LEGAL

Privacy Policy

Last updated: 04 May 2026

This Privacy Policy explains how icco.in collects, uses, stores, and protects your personal data. We aim to be transparent and to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 (and its rules).

1. Who we are

icco.in is operated by ICCO EMS, with office at Office No 2, Shree Gajanan Park, Nashik Road, Nashik 422101, India. We are the Data Fiduciary for personal data collected through this Platform.

2. What data we collect

We collect the following categories of personal data:

• Account information: name, email, phone number, password (stored as a one-way hash), city, role (attendee or organiser).
• Booking information: attendee name, phone, event booked, quantity, booking code.
• Event information (Organisers): event details, venue, posters, descriptions you upload.
• Technical data: IP address, browser type, device type, pages visited, timestamps. Used for security and analytics only.
• Communications: emails or messages you send to us.

We do not collect Aadhaar, PAN, biometric data, or financial account details. When payments are introduced, payment data will be processed by PCI-DSS compliant third-party payment gateways and not stored on our servers.

3. Why we collect it (purposes)

• To create and operate your account.
• To process and confirm bookings.
• To allow Organisers to verify and check in attendees at events.
• To send you booking confirmations and important account notifications.
• To prevent fraud, abuse, and unauthorised access.
• To improve the Platform and respond to support queries.
• To comply with legal obligations.

4. Legal basis for processing

Under the DPDP Act, we process your personal data based on your explicit consent given at the time of registration and booking. For certain limited purposes (such as fraud prevention or legal compliance), we may process data without consent as permitted under "legitimate uses" defined in Section 7 of the Act.

5. Sharing your data

We do not sell your personal data. We share limited data only as necessary:

• With Organisers: when you book an event, your attendee name, phone number, and booking code are shared with the relevant Organiser to facilitate entry verification.
• With service providers: hosting (Hostinger), email services, and (when introduced) payment gateways. These are bound by confidentiality and data protection obligations.
• With law enforcement: when required by a valid legal order from an Indian authority.
• In a business transfer: if icco.in is acquired or merged, data may be transferred to the new entity, subject to the same protections.

6. How long we keep it

We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where retention is required by law (e.g., tax records may be retained for up to 7 years as required under Indian law). Booking records associated with attended events are anonymised and retained for analytical purposes only.

7. Security

We implement reasonable technical and organisational security measures, including:

• HTTPS encryption for all data in transit.
• Passwords stored using industry-standard one-way hashing (bcrypt).
• Database access restricted by authentication and least-privilege principles.
• Regular security review of code and infrastructure.

Despite these measures, no system is 100% secure. We cannot guarantee absolute security and you use the Platform at your own risk.

8. Your rights under the DPDP Act

You have the following rights regarding your personal data:

• Right to access: obtain a summary of the personal data we hold about you.
• Right to correction: correct inaccurate or incomplete data (most fields can be edited from Settings).
• Right to erasure: request deletion of your personal data (use the "Delete account" option in Settings).
• Right to grievance redressal: raise complaints with our Grievance Officer.
• Right to nominate: nominate another person to exercise your rights in case of incapacity or death.
• Right to withdraw consent: withdraw consent for processing at any time, after which the related service may not be available to you.

9. Cookies

We use only essential cookies required for the Platform to function (session cookies for login). We do not currently use analytics, advertising, or third-party tracking cookies. If we add such cookies in future, we will obtain your consent first.

10. Children

The Platform is not directed at children under 18. Under the DPDP Act, we do not knowingly process the personal data of children without verifiable parental consent. If you believe a child has provided personal data to us, please contact our Grievance Officer and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be posted on this page with the updated date at the top. Material changes will be notified to you via email or platform notice.

12. Grievance Officer

In compliance with the Information Technology Act, 2000 and the DPDP Act, 2023, you can contact our Grievance Officer for any complaints related to your personal data: