Legal
Privacy notice
What we collect, why, who processes it, how long we keep it, and your rights.
Last updated:
Purpose
What we collect, and why
- Name
- For the roster, check-in and your certificate.
- For your confirmation, tracking link, reminders and certificate.
- Mobile number
- For same-day messages if an event is cancelled or the meeting point moves.
- Age band, or age if under 18
- Some events have a minimum age. Under-18s need guardian consent and a guardian present.
- Guardian name and contact, for minors
- To record consent and reach someone if there is a problem.
- School, college or company, if you give it
- Optional. Used only for team allocation and a team leaderboard showing team names and counts, never individuals.
- Attendance
- Whether you checked in. Certificates and our published totals are based on attendance.
- What we do not collect
- No identity documents, no precise location tracking, and no advertising or cross-site trackers.
Lawful basis and consent
We rely on the consent you give when you register, for the purpose stated then. It is recorded with a timestamp and the version of the wording you agreed to.
You can withdraw consent at any time through the grievance route. This stops future messages and removes you from rosters. It cannot recall messages already sent, and we may keep a minimal attendance record where needed for safety or reporting obligations.
A parent or guardian gives consent for a minor. The consent page explains the waiver, guardian consent and media release.
Sub-processors
Who processes it
This website stores no personal data. Registration data is held by our registration desk, which runs on Cloudflare. We use these third parties only for hosting and messages:
- Website hosting
- Cloudflare hosts this website and the registration desk.
- Registration desk
- Registrations are taken at saveaturtle-register.pages.dev, run by OIAS for SAVEaTURTLE. It collects the details listed above.
- Google Workspace runs our email.
- SMS delivery
- An Indian SMS provider registered under DLT.
- WhatsApp messages
- Sent only to people who opted in, about an event they registered for. Never marketing.
Each gets only what it needs to deliver the message. We do not sell, rent or share your data with anyone else, including partners.
How long we keep it
- Registration and attendance
- The season plus 24 months, for returning volunteers and season totals.
- Certificates
- While the certificate can still be reissued.
- Message logs
- 12 months, for delivery troubleshooting and opt-outs.
- Guardian consent records
- As long as the law requires for events involving minors.
- After that
- Deleted, or reduced to a count that identifies nobody.
Your rights
Under the DPDP Act, 2023 you may ask for access to your data, correction, completion, erasure where we are not required to keep it, withdrawal of consent, and to nominate someone to act for you.
Use the grievance route. First response within 7 working days, resolution within 30 days. If you are not satisfied, you can escalate to the Data Protection Board of India.
This website
No advertising cookies, third-party analytics or social trackers. The home page animation runs in your browser and sends nothing from your device.
If we add analytics, this notice will be updated first.
Last updated: