1. Who we are
This Privacy Policy explains how Bandhan 3 Ceremonies Private Limited ("Bandhan", "we", "us") handles your personal data when you use bandhan3.com or the Bandhan Android application (collectively, the "Platform"). We are the "Data Fiduciary" for your data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
2. What we collect
a. Information you give us
- Identity: name, date of birth, mobile number, email, family relationship graph.
- Wedding & celebration details: dates, guest counts, venue preferences, budgets.
- Financial: invoices, receipts, payment references (we never store card numbers — payment gateways do).
- Vendor/partner data: KYC documents (PAN, GST, Aadhaar-last-4), business details, availability.
- Uploads: photos, notes, files you attach to a task, message or vendor package.
b. Information we collect automatically
- Device identifiers, IP, session identifiers, coarse location.
- Product analytics — pages viewed, features used, error traces (used to improve reliability).
- Cookies & local storage — see our Cookies Policy.
3. Why we use it (lawful basis)
- To provide the service you asked for — plan your wedding, manage vendors, send OTPs, book advisors. (Consent + contract)
- To verify vendors and prevent fraud — KYC checks, peer-review clustering, anti-brute-force. (Legitimate interest + legal obligation)
- To send you transactional messages — OTPs, booking confirmations, escalations. Never marketing without your explicit opt-in. (Consent + contract)
- To comply with law — GST invoicing, statutory audit, court orders. (Legal obligation)
4. Who we share it with
We do not sell your data. We share it only with:
- Vendors you engage with — they see your name, phone, event date, and the brief you send them. Nothing more.
- Advisors you assign — scoped to the specific family they support.
- Sub-processors — payment gateway (Stripe / Razorpay), SMS (MSG91 / Twilio), email (Resend / SendGrid), object storage (AWS S3 or Emergent Object Storage). Each is bound by DPAs.
- Law-enforcement — only on a valid legal order.
5. How long we keep it
- Active family data: for as long as your Family ID is active.
- Financial records: 8 years (Companies Act 2013 requirement).
- KYC documents: 5 years after vendor deactivation (PMLA guidance).
- Anonymised analytics: 24 months.
6. Your rights under DPDP Act 2023
You may exercise these rights at any time by emailing info@bandhan3.com:
- Access — get a copy of the data we hold about you.
- Correction / erasure — fix mistakes or ask us to delete data no longer needed.
- Withdraw consent — for any specific processing you consented to.
- Grievance redress — our Grievance Officer replies within 15 days as required by law.
- Nominate a person to exercise your rights if you can no longer do so.
7. Security
We use TLS in transit, encryption at rest for sensitive fields, role-based access, and independent penetration testing. In the unlikely event of a personal-data breach we will notify the Data Protection Board of India and affected users within 72 hours as required by the DPDP Act.
8. Children
The Platform is for adults (18+). We do not knowingly collect data from anyone under 18 without verifiable parental consent as required by law.
9. Changes
We may update this policy. Material changes will be notified at least 15 days in advance via email and an in-app banner.
10. Contact the Grievance Officer
Bandhan 3 Ceremonies Private Limited
Grievance Officer
Email: info@bandhan3.com