Privacy Policy

1.1 "Personal Data" means any data about an individual who is identifiable by or in relation to such data, whether recorded in digital form or collected in non-digital form and subsequently digitised.

1.2 "Data Fiduciary" means Cinevine Productions, the entity that determines the purpose and means of processing your Personal Data.

1.3 "Data Processor" means any third party that processes Personal Data on our behalf and on our instructions (e.g., our web hosting provider, payment gateway, or cloud storage vendor).

1.4 "Processing" means any operation performed on Personal Data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, or erasure.

1.5 "Consent Manager" means a person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review, or withdraw consent through an accessible, transparent, and interoperable platform, where applicable.

1.6 "Data Principal" means the individual to whom the Personal Data relates, and where such individual is a child, includes the parent or lawful guardian of such child.

1.7 "Child" means an individual who has not completed the age of 18 years.

4.1 Wherever we rely on your consent to process Personal Data, such consent is sought through a clear, standalone, and plain-language notice, presented before or at the time of collection, specifying:

• (a) the Personal Data being collected;
• (b) the specific purpose of such processing;
• (c) the manner in which you may exercise your rights as a Data Principal; and
• (d) the manner in which you may lodge a complaint with the Data Protection Board of India.

4.2 Your consent is free, specific, informed, unconditional, and unambiguous, and is given through clear affirmative action (e.g., ticking an unchecked box, clicking "Submit" on a form that displays this notice). We do not use pre-ticked boxes or bundle consent with our Terms.

4.3 You may withdraw your consent at any time, with the withdrawal being as easy as it was to give consent. Withdrawal will not affect the lawfulness of processing carried out before withdrawal, and may affect our ability to continue delivering Services already contracted for, in which case we will inform you of the consequences.

4.4 To withdraw consent, write to our Grievance Officer / Data Protection Contact listed in Section 15.

5.1 The Website uses cookies and similar tracking technologies to operate correctly, remember your preferences, and understand how visitors use the Website.

5.2 Types of cookies used:

• Strictly Necessary Cookies: required for core Website functionality (e.g., form submission, session management). These cannot be disabled.
• Analytics Cookies: (e.g., Google Analytics) help us understand aggregate visitor behaviour. These are set only after you provide consent via our cookie banner.
• Marketing/Advertising Cookies: (e.g., Meta Pixel) may be used to measure the effectiveness of our advertising and to show you relevant content on other platforms. Set only with your consent.

5.3 You can control or disable cookies through your browser settings at any time. Disabling non-essential cookies will not prevent you from using the core functionality of the Website but may affect analytics accuracy and personalisation.

5.4 We do not use cookies to track children for behavioural monitoring, targeted advertising, or profiling purposes.

We do not sell your Personal Data. We disclose Personal Data only in the following circumstances:

• 6.1 Data Processors acting on our instructions: including website hosting, cloud storage, payment gateway providers, email service providers, and analytics tools.
• 6.2 Sub-contracted photographers, videographers, editors, or second shooters: engaged by us to fulfil your booking, bound by strict confidentiality obligations.
• 6.3 Legal and regulatory disclosures: where required to comply with a legal obligation, court order, or lawful request from government authorities.
• 6.4 Business transfers: in the event of a merger, acquisition, or sale of business assets.
• 6.5 Processor safeguards: All Data Processors we engage are contractually bound to process Personal Data only as per our instructions and implement security safeguards.

7.1 Certain Data Processors we use (e.g., cloud storage or analytics providers) may store or process data on servers located outside India.

7.2 The DPDP Act follows a negative-list approach: your Personal Data may be transferred outside India except to countries specifically restricted by the Central Government. As of the date of this Policy, no such restricted list has been notified.

7.3 Where data is transferred outside India, we require our processors to maintain security standards consistent with this Policy.

8.1 We retain your Personal Data only for as long as necessary to fulfil the purposes described in Section 3, or as required by applicable law (typically up to 8 years for financial and tax records).

8.2 Booking and communication data is retained for the duration of our engagement and for a reasonable period thereafter for warranty, dispute, and portfolio-consent tracking purposes.

8.3 Photographs and videographs delivered as part of Services are retained on our systems for backup purposes for 12 months post-delivery, after which they may be archived or deleted, unless a longer retention is separately agreed with you.

8.4 Where you withdraw consent or request erasure, we will erase your Personal Data unless retention is necessary for legal compliance or defending legal claims.

9.1 We implement reasonable security safeguards appropriate to the nature of Personal Data processed, including:

• Encryption of data in transit (HTTPS/TLS) across the Website;
• Access controls restricting Personal Data access to authorised personnel only;
• Secure storage of payment-related metadata with our PCI-DSS compliant payment gateway partner;
• Regular review of third-party processor security practices;
• Logging and monitoring to detect unauthorised access.

9.2 No method of electronic transmission or storage is 100% secure. While we strive to protect your Personal Data, we cannot guarantee absolute security.

10.1 As part of our creative Services, we capture photographs and video/audio recordings that may identify you and your guests. This is separate and additional to general Website data processing.

10.2 Portfolio and marketing use of your wedding photographs/films (on our Website, social media, print portfolio, or client showcases) is done only with your explicit, separate consent, obtained at the time of booking via our Service Agreement/booking form.

10.3 If you do not wish for your photographs/films to be used for portfolio or marketing purposes, you may opt out at any time by writing to us at hello@cinevines.com. We will honour opt-out requests for future use but cannot retroactively recall material already published prior to your request.

10.4 We do not sell, license, or share your wedding photographs/films with any third party for commercial purposes unrelated to the delivery of your Services or our own portfolio/marketing use, without your separate written consent.

11.1 Weddings frequently involve the presence and photography of children. Where our Services involve the Personal Data of a Child (including their likeness in photographs/videos), we process such data only:

• (a) with the verifiable consent of the child's parent or lawful guardian; and
• (b) in a manner that does not involve tracking, behavioural monitoring, or targeted advertising directed at children.

11.2 By booking our Services or submitting enquiry forms containing information about children attending the event, you confirm that you are their parent/lawful guardian, or that you have obtained the necessary consent from their parent/lawful guardian.

Subject to applicable law, you have the right to:

• 12.1 Right to Access: obtain a summary of the Personal Data we hold about you and the processing activities undertaken.
• 12.2 Right to Correction and Completion: request correction of inaccurate or misleading Personal Data, and completion of incomplete Personal Data.
• 12.3 Right to Erasure: request erasure of Personal Data that is no longer necessary for the purpose it was collected.
• 12.4 Right to Withdraw Consent: withdraw consent at any time, as described in Section 4.3.
• 12.5 Right of Grievance Redressal: raise a grievance regarding our processing of your Personal Data with our Grievance Officer (Section 15), and if unresolved, escalate it to the Data Protection Board of India.
• 12.6 Right to Nominate: nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.