---

2) What this policy covers

This policy applies to personal data we process in connection with:

• Our website(s) and contact forms

• Consulting, marketing, performance, SEO, design/printing and event services

• Personal branding services for founders/executives

• Medical empanelment support for hospitals and institutions

• Email, phone, WhatsApp and other communications with you

This policy does not apply to third‑party websites, apps or services that link to or from our website. Please review their policies separately.

---

3) The data we collect

We collect the following categories of personal data, depending on your interaction with us:

• Identity & Contact Data: name, company, role, email, phone/WhatsApp, postal address.

• Business & Engagement Data: service interests, project briefs, budgets, proposals, contracts, feedback, testimonials.

• Website/Technical Data: device and browser, IP address, general location (city/region), referral URLs, pages viewed, session duration, cookies and similar identifiers.

• Marketing & Communications Data: newsletter preferences, campaign engagement (opens/clicks), form submissions, event registrations.

• Event Operations Data: attendee lists, speaker bios, vendor contacts, emergency contact details required by venues/authorities, photographs/video captured at events.

• Empanelment/Institutional Data (B2B): authorised signatory details, hospital/clinic documentation with contact information of administrators and relevant staff.

• Payment/Commercial Data: purchase history, invoices, GST details, limited payment references (we do not store full card/bank credentials; these are processed via payment partners).

We do not intentionally collect personal data of children (persons under 18 years). See Section 10.

---

4) Sources of data

• Directly from you when you fill a form, email/WhatsApp us, sign a proposal, or attend an event.

• Automatically when you use our website (cookies, analytics).

• From third parties such as advertising platforms, event partners, referral partners, or public sources (e.g., LinkedIn, public websites) as permitted by law.

---

5) Why we process your data (purposes)

We process personal data to:

1. Provide and improve services—consulting, campaigns, content, design/print, events, empanelment support.

2. Respond to enquiries—demo requests, quotes, support.

3. Plan and run events—registrations, access control, safety and vendor coordination.

4. Send service communications—project updates, invoices, policy notices.

5. Marketing (with your consent or as permitted)—newsletters, invites, case studies and helpful resources.

6. Measure and secure—analytics, troubleshooting, preventing fraud or abuse.

7. Comply with law—record keeping, taxation, responding to legal requests.

Under the DPDP Act, we rely on consent (for example, newsletter subscriptions) and permitted uses under law (e.g., service delivery, security, compliance) as applicable.

---

6) Cookies & similar technologies

We use cookies and similar technologies to enable site functionality, understand usage and improve content. You can manage cookies through your browser settings and, where provided, our on‑site preferences banner. Disabling certain cookies may affect some features.

---

7) Sharing your data

We share data only as needed and with appropriate safeguards:

• Vendors/Processors: hosting, cloud storage, analytics, marketing/advertising platforms (e.g., Google, Meta, WhatsApp Business), email/SMS tools, design/print partners, logistics providers, event venues and production vendors.

• Professional advisors: accountants, auditors, legal counsel.

• Authorities: where required by law, court order or to protect our rights, users or the public.

• Business transfers: in connection with a merger, acquisition or reorganisation, subject to continued protection of your data.

We do not sell personal data.

---

8) International transfers

Our vendors may process data in countries outside India. Where such transfers occur, we take reasonable steps to ensure comparable protection, consistent with Indian law and contractual safeguards with our processors.

---

9) Data retention

We keep personal data only for as long as necessary for the purposes described above, and to meet legal, accounting or reporting requirements. Typical retention ranges from 12 to 36 months from last interaction for marketing data, and 7 years for invoices and statutory records, unless a longer/shorter period is required by law or agreed with you.

---

10) Children’s data

Our services and website are not intended for individuals under 18 years. We do not knowingly collect personal data from children. If you believe a child has provided data to us, please contact us and we will take appropriate steps to delete it or obtain necessary consents.

---

11) Your rights & choices (India)

Subject to applicable law, you have the right to:

• Be informed about our data practices.

• Access your personal data we process.

• Correct and update inaccurate or incomplete data.

• Delete personal data that is no longer necessary for the purpose it was collected or where consent is withdrawn.

• Withdraw consent at any time for processing based on consent.

• Grievance redressal where you are dissatisfied with our response.

• Nominate another individual to exercise these rights in the event of death or incapacity, where applicable under law.

We will respond to verified requests within a reasonable time (normally 30 days). Certain requests may be limited by legal or regulatory requirements.

---

12) How to exercise your rights

Email us at info@crazarminds.com with the subject line “Data Rights Request – Crazar Minds.” We may need information to verify your identity and understand your request. If you are unhappy with our response, you may escalate to the designated authority under Indian law when notified by the government.

---

13) Security

We use reasonable technical and organisational measures to protect personal data, including access controls, encryption in transit, and restricted employee access on a need‑to‑know basis. No method of transmission or storage is fully secure; please use secure channels when sharing sensitive information.

---

14) Event‑specific notes

For events we manage, we may share limited attendee information with venues, security providers and authorities where required for access control, safety and compliance. Photography/videography may be conducted for documentation and marketing; notices will be displayed at the venue and consent obtained where required.

---

15) Empanelment‑specific notes (B2B)

For medical empanelment/institutional support, we process contact details of authorised representatives and statutory documentation to prepare and submit applications. We do not collect or process patient medical records unless explicitly agreed in writing for a defined purpose and with appropriate safeguards.

---

16) Marketing communications

You can opt out of marketing emails at any time by clicking unsubscribe in our emails or contacting us. You may still receive essential service communications (e.g., invoices, policy updates).

---

17) Third‑party links

Our website and materials may link to third‑party websites. We are not responsible for their content or privacy practices. Review their policies before sharing data with them.

---

18) Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will reflect the most recent changes. Significant changes will be communicated via our website or email where appropriate.