Privacy Notice · Version 2026-10-07

Your information and choices

Who and what

Nirala Studio uses the adult booker's name, email, phone, learner profile and attendance preference for workshop registration, payment confirmation and essential workshop communications. Course-interest details are used to record interest and send course availability updates. These permissions do not include unrelated marketing.

Field necessity

Name identifies the adult booking; email delivers confirmations and privacy verification; WhatsApp number supports the workshop group and stated contact channel. Attendance preference supports workshop delivery. Learner profile is optional and must not contain a child’s identifiers. Payment references support payment confirmation. Optional analytics is a separate choice and never a condition of booking.

Adult bookings

The person completing a booking or course-interest form must be 18 or older and enter only their own contact details. If you are under 18, ask your parent or lawful guardian to complete the form themselves using their own name, email and phone. Using an adult’s email address on your own is not enough. Do not enter a child's name, date of birth, email or phone. Any later collection of children's personal data requires a separate appropriate verification process.

Providers and protection

Your name, email address and phone number are encrypted before we store them. This makes the stored details unreadable without authorised access. Authorised administrators can read them only for the purposes explained in this notice. SMEPay processes payments; email and WhatsApp providers deliver messages. We store payment references, status, amounts and timestamps, not bank or UPI credentials. Joining a WhatsApp group may reveal your number to other group members.

Retention

Our default retention period for paid registrations and payment references is 18 months from payment completion. Abandoned registrations are retained for up to 18 months from creation. These are provisional business review periods, not statutory minimums or permission for indefinite storage. Verified erasure requests restrict ordinary contact use while the studio reviews the applicable retention matrix. Required legal records remain restricted with a reason and review date. Course-interest records have an 18-month review period from signup, with earlier reviewed erasure where permitted. Retention reviews are operated manually. Encrypted backups are handled separately and must not reintroduce erased records when restored.

Your choices

Use Manage privacy to verify your email, access your records, withdraw selected communication consent or request withdrawal of all other consent-based processing, request erasure, or open a correction or grievance request. Withdrawal stops future messages governed by that consent after it is processed; it cannot recall messages already sent or cancel completed payments. Other-processing withdrawal restricts ordinary contact use and new payment attempts while existing service, lawful retention and provider responsibilities are reviewed. Provider follow-up remains visible until documented. You may grant selected communication consent again through the same verified process; restricted records remain subject to review. Erasure, corrections and nominations require review. Request status provides verified updates on earlier requests. Unknown historical consent is not treated as a grant.

Contact and review

Nirala Admin owns privacy requests and incident decisions. Contact Nirala Studio at contact.niralastudio@gmail.com for help, correction details, grievances, or if you no longer control your registered email. Include your request reference if available, but do not send identity documents unless a justified verification process is agreed. We aim to review verified requests within 30 days. You may request nomination assistance through the same contact. For a privacy grievance, contact Nirala Admin first and keep your case reference. Under the DPDP framework, exhaust our grievance-redressal opportunity before approaching the Data Protection Board of India. The main rights provisions commence on 13 May 2027. When applicable, use the official Board complaint procedure published by the Government of India; contact us for help locating it. Official information: https://www.meity.gov.in/data-protection-framework. Our 30-day target is a studio commitment, not a claim that every statutory deadline is 30 days.

Optional website analytics

If you accept analytics, Google Analytics receives page visits and registration-start events, along with connection and browser information. We do not send contact details, payment references, URL query strings or privacy-request tokens. Advertising features are disabled. Declining does not affect your booking. Use Analytics preferences on a public page to change your choice; withdrawal stops future analytics and clears the analytics cookies for this site. Previously collected data is handled separately by Google and the studio. Our analytics choice notice version is 2026-10-04-analytics-1.