Privacy Policy

1. Who we are

This ticketing platform is operated by Christ (Deemed to be University) (Christ University Arts & Events), Christ University Campus, Hosur Road, DRC Post, Bengaluru – 560 029, Karnataka, India. This policy explains what personal data we collect when you use booking.christuniversity.in, why we use it, and the rights you have over it.

2. Data we collect

• Booking details — your name and email address (and phone number, if you provide one).
• Order information — the events, shows, seats/tickets you select and your order history.
• Payment status — confirmation of success/failure and a payment reference from our payment provider. We do not receive or store your card number, UPI PIN, or bank credentials.
• Entry / scan logs — the time and gate at which your ticket QR code is scanned, for access control and fraud prevention.
• Technical & usage data — device/browser information, and analytics/session identifiers (including cookies) used to run and improve the site.

3. Why we use your data (purposes)

• To process your order and deliver your ticket.
• To validate entry at the venue and prevent duplicate or fraudulent scans.
• To provide customer support and send transactional messages (order and ticket emails).
• To understand site usage through analytics and to keep the platform secure.
• To meet legal, accounting and tax obligations.

4. Payment data

Payments are processed by Razorpay, a third-party payment provider. Your card/UPI/bank credentials are entered on and handled by the payment provider and are not stored as raw credentials by Christ University Arts & Events. Please also review Razorpay's own privacy policy.

5. Cookies & analytics

We use necessary cookies and session identifiers to operate the booking — to hold your seats, carry your basket to payment and keep the checkout secure. These are used without consent because the booking you asked for cannot be delivered without them.

Everything else runs on your consent, given on the cookie banner and changeable at any time through the Cookie settings link in the footer of this site.

With your analytics consent we use Google Analytics 4, Google Tag Manager and Microsoft Clarity to measure how the site is used. When an order is completed, our server also reports that purchase to Google Analytics — but only where an analytics identifier from your browser was recorded with the order. That report contains the analytics identifier, your order number, the amount and currency, and the event and seat or zone booked. It does not contain your name, email address or phone number.

With your marketing consent we use the Meta Pixel in your browser and Meta's Conversions API on our server, to measure how our advertising performs. The server report of a completed purchase is sent only where marketing consent was in force when you placed the order. It contains a one-way (SHA-256) hash of your order number, Meta's own browser identifiers (the _fbp and _fbc cookies), the amount and currency, the number of tickets, and the time of purchase. It does not contain your name, email address, phone number or IP address.

Turning marketing off. Withdrawing is as easy as giving: open Cookie settings in the footer and choose Reject All, or turn off Marketing Cookies and save. Your browser tells our server and keeps trying until the server confirms it has been saved — after a lost connection, or the next time you open the site. From the moment it is saved, we start no new report to Meta about orders placed in this browser in the last 30 days. We cannot stop a report already sent, nor one already on its way, and until your choice reaches our server a report may still be sent. Your choice is linked to your orders through the session identifier stored in this browser: a choice made in another browser, on another device, or after clearing this site's cookies cannot be linked to an earlier order.

Turning marketing off does not stop the Google Analytics purchase report described above, which follows your analytics consent. To prevent that report, decline analytics cookies before booking.

6. Who we share data with

We share the minimum necessary data with: our payment provider (Razorpay) to take payment; our email delivery provider to send tickets and confirmations; venue / event staff for entry validation; and our analytics and advertising measurement providers(Google, Meta) as described in section 5. Neither Google nor Meta receives your name, email address or phone number from us, and Meta receives nothing from our server without your marketing consent. We do not sell your personal data. We may disclose data where required by law.

7. How long we keep it

We keep personal data only for as long as the purpose it was collected for is still being served, or for as long as Indian law requires us to keep it — whichever is longer. Where a statute sets the period, the statute governs and we cannot delete the record earlier, even on request.

• Order, payment and ticket records — retained as accounting records for the period required of books of account under the Companies Act, 2013, and of tax records under the GST and income-tax legislation. This is a legal obligation, not a choice.
• Consent records — the record of what you agreed to, and when, is kept for as long as the data it authorises, and afterwards for the period in which a claim relating to the transaction can still be brought under the Limitation Act, 1963. Consent records are append-only: a withdrawal is added as a new entry and never erases the earlier agreement.
• Technical and security logs — retained for at least 180 days within India, as directed by CERT-In under section 70B(6) of the Information Technology Act, 2000.
• Marketing contact data — kept until you withdraw consent, and erased or anonymised once the purpose is no longer being served, in line with the Digital Personal Data Protection Act, 2023.

Withdrawing consent stops further use of your data for that purpose. It does not delete records we are legally required to keep, such as the accounting record of a completed purchase.

8. Your rights

Under India's Digital Personal Data Protection Act, 2023 you may ask us to access a summary of the personal data we hold about you and how we use it, to correct, complete or update it, and to erase it where we are not required to keep it. You may nominate another person to exercise these rights on your behalf in the event of your death or incapacity.

You may withdraw consent at any time, as easily as you gave it: marketing and analytics cookies through the Cookie settings link in the footer, anything else by writing to the contact below. Withdrawal stops further use of your data for that purpose. It does not make our earlier use of it unlawful, and it does not delete records a statute requires us to keep — see section 7.

To exercise any of these, or to raise a grievance, contact us using the details below; we acknowledge and respond within the timelines stated there. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

9. Data-privacy & grievance contact

Grievance Officer – Booking Support — musicstudiobookings@christuniversity.in. We acknowledge requests within 48 hours and aim to resolve them within 30 days.