Privacy Policy

1. Who we are (Data Controller / Data Fiduciary)

Nitya Panchangam operates the website nityapanchangam.com. For the purposes of India's Digital Personal Data Protection Act 2023 (DPDP), we are the Data Fiduciary. For the purposes of the EU General Data Protection Regulation (GDPR), we are the Data Controller. For California residents under CCPA, we are the Business.

Registered contact: use the Contact page. Grievance Officer contact for India DPDP-related complaints: same page.

2. Data we collect

• Analytics (only with consent): Google Analytics 4 (property G-8TF95LBYRV) — anonymized page views, device type, browser, referrer, coarse geolocation (city-level, from IP). IP address is anonymized before storage per Google's IP-anonymization setting.
• City preference: if you select a city for panchangam, we store the choice in your browser's localStorage. It never leaves your device.
• Consent record: your cookie-banner choice is stored in localStorage as np-consent-v1. It never leaves your device.
• Contact form / email: if you email us via the Contact page, we retain the email and its contents for up to 3 years to resolve your request and for our records.
• What we do NOT collect: we do not require registration, we do not collect names, phone numbers, addresses, birth dates, or any special-category (sensitive) personal data. If you provide birth data for a kundli/horoscope calculation, it is computed client-side and never transmitted to our servers.

3. Purposes & legal basis

Purpose	Legal basis (GDPR Art.6)	DPDP §7
Serve the site + city panchangam	Legitimate interest / performance of service	Specified purpose (Explicit Consent for cookies)
Analytics + performance measurement	Explicit consent (Art.6(1)(a))	Explicit consent (§6)
Respond to your email / support	Legitimate interest	Specified purpose
Legal compliance (records)	Legal obligation (Art.6(1)(c))	Legal function

4. Data sharing (third parties)

• Google LLC (Analytics 4): we transmit anonymized analytics events with your consent. Processed under Google's privacy policy. Servers may be located outside India / EU (see §7 International Transfers).
• Amazon.in (affiliate links): when you click an Amazon product link (tagged digitalshala4-21), Amazon may set its own cookies and process your data under Amazon's privacy policy. We receive only aggregated commission reports, not identifiable browsing data.
• Hostinger (hosting): server logs (IP, user-agent, timestamp) are processed by our hosting provider for security and network operation. Retained per Hostinger policy (~30 days for access logs).
• WhatsApp (channel link): if you click through to our WhatsApp channel, WhatsApp/Meta's policies apply.
• We do not sell or rent your personal data. We do not run behavioral advertising cookies unless you explicitly opt in.

5. Data retention

• Google Analytics: 14 months (Google's minimum), then auto-deleted.
• Contact emails: up to 3 years, then deleted.
• Consent state (np-consent-v1): until you clear browser storage.
• Server access logs: ~30 days.

6. Your rights

All users

• Withdraw consent at any time (reopen banner — see Cookie Policy).
• Object to processing.
• Request access to any personal data we hold on you.
• Request correction or deletion (erasure).
• Request portability (structured, machine-readable export).
• Complain to your supervisory authority.

EU / UK (GDPR Art. 13-22)

Rights above + right to restriction of processing (Art. 18) + right to lodge a complaint with your national Data Protection Authority (list at edpb.europa.eu).

California (CCPA / CPRA)

Right to know what personal information is collected, disclosed, sold; right to delete; right to correct; right to opt out of "sale" (we do not sell); right to limit use of sensitive personal information (we do not process any); right to non-discrimination. Requests: Contact page.

India (DPDP Act 2023)

Right to access, correction, erasure, grievance redressal (§11-13), right to nominate. Grievance Officer: contact via the Contact page — mark subject "DPDP Grievance". Response within 15 days. If unresolved, complain to the Data Protection Board of India.

7. International data transfers

Google Analytics may process data outside India / EU (US, Ireland, other Google regions). Google is bound by the EU-US Data Privacy Framework and Standard Contractual Clauses. If you are in India, the DPDP Act permits transfers to territories not specifically restricted by the Central Government.

8. Cookies

See the dedicated Cookie Policy. In short: strictly-necessary cookies are always active; analytics + advertising cookies only fire after explicit opt-in via the banner; you can withdraw consent at any time.

9. Do Not Track

We honor the DNT (DNT: 1) browser header. Analytics remains denied even if you accepted the banner, as long as DNT is on.

10. Children's privacy

The site is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

11. Security

The site is served over HTTPS with HSTS preload; Content Security Policy limits which origins can execute scripts; strict-origin-when-cross-origin referrer policy prevents URL leakage across sites. No system is perfectly secure — we mitigate known risks and disclose breaches per DPDP §8 / GDPR Art. 33-34 if they occur.

12. Changes to this policy

We may update this policy to reflect legal changes or new features. The "Last updated" date at the top always reflects the current version. Material changes will be flagged in the cookie banner on your next visit.

13. Contact

All privacy queries + DPDP grievance requests: Contact page. Please mark subject line with "Privacy" or "DPDP Grievance" as appropriate.