Privacy Policy & DPDP Notice
Formulated in strict adherence to India's Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) and the notified Digital Personal Data Protection Rules, 2025 (DPDP Rules, 2025), detailing the actual and verified data practices of MyEntryPass.
Statutory Notice to Data Principals (Section 5, DPDP Act, 2023)
Under Section 5 of the DPDP Act, 2023 and Rule 3 of the DPDP Rules, 2025, every Data Principal whose personal data is collected or processed by MyEntryPass is entitled to an itemised notice before granting consent. This document sets out the specific categories of digital personal data processed, our lawful bases, processors, retention limits, consent withdrawal mechanisms, and your statutory rights to access, correction, grievance redressal, and nomination.
Contents & Navigation
1. Data Fiduciary Identity & Scope
Under Section 2(i) of the Digital Personal Data Protection Act, 2023, the Data Fiduciary determining the purpose and means of processing personal data across MyEntryPass (available at https://myentrypass.in) is:
Ornitech Solutions (Operating Brand: MyEntryPass)
Principal Place of Business: Surat, Gujarat, India
Contact Email: support@myentrypass.in / contact@ornitech.in
Helpline / WhatsApp: +91 78749 48471
This Policy applies to all individuals in India and worldwide who register accounts, browse events, book digital entry passes, attend college festivals or community events, submit organizer applications, or communicate with our support desk.
2. Verified Data Collection by Flow
We adhere strictly to the principle of data minimisation (Section 6(1)). We only collect data required to operate entry pass generation, secure gate authentication, and organizer workflows. Based on audited codebase behavior, data collected includes:
A. Account Creation & Authentication Flow
- Email Address: Used as primary unique identifier, for one-time password (OTP) delivery, pass delivery, and transaction confirmations.
- Mobile Phone Number: Collected for SMS/WhatsApp pass receipt delivery, cash pass approvals, and attendee gate validation.
- Name (First Name & Last Name): Displayed on issued digital entry passes to ensure authorized gate entry.
- Google OAuth 2.0 Credentials: When opting to “Continue with Google”, we receive your Google ID (
sub), verified email address, full name, and avatar URL. We never access your Google password or private Google Drive files. - Password Credentials: For password-based staff/admin accounts, passwords are cryptographically salted and hashed using
bcryptbefore database storage. Plaintext passwords are never stored.
B. Ticketing & Pass Issuance Flow
- Attendee Information: Primary customer name, customer email, customer phone number, selected pass tier, assigned seat/zone, and ticket quantity.
- Group & Team Registrations: For group bookings and hackathons, team name, team size, and individual team member names, emails, and phone numbers are collected to issue individual split passes.
- Cryptographic Pass Tokens: A unique alphanumeric
bookingCodeand time-bound HMAC-SHA256 signature are generated to prevent pass forgery and ticket scalping. - Gate Check-in Logs: Multi-day event check-in timestamps, pass usage counters (
usedPasses,remainingPasses), and staff scanner identifiers (scannedBy).
C. Payment & Transaction Flow
- Online Payments (Razorpay): Processed via Razorpay Software Private Limited (PCI-DSS Level 1 compliant gateway). MyEntryPass only receives and stores the Razorpay Order ID (
order_...), Payment ID (pay_...), payment status, and cryptographic signature. We never collect, process, or store full credit/debit card numbers, CVVs, or UPI MPINs. - Campus Offline Cash Payments: For student and college cash ticketing, cash requests record the requested amount, creation timestamp, and approving/rejecting manager ID (
approvedBy,approvedAt). - Free Student Registrations: Direct zero-cost registrations bypass all payment processors.
D. Organizer Application & Event Hosting Flow
- Organizer Identification: Organization/college committee name, contact person name, official email, phone number, and social media/website URL.
- Event Specifications: Venue name, address, target city, event start/end schedule, artist names, age restriction, language, and custom terms & conditions.
- Event Media: Event posters and gallery images uploaded to Google Cloud Storage.
E. Attendee Feedback & Support Inquiries
- Event Ratings & Reviews: Star ratings across 5 categories (Experience, Organization, Venue, Booking, Management), feedback tags, and public review text.
- Support Messages: Inquiries sent to
support@myentrypass.inor WhatsApp helpline are logged to resolve ticketing disputes and gate access questions.
3. Purposes of Processing & Lawful Grounds
In compliance with Section 4 and Section 6 of the DPDP Act, 2023, personal data is processed solely under valid lawful grounds:
| Processing Purpose | Personal Data Involved | Lawful Ground (DPDP Act, 2023) |
|---|---|---|
| Pass Issuance & Delivery | Name, Email, Mobile Phone, Seats, Booking Code | Consent (Sec 6) & Legitimate Use (Sec 7(b)) |
| Anti-Scalp Gate Verification | HMAC Token, QR Code, Scan Timestamp, Staff ID | Legitimate Use for Prevention of Fraud (Sec 7) |
| Payment Settlement & Invoicing | Razorpay Order/Payment ID, Amount, Email, Phone | Contractual Performance & Legal Obligation (Sec 7) |
| Organizer Vetting & Listing | Organizer Contact, Email, Phone, Event Venue | Consent (Sec 6) |
| Location-Based Event Filtering | Selected City, Device Coordinates (Client-side) | Consent (Sec 6) — Freely Revocable |
| Taxation & Statutory Books | Transaction Records, Invoices, Payment Timestamps | Compliance with Indian Law (GST Act, IT Act) |
4. Data Processors & Third-Party Recipients
Under Section 8(2) of the DPDP Act, 2023, personal data is processed by authorized Data Processors bound by strict confidentiality and security agreements. We never sell, rent, or trade your personal information to third-party data brokers.
Razorpay Software Private Limited
Role: Payment Gateway Processor (India).
Data Shared: Customer email, mobile phone, transaction amount, order ID. Card details are processed inside Razorpay's PCI-DSS Level 1 compliant secure vault.
Google Cloud Platform (GCS)
Role: Cloud Infrastructure & Image Storage.
Data Shared: Encrypted QR code images (storage.googleapis.com/...) and organizer event posters.
MongoDB Atlas
Role: Managed Database Infrastructure.
Data Shared: Encrypted user credentials, booking logs, organizer applications, and pass records with automated backups.
Authorized Event Organizers & Staff
Role: Venue Admission & Gate Verification.
Data Shared: Attendee name, pass tier, seat assignment, and check-in status visible to event managers on the scanner app to admit verified ticket holders.
5. Location & Geocoding Data
MyEntryPass offers city-level filtering to help attendees discover concerts, college fests, and workshops in their vicinity:
- Device Geolocation (GPS): Requested strictly with explicit browser consent via
navigator.geolocation. Coordinates are reverse-geocoded to identify your city (e.g. Surat, Mumbai, Delhi NCR). - Client-Side Caching: Coordinates and detected city are cached locally in your browser memory and
localStorage(mep_city_location) for 24 hours. They are not stored on backend servers or used for persistent user tracking. - Manual City Selection: You can decline GPS permission at any time and manually select your preferred city from the header navigation.
6. Dynamic QR Cryptography & Reasonable Security Safeguards
In accordance with Section 8(5) of the DPDP Act, 2023, MyEntryPass implements robust technical and organizational security safeguards:
- HMAC-SHA256 Signed Passes: QR code payloads are signed with rotating server-side HMAC keys, rendering screenshots and forged tickets invalid at gate turnstiles.
- Data in Transit: 100% of network traffic between your browser and our servers is encrypted using modern TLS 1.3 / SSL with strict HTTPS enforcement.
- Data at Rest: Database records and Google Cloud Storage buckets are encrypted at rest with AES-256 standard encryption.
- Breach Notification (Section 8(6)): In the unlikely event of a personal data breach affecting users, MyEntryPass will inform the Data Protection Board of India and affected Data Principals in the form and manner prescribed under DPDP Rules, 2025.
7. Data Retention & Erasure Schedules (Section 8(7))
Personal data is erased or anonymised once the purpose of collection has been fulfilled or upon consent withdrawal, in adherence to Section 8(7) of the DPDP Act, 2023:
| Data Record Category | Retention Duration | Statutory Justification |
|---|---|---|
| User Account Profile | Active account lifetime + 30 days after deletion request | Facilitates ongoing pass access and account recovery. |
| Gate Entry Validation Logs | 90 days post-event conclusion | Resolution of ticket disputes, chargeback investigations. |
| Financial & Invoicing Records | 7 years from end of financial year | Mandatory statutory retention under GST Act & Income Tax Act, 1961. |
| Temporary OTP Verification Codes | 10 minutes maximum | Immediate expiration post-authentication. |
| Rejected Organizer Applications | 180 days post-rejection | Security dispute review and re-application verification. |
8. Statutory Rights of Data Principals (Sections 11–14)
As a Data Principal under the DPDP Act, 2023, you are guaranteed enforceable statutory rights:
Right to Access Information (Sec 11)
You have the right to obtain a summary of personal data being processed by us, a description of the processing activities, and identities of all Data Fiduciaries/Processors with whom your data was shared.
Right to Correction & Erasure (Sec 12)
You have the right to correct inaccurate or misleading personal data, complete incomplete data, and request erasure of personal data that is no longer required for its original purpose.
Right of Grievance Redressal (Sec 13)
You have the right to register a grievance with our designated Grievance Redressal Officer regarding any act or omission by MyEntryPass in relation to your personal data.
Right to Nominate (Sec 14)
You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal.
9. Consent Withdrawal Mechanism (Section 6(4))
Under Section 6(4) of the DPDP Act, 2023, you have the statutory right to withdraw your consent at any time. The ease of withdrawal is comparable to the ease of giving consent.
How to Exercise Consent Withdrawal:
Send an email with the subject line “DPDP Consent Withdrawal Request” from your registered email address to our Data Protection Desk:
Consequence of Withdrawal: Withdrawal of consent does not affect the lawfulness of processing undertaken prior to withdrawal. If you withdraw consent for essential ticketing data prior to event date, your entry pass may be invalidated as admission cannot be cryptographically verified.
10. Processing of Personal Data of Children (Section 9)
In strict accordance with Section 9 of the DPDP Act, 2023:
- MyEntryPass requires verifiable parental or lawful guardian consent before processing personal data of children under eighteen (18) years of age.
- We prohibit tracking, behavioral monitoring, and targeted advertising directed at children or minors.
- We do not process any personal data of children that is likely to cause any detrimental effect on the well-being of a child.
11. Cookies, Analytics & Advertising Disclosures
We use functional and analytical cookies to ensure security, maintain active login states, and evaluate site performance:
- Essential Session Cookies: Stored to maintain your authenticated login state (
mep_token) and protect form submissions from CSRF attacks. - Third-Party Advertising Vendors: Third-party advertising vendors, including Google LLC, may use cookies to serve advertisements based on past visits to websites.
- Opting Out: You may opt out of personalized advertising by visiting Google Ads Settings or www.aboutads.info. You may also configure your browser to block cookies.
12. Grievance Redressal Officer & Escalation (Section 13)
In compliance with Section 13 of the DPDP Act, 2023 and Rule 14 of the DPDP Rules, 2025, MyEntryPass has appointed a dedicated Grievance Redressal Officer to address all data protection inquiries, access/rectification requests, and grievances:
Grievance Redressal Officer Details:
Escalation to the Data Protection Board of India (DPBI)
Under Section 13(3) of the DPDP Act, 2023, if you are not satisfied with the resolution provided by our Grievance Redressal Officer, or if no response is received within the statutory period, you have the right to register a formal complaint with the Data Protection Board of India (DPBI) in the digital form and manner prescribed by the Central Government.
13. Language Accessibility & Constitutional Schedule VIII
In accordance with Section 5(3) of the DPDP Act, 2023, Data Principals are entitled to access this Privacy Notice in English or any of the 22 languages specified in the Eighth Schedule to the Constitution of India. To request this notice or any communication in Hindi, Gujarati, or any other scheduled language, please email support@myentrypass.in with the subject line “Language Accessibility Request”.