sending platform updates and important announcements relevant to your use of FestNest.

🛡️ Safety & Moderation

Reviewing reported content, preventing fraudulent or abusive activity, and maintaining a safe, trustworthy community for students.

📊 Analytics & Improvement

Understanding how users interact with FestNest to improve features, fix bugs, and prioritize what to build next. We use aggregated, anonymized data for this.

⚖️ Legal Compliance

Meeting our obligations under Indian law, responding to lawful government requests, and enforcing our Terms of Service.

We will never sell your personal data to third parties, use it for profiling unrelated to FestNest's core features, or share it with advertisers.

04 Legal Basis for Processing

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), every organization that processes personal data must have a valid lawful basis. FestNest processes your data on the following grounds:

Consent You give us explicit, informed consent at the time of registration by accepting this Privacy Policy. You may withdraw consent at any time by deleting your account.

Contractual Necessity Processing is necessary to provide the service you signed up for — creating your profile, publishing your events, and enabling registration flows.

Legitimate Interests We process limited usage and analytics data to maintain platform security, prevent abuse, and improve FestNest features — balanced against your privacy rights.

Legal Obligation We may process or retain data when required by Indian law, court orders, or regulatory requests from competent Indian authorities.

07 Data Retention

We keep your personal data only for as long as necessary to provide the service and meet our legal obligations. Here is our retention schedule in plain language:

Active account data

Profile info, saved events, and account preferences.

Lifetime of account

Event submissions

Necessary for organizer dispute resolution and historical records.

2 years after event

Authentication logs

90 days

Deleted account data

After which it is permanently and irreversibly purged from our systems.

30 days after deletion

Anonymized analytics

Aggregated usage statistics that cannot identify any individual.

Indefinitely

08 Your Rights Under the DPDP Act

The Digital Personal Data Protection Act, 2023 grants every Indian data principal (that's you) a set of enforceable rights over your personal data. We are committed to honoring these rights promptly and without making the process unnecessarily difficult.

⚡ How to Exercise Your Rights

Email us at support@festnest.in with the subject line "Data Rights Request — [Your Right]". We will respond within 30 days. We may ask you to verify your identity before processing the request.

§ 1

Right to Access

You can request a copy of all personal data we hold about you — your profile information, saved events, account activity, and any other data tied to your account.

§ 2

Right to Correction & Completion

If any data we hold about you is inaccurate, incomplete, or outdated, you have the right to request that we correct or update it. Most profile data can be edited directly in your FestNest account settings.

§ 3

Right to Erasure (Right to be Forgotten)

You can request the permanent deletion of your personal data and account. We will process this within 30 days. Note: publicly listed event data you submitted may be anonymized rather than deleted if required for platform integrity.

§ 4

Right to Withdraw Consent

You may withdraw the consent you gave when signing up, at any time and without penalty. Withdrawal does not make prior processing unlawful. To withdraw, submit a deletion request or contact us directly.

§ 5

Right to Grievance Redressal

If you believe your data rights have been violated, you can raise a complaint with our Grievance Officer. If unsatisfied with our response, you may escalate to the Data Protection Board of India once it is constituted under the DPDP Act.

§ 6

Right to Nominate

You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity, as provided under Section 14 of the DPDP Act.

09 Data Security

Protecting your personal data is a core responsibility we take seriously. We implement the following security measures:

All data in transit is encrypted using TLS/HTTPS — your browser shows a padlock icon when connected to FestNest.
Passwords are hashed using bcrypt with a strong salt factor. We never store plain-text passwords.
Authentication uses industry-standard JSON Web Tokens (JWT) with defined expiry periods.
Firebase Authentication handles sign-in sessions using Google's security infrastructure.
Access to production databases is restricted to authorized personnel only, with role-based access control.
We perform periodic security reviews and promptly apply security patches.
File uploads (event posters, brochures) are stored on Cloudinary with access controls to prevent unauthorized retrieval.

⚠️ In Case of a Data Breach

If we become aware of a security incident that compromises your personal data, we will notify affected users promptly via email and take immediate steps to contain and investigate the breach, in accordance with DPDP Act requirements.

Despite our best efforts, no system is completely invulnerable. We encourage you to use a strong, unique password for your FestNest account and to log out of shared devices.

10 Children's Privacy

FestNest is designed for college students and event organizers. Our platform is not intended for children under the age of 18. We do not knowingly collect personal data from anyone below the age of 18.

Under the DPDP Act, 2023, processing personal data of children requires verifiable parental consent. If we discover that a user under 18 has created an account without parental consent, we will delete that account and all associated data immediately.

If you are a parent or guardian and believe your child has created a FestNest account, please contact us at support@festnest.in and we will act promptly.

11 Changes to This Privacy Policy

We may update this Privacy Policy from time to time as our platform evolves, we add new features, or legal requirements change. Here is how we handle changes:

We will update the "Last Updated" date at the top of this page whenever we make changes.
For material changes (those that meaningfully affect how we use your data or your rights), we will notify you via email at the address associated with your account at least 14 days before the changes take effect.
For minor changes (grammar corrections, clarifications, non-material updates), we will update the page and you will be notified on your next login.
If you continue to use FestNest after a policy update takes effect, it means you accept the updated terms. If you do not agree, you can request account deletion before the effective date.

12 Contact & Grievance Redressal

We want to make it easy to reach us with privacy questions or concerns. Here are all the ways to get in touch:

General Privacy Queries

support@festnest.in

Questions about this Policy, your data, or how we handle information.

Grievance Officer

grievance@festnest.in

Formal complaints about data rights violations under the DPDP Act.

Company: FestNest Technologies Pvt. Ltd.
Jurisdiction: India — disputes arising from this Privacy Policy are subject to the laws of India and the exclusive jurisdiction of courts in India.

Response Time: We endeavour to respond to all privacy-related enquiries within 7 business days, and to formally acknowledge data rights requests within 30 days as required by the DPDP Act.

If you are dissatisfied with our response to a grievance, you have the right to escalate your complaint to the Data Protection Board of India once it is established under the DPDP Act, 2023.