Privacy Policy & Data Protection Notice

1. Key Privacy Highlights

2. Scope & Applicability

This Privacy Policy applies to all individuals ("Data Principals", "Users", "Parents", or "Guests") who:

• Visit or interact with our public website (https://www.taurra.in);
• Install, register, or use our mobile applications available on the Google Play Store or Apple App Store;
• Visit any of our physical taurra indoor play centres, kiosks, or reception desks across Kolkata and other cities;
• Sign digital or physical safety waivers, buy play passes, book birthday parties, or place orders at our play centre cafés;
• Communicate with our customer support teams via phone, SMS, WhatsApp, or email.

3. Personal Data We Collect

We collect data strictly to provide safe, delightful, and seamless family play experiences. Data categories include:

A. Information Provided Directly by Parents and Guardians

• Parent / Guardian Profile: Full name, mobile phone number, email address, and home city or PIN code.
• Authentication Credentials: Passwords (encrypted using secure cryptographic hashing) and One-Time Password (OTP) verification tokens.
• Child / Minor Information: Minor child’s first and last name (or nickname), age, date of birth, gender, and emergency contact numbers.
• Safety & Medical Notes (Voluntary): Any allergies, physical limitations, or special assistance needs shared voluntarily by parents on digital waivers so our staff can ensure a safe environment.
• Bookings & Party Details: Chosen play packages, session time slots, event dates, guest counts, special theme requests, and café food preferences.
• Support Communications: Inquiries, feedback, and customer support conversations submitted via our contact forms, WhatsApp support channels, or emails.

B. Information Collected Automatically Through App & Website Usage

• Device & Technical Identifiers: Device brand and model, operating system version, unique device identifiers (such as Android ID or vendor ID), network carrier, and internet protocol (IP) address.
• Log & Diagnostic Data: App launch timestamps, feature interactions, crash logs, and performance metrics collected solely to detect technical glitches, fix crashes, and enhance stability.
• Session & Website Telemetry: Browser type, referring URLs, pages viewed on taurra.in, and essential session state tokens.

C. Information Collected at Physical Play Centres

• RFID Wristband & QR Pass Scanning: Entry and exit timestamps, play duration tracking, and overtime calculation to ensure child accountability and prevent unauthorized departures.
• CCTV Footage: Closed-circuit video surveillance operating continuously in public reception areas, play zones, and entry/exit points for the safety and security of children, parents, and staff.
• Digital Safety Waiver Signatures: Digital signatures and timestamps acknowledging play zone rules and terms.

4. Children's Privacy & Safety (DPDP Act Compliance)

In accordance with Section 9 of the Digital Personal Data Protection Act, 2023 (DPDP Act) of India:

• Verifiable Parental Consent: We do not knowingly permit minors under 18 to create independent accounts or purchase bookings. All child profiles, party reservations, and safety waivers must be registered and authorized by a parent or legal guardian.
• No Behavioral Tracking or Profiling: We do not engage in tracking, behavioral monitoring, or profiling of children. We do not construct advertising profiles based on a child’s activity or preferences.
• Zero Targeted Advertising: We never serve targeted or behavioral advertisements directed at children.
• Data Minimization: We only collect the minimal child information required for admission control, age-appropriate play equipment allocation, and emergency medical response.
• Parental Control & Deletion: Parents and guardians have the absolute right to inspect, update, or request immediate deletion of their child’s profile from our active systems at any time.

5. How We Use Personal Data

• To Provide & Manage Services (Contractual Performance): Processing play pass purchases, issuing QR tickets and wristbands, managing birthday parties, recording entry/exit times, and generating GST-compliant tax invoices.
• Child Protection & Operational Safety (Legitimate Use): Matching minors to their registered guardians during check-out, ensuring emergency contacts are instantly accessible, and preventing unauthorized child departures.
• Transactional Communications: Sending booking confirmations, OTP login codes, payment receipts, session expiry reminders, and critical service notifications via SMS, WhatsApp, and email.
• Customer Support: Responding to questions, resolving complaints, processing refund requests, and assisting with birthday customizations.
• App Performance & Security: Diagnosing crash dumps, preventing fraud or ticket forgery, securing user accounts, and monitoring network integrity.
• Statutory & Regulatory Compliance: Retaining mandatory financial and billing records as required under Indian taxation (GST) and corporate laws.

6. Payments & Financial Information

Online payments on our website, mobile application, or on-site POS kiosks are processed securely through RBI-licensed, PCI-DSS compliant third-party payment aggregators (such as Razorpay):

• No Card Storage by taurra: We do not collect, process, or store sensitive payment card credentials, CVV codes, UPI MPINs, or net banking passwords on our servers.
• Information Received from Gateway: We receive only non-sensitive transaction tokens, order identifiers, payment method types (e.g. UPI, Net Banking, Credit Card), transaction timestamps, and payment status (Success/Failed) to generate your booking invoice.

7. Mobile App Permissions & Diagnostics

We do not access your microphone, contacts list, call logs, SMS inbox, or continuous background GPS location.

8. Sharing & Third-Party Disclosures

We do not sell, rent, monetize, or disclose your personal data or your children's data to third parties for their independent commercial or advertising purposes.

• Payment Gateway Partners: RBI-authorized payment processors (e.g., Razorpay) to complete cashless transactions securely.
• Communication Service Providers: Telecom SMS gateways, WhatsApp Business API partners, and transactional email providers to deliver your OTPs and booking receipts.
• Cloud & Database Hosting Providers: Secure, enterprise-grade cloud servers located within the territory of India adhering to strict ISO/IEC 27001 and SOC-2 data security standards.
• Legal & Regulatory Authorities: Law enforcement agencies, courts, or government bodies when legally compelled by valid court orders, summons, or statutory obligations.

9. Data Security & Storage in India

• Data In Transit: All communications between your device, our website, and mobile apps are encrypted using modern Transport Layer Security (TLS 1.2 / TLS 1.3) protocols.
• Data At Rest: Databases and server backups are encrypted with industry-standard encryption protocols. Passwords and sensitive authentication tokens are irreversibly hashed.
• Role-Based Access Control (RBAC): Access to customer and child data is restricted strictly to authorized branch personnel on a need-to-know basis.
• Data Residency in India: All personal data of Indian residents is stored and processed on secure cloud servers located within the Republic of India.

10. Data Retention & Archival

• Active User Accounts: Retained for the duration your account is maintained. You can request deletion at any time.
• Tax & Financial Records: Invoices, payment transaction logs, and GST records are retained for the statutory period mandated under Indian tax and corporate laws (typically up to 8 financial years).
• Safety Waivers: Digital safety waivers and check-in records are retained in compliance with applicable statutory limitation periods for tort and liability claims.
• CCTV Video Recordings: Stored on rolling digital video recorders (DVR) and automatically overwritten every 30 to 60 days, unless preserved for a specific safety incident or inquiry.

11. Account & Personal Data Deletion Policy

You can request account and data deletion using any of the following methods:

Method 1: Inside the Mobile Application

1. Open the taurra app on your Android or iOS device;
2. Log in to your account and navigate to Profile > Settings;
3. Tap Account Settings > Delete Account;
4. Confirm your request. Your account will be immediately scheduled for permanent erasure.

Method 2: Email or Online Request

1. Send an email from your registered email address to{' '} privacy@taurra.in or{' '} info@taurra.in with the subject line:{' '} "Account & Data Deletion Request";
2. Provide your registered mobile number and full name;
3. Alternatively, submit a request via our Contact Page at https://www.taurra.in/contact.

What Happens When You Delete Your Account:

• Immediate Action: Your account will be deactivated, and you will no longer receive marketing communications.
• Within 30 Days: Your personal identity details (name, phone number, email, address), saved preferences, and all associated child profiles will be permanently erased or irreversibly anonymized from our production databases.
• Statutory Exceptions: Financial transaction logs and GST invoices will be retained in archival form as required by Indian taxation statutes, but will be completely unlinked from active profiles.

12. Your Rights as a Data Principal

• Right to Access: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Completion: You may request the correction of inaccurate data or completion of incomplete personal information.
• Right to Erasure: You may request the deletion of your personal data when it is no longer needed for the purpose it was gathered.
• Right to Grievance Redressal: You have the right to readily available means of grievance redressal provided by us.
• Right to Nominate: You may nominate an individual who, in the event of death or incapacity, shall exercise your rights under the DPDP Act.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time.

13. CCTV Surveillance & Photography

• On-Premises CCTV: For child security and accident prevention, high-definition CCTV operates in reception areas, play zones, and entry/exit points.
• Family Photography: Parents are welcome to photograph their children, but are requested to respect other families' privacy.
• Promotional Media Opt-Out: If you prefer that you or your child not appear in promotional materials, notify staff or email info@taurra.in for immediate opt-out.

14. Cookies & Web Telemetry

Our website uses only essential and functional cookies to ensure proper operation, navigation, and preference memory. We do not use third-party behavioral advertising cookies or cross-site tracking.

15. Grievance Officer & Contact Information

16. Updates to This Policy

We may update this Privacy Policy periodically. When changes are published, we will revise the "Last updated" date. For significant modifications, notice will be provided via our website or mobile apps.