Privacy Policy

This Privacy Policy explains how Bombay No 3 Productions LLP ("we", "us") collects, uses, shares and protects your personal data when you use the Platform. It is published in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

1. Data we collect

• Identity & contact: name, email, mobile number, billing address (for invoicing).
• Authentication: password hash (we never store passwords in plain text), session tokens.
• Booking data: show, seats, payment reference, consent flags and timestamp, and IP address at consent, for visitors from the period when we operated a cookie banner. We no longer collect these for new visitors.
• Device & usage: IP address, browser/OS, pages visited, basic interaction events for security and product improvement.
• Cookies and similar identifiers: set by us and by the analytics and advertising providers listed in §8. These load for every visitor; we do not ask for consent first.

2. Purpose & lawful basis

• Performance of contract, to complete your booking, deliver tickets, process refunds and provide support.
• Legal obligation, to issue tax invoices, maintain financial records, and respond to lawful requests.
• Legitimate use under DPDP Act §7(b)-(h), to detect fraud, prevent scalping, secure the Platform, and operate the service.
• Consent, for marketing communications about upcoming shows, profile personalisation, and any other non-essential processing.

3. Sharing of data

We share personal data only with:

• Event organisers and venues, limited to the information needed to admit you (booking reference, name).
• Payment processors (e.g. Razorpay) to process your payment securely; we do not store full card numbers.
• Communication providers for sending email/SMS/WhatsApp tickets and updates.
• Government authorities, where required by law, subpoena, or valid order.
• Distribution partners (e.g. BookMyShow, PayTM Insider) when you book through their channels, strictly the booking details needed to fulfil the ticket.
• Advertising and measurement partners. Google, Meta and Microsoft receive cookie identifiers and usage data from every visit, to measure traffic and to serve and measure ads. We also send Meta a server-side record of paid bookings and of event page activity, containing its own advertising identifiers, your IP address and browser user agent, a pseudonymous identifier for your session on this site, and the order value. It contains no name, email address, phone number or postal address. See §8 for the full list and what each receives.

We do not sell personal data. We do not transfer personal data outside India except to processors who comply with the standards required by the DPDP Act.

4. Your rights as a Data Principal

Under the DPDP Act, you have the right to:

• Access a summary of your personal data we hold;
• Correct, complete, or update inaccurate or incomplete data;
• Erase personal data that is no longer necessary, subject to legal retention obligations (e.g. tax records retained for 8 years);
• Withdraw consent for marketing or other consent-based processing;
• Nominate another individual to exercise your rights in case of incapacity or death;
• File a grievance with our Data Protection Officer (DPO), and thereafter with the Data Protection Board of India.

To exercise these rights, contact our DPO at [email protected]. We will respond within the timelines prescribed under the DPDP Act.

5. Retention

• Booking, billing and tax records, retained for 8 years from the financial year of the transaction (in line with the GST Act).
• Account data, retained until you delete your account; tombstoned for 90 days, then permanently erased.
• Logs (security, fraud detection), retained up to 180 days.

6. Security

We use TLS in transit, encrypted at rest where appropriate, bcrypt for password hashing, role-based access, and audit logging for sensitive operations. While we follow industry best practices, no system is perfectly secure; we will notify you and the Data Protection Board in accordance with law in the event of a notifiable personal data breach.

7. Children

The Platform is not directed to children under 18. We do not knowingly collect personal data of children, and require verifiable parental consent before processing children's data as required by the DPDP Act.

8. Cookies, analytics and advertising

We do not ask for cookie consent. This site previously showed a cookie banner. It has been removed, and analytics and advertising tools now load for every visitor. There is no opt-in step, and no consent is collected or recorded for new visitors.

The following load on every page, for every visitor:

• Google Analytics 4 (Google), for traffic and behaviour measurement.
• Meta Pixel (Meta Platforms), for advertising measurement.
• Microsoft Clarity (Microsoft), which records how pages are used, including scrolling and clicks.
• Google AdSense (Google), where advertising is shown.

These set cookies and similar identifiers in your browser and may combine that activity with data those companies already hold about you.

What we send to Meta from our servers.When a booking is paid, and separately when an event page is viewed or engaged with, we send Meta a conversion record through its Conversions API. That record contains the advertising click identifier from the link you arrived on where there is one, the browser cookie identifier that Meta's own pixel sets, your IP address and browser user agent, a pseudonymous identifier for your browsing session on this site, and the order value and the item booked. It does not contain your name, email address, phone number or postal address.

Your IP address and browser user agent already reach Meta directly from the Meta Pixel running in your browser, on every page you open. Sending them from our servers as well gives Meta nothing further about you; it lets Meta recognise the two records as one event rather than two, and stops the same visit being counted twice.

If you previously chose "Essential only" on the old banner, that choice is still stored on your device and is still honoured: no conversion record is sent to Meta for your bookings.

You can control this through your browser: block or delete cookies, or use a tracking-protection or ad-blocking extension. You can manage ad personalisation at adssettings.google.com, read how Google uses cookies in advertising at policies.google.com/technologies/ads, and review Meta's practices at facebook.com/privacy/policy. You may also contact our Grievance Officer below to object to this processing or to ask what we hold about you.

9. Grievance Officer

• Grievance Officer: Chintan Pavlankar
• Email: [email protected]

10. Changes

We may update this Privacy Policy as the law and our services evolve. Material changes will be communicated by email or a banner on the Platform.