What we collect, and why

Who we are

Vriksha Bonsai Circle, Bengaluru, runs this site and is the data fiduciary for it. That means we decide what is collected here, and we answer for it. Write to vrikshakalp.oct2027@gmail.com about anything on this page.

Post reaches us at Vriksha Bonsai Circle, Bengaluru, Karnataka, India.

What we collect, and what it is for

Registration. For every delegate on a payment: their name, nationality, email address and phone number, the pass they chose, and the bonsai club they belong to if they name one. The name goes on the badge and on the delegate’s invitation letter. The email and phone are how we reach you about the convention. We ask for nothing else, and we ask for it once.

Passport details. Only on the form for delegates registering from outside India: passport number, date of birth and passport expiry date. They are used for one thing — the visa invitation letter — and nothing else. They are never shown in a browser after you submit them, never printed on a receipt, and masked on the committee’s screens. They are deleted after 31 January 2028.

Payment. Nothing. Card, UPI and netbanking details go straight to Razorpay, our payment gateway. They never reach this site, and we never see or store them. What comes back to us is a payment reference, an amount, and whether it succeeded.

The contact form. Your name, your email address, the organisation you named if you named one, and your message. We use them to answer you.

Server logs. A one-way salted hash of your IP address and your browser’s user-agent string, kept so we can tell when one machine is flooding a form. The hash cannot be turned back into your address, and we never store the address itself.

Analytics. Vercel Analytics counts page views in aggregate. It sets no cookies, it does not follow you to other sites, and it tells us nothing about you as a person.

Why we are allowed to hold it

Consent. You give it when you submit the registration form or the contact form, and nothing on this site collects anything about you before you press a button. You can withdraw that consent at any time — see “Your rights” below. Withdrawing it after you have registered means we can no longer send you convention information, and it does not refund a fee.

How long we keep it

• ·Registration data — until twelve months after the convention ends, then anonymised.
• ·Passport details — until 31 January 2028, then deleted.
• ·Contact messages — twenty-four months.
• ·Hashed IP addresses — thirty days.

Razorpay keeps its own payment records for as long as Indian financial regulation obliges it to. We keep only the reference number.

Who else handles it

Four companies process data on our behalf. None of them sells it, and none of them uses it for advertising.

• ·Razorpay — takes the payment. Sees your name, email, phone and payment instrument.
• ·Supabase — hosts the database this site writes to. Holds the registration and contact records.
• ·Vercel — hosts the site and serves every page.
• ·Google — carries our email, sent over Gmail SMTP from the circle’s own address. Every registration email is copied to the organisers’ own mailbox.

We share your data with nobody else. We sell it to nobody at all.

Your rights

As a Data Principal under the Act, you may:

• ·ask what personal data of yours we hold, and what we have done with it;
• ·ask us to correct, complete or update anything that is wrong;
• ·ask us to erase it, except where a law obliges us to keep it;
• ·nominate someone to exercise these rights for you if you die or become unable to exercise them yourself;
• ·raise a grievance with us, and take it to the Data Protection Board of India if our answer does not settle it.

To do any of these, email vrikshakalp.oct2027@gmail.com with “DPDP” in the subject line and say which data you mean. We reply within thirty days. We may ask you one question to confirm you are who you say you are; we will not ask you for a document we do not already hold.

Grievance officer

Grievances go to the organising committee of Vriksha Bonsai Circle, at vrikshakalp.oct2027@gmail.com. If you are unhappy with how we have handled your data, write there first. As with the requests above, we reply within thirty days; if our answer does not settle it, you may take the grievance to the Data Protection Board of India.

Cookies and browser storage

No advertising cookies. No analytics cookies. No third-party trackers. If you only read this site, nothing is stored on your machine and there is no consent banner, because there is nothing to consent to.

Two strictly necessary exceptions. A committee member signing in to the admin area gets a session cookie from Supabase Auth. Razorpay sets its own cookies inside its checkout window while you are paying, under its own policy.

The registration form also keeps what you have typed in your own browser’s session storage, so a failed payment does not cost you the whole form. That never leaves your machine and it is gone when you close the tab.

Children

This convention is for adults. We do not knowingly collect data from anyone under eighteen. A delegate under eighteen should be registered by a parent or guardian, who consents on their behalf and whose contact details we use.

Changes to this page

If this page changes, the date at the top changes with it. If the change matters — a new processor, a longer retention period, a new purpose — we email everyone who has registered.