privacy notice
what we collect when you book a space or a ticket, why, who else sees it, and how to make us stop. written to the Digital Personal Data Protection Act, 2023.
1. who this is from and who it's for
This notice is issued by Koodam Spaces Private Limited, Chennai, Tamil Nadu, India — the data fiduciary in the words of the Digital Personal Data Protection Act, 2023 (“DPDP Act”). It applies to everyone who uses Koodam or Koothu: guests, ticket buyers, hosts, organizers, and people who write to support.
Where a host or organizer receives your name and phone for a booking, they process it as a separate fiduciary for the purpose of that booking. The host agreement limits what they can do with it.
2. what we collect
| data | when | from |
|---|---|---|
| name, phone number, email | sign-up, checkout | you |
| booking and ticket history, amounts, invoices | every booking or order | generated by us |
| payment status, last 4 digits, UPI handle or card network | payment | Razorpay (we never get full card numbers) |
| messages to support, issue reports, photos you attach | when you write in | you |
| host KYC: legal name, PAN, GSTIN, bank account | host onboarding | you, verified by Razorpay Route |
| calendar feeds (Google Calendar / iCal URLs) for blocking hours | if a host connects one | you |
| device, browser, IP address, pages viewed | every visit | automatic (server logs) |
We don’t collect your precise location, contacts, or anything from your camera roll except a photo you choose to attach.
3. why we use it
- to run the booking — tell the host who’s coming, tell you where to go, send the invoice. lawful basis: you asked us to (consent at checkout, and performance of the contract).
- to pay hosts and organizers — settle T+2 payouts through Razorpay Route, issue tax invoices with GST. lawful basis: legal obligation (GST and Income-tax law) and contract.
- to handle problems — refunds, damage claims, support tickets. lawful basis: contract and our legitimate use in resolving disputes.
- to keep the platform safe — detect fraud, repeat no-shows, off-platform payment attempts. lawful basis: legitimate use, and legal obligation under the intermediary rules.
- to tell you about shows and spaces — only if you opt in. lawful basis: consent, which you can withdraw in one tap.
We don’t sell personal data, and we don’t use it for advertising profiles.
4. WhatsApp and email messages
Booking confirmations, reminders, e-tickets and refund notices go by email always and by WhatsApp only if you tick the box at sign-up or in your account. WhatsApp messages are sent through the WhatsApp Business Platform (Meta) using pre-approved templates; Meta’s privacy policy governs delivery. Marketing on WhatsApp needs a separate opt-in and every message carries a stop instruction. Reply STOP, untick the box in your account, or write to support@koodam.in and we stop within 24 hours. Transactional messages about a booking you already hold still go out — by email if you have turned WhatsApp off.
6. how long we keep it
- account details: until you delete your account, then 30 days in backups.
- bookings, orders, invoices: 8 years from the end of the financial year, because GST and Income-tax law require it — even after account deletion, with your name replaced by the invoice reference where the law allows.
- support conversations: 2 years after the ticket closes.
- server logs: 90 days.
- host KYC documents: held by Razorpay under RBI rules; we keep only the verification status.
7. your rights under the DPDP Act
- access — a summary of what we hold about you and who we’ve shared it with, within 30 days of asking.
- correction and erasure — fix a wrong phone number from your account page; ask us to erase what we don’t have to keep.
- withdraw consent — for WhatsApp and marketing, in one tap; withdrawal doesn’t affect what was already lawfully done.
- grievance redressal — write to the grievance officer (section 11). if you’re not satisfied after that, you can complain to the Data Protection Board of India.
- nominate — name someone to exercise these rights for you if you die or are incapacitated; write to support to set this up.
Your duties under the Act: give us accurate details and don’t impersonate anyone.
9. children
Koodam is for people 18 and over. We don’t knowingly collect data from anyone under 18; if you tell us we have, we delete it. Events marked 18+ or 21+ are checked at the door by the organizer, not by us collecting a date of birth.
10. security
- everything is encrypted in transit (TLS) and at rest.
- row-level security in the database: a host can read only their own bookings, a guest only theirs.
- payment details never touch our servers; Razorpay is PCI-DSS Level 1.
- if a breach affects you we tell you and the Data Protection Board as the Act requires, without unreasonable delay.
11. contact and grievances
Grievance officer: [name pending], Koodam Spaces Private Limited, Chennai, Tamil Nadu, India. Email support@koodam.in with “privacy” in the subject. We acknowledge within 48 hours and answer within 30 days.