Privacy Policy | Tracklist India

Draft, for legal review. This document has not yet been approved by counsel.

Who we are

Tracklist India ("Tracklist", "we", "our") is an independent Indian music publication available at tracklist.in. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, the Data Fiduciary is [PLACEHOLDER: legal entity name], [PLACEHOLDER: registered address]. You can reach us about any privacy matter at connect@tracklist.in.

This policy applies to personal data we process in India through our website, newsletter and related services. It is written to give you the notice the DPDP Act requires, in clear and plain language.

Personal data we collect

Data you give us: your email address and the lists you choose (Playlists, Weekly newsletter) when you sign up for our playlists or newsletter, along with the time you signed up, the page you signed up from and the consent wording you agreed to, and your name, email address and message when you write to us, send a correction or raise a grievance.
Data collected automatically: limited technical data needed to deliver the site securely, such as IP address, browser type, device type and pages requested, held in server logs.
Choices stored on your device: your cookie and embedded content preferences, stored in your browser so we can respect them.

We do not knowingly collect sensitive categories of information, and we do not ask for government identifiers, financial details or passwords.

Purposes and legal basis

We process personal data only for lawful purposes and on one of the grounds the DPDP Act allows.

Consent: sending the newsletter, loading third-party embedded players (such as the Spotify player on our Charts pages), loading third-party advertising and its cookies (such as Google AdSense or Google Ad Manager, when we switch them on) and any optional analytics we may introduce later. Without this consent we show only our own house adverts, which use no cookies. We ask for consent through a clear, specific and unambiguous action, and each request names its purpose.
Certain legitimate uses (Section 7 of the DPDP Act): responding to a message you have voluntarily sent us for that purpose, keeping the site secure, and complying with law, court orders or requests from authorities that are made lawfully.

We will not use your personal data for a purpose that is not described here without giving you fresh notice and, where needed, asking for fresh consent.

What we collect: your email address, the lists you choose, the date and time, the page you signed up from and the exact consent wording shown to you. To stop abuse we briefly keep a scrambled (hashed) form of your IP address, deleted within 10 minutes.
Purpose: to email you our playlists and, if you choose it, the weekly newsletter. We do not sell your email address or use it for anything else.
Where it is stored: in a database run for us by our hosting provider, acting as our Data Processor.
Retention: until you unsubscribe; we then delete your details within 30 days.
Unsubscribe: every email has a one-click unsubscribe link, or write to connect@tracklist.in.
Grievances: contact our Grievance Officer through the Grievance Officer page or at connect@tracklist.in.

You can withdraw consent at any time, as easily as you gave it. Use the unsubscribe link in any newsletter, change your choices through Cookie settings in the site footer, or write to connect@tracklist.in. Withdrawal does not affect processing that took place before it. Once you withdraw, we stop the related processing within a reasonable time, and we ask any Data Processor acting for us to do the same.

Where a registered Consent Manager is available under the DPDP Act, you may also use it to give, manage, review or withdraw consent.

Your rights as a Data Principal

Under the DPDP Act you have the right to:

obtain a summary of the personal data we process about you and the processing activities involved, and the identities of any Data Fiduciaries and Data Processors we have shared it with;
correct, complete or update inaccurate or incomplete data, and have data erased when it is no longer needed for the purpose it was collected for, unless we must keep it by law;
have a readily available means of grievance redressal, as set out below;
nominate another person to exercise your rights in the event of your death or incapacity.

To exercise any right, write to connect@tracklist.in with the subject line "Data request". We may ask for information needed to verify that the request comes from you. We aim to respond within the period prescribed under the DPDP Act and its rules, and in any case without undue delay.

Your duties

The DPDP Act also places duties on Data Principals, including not impersonating another person, not suppressing material information when providing data for a document or identifier, and not registering false or frivolous grievances.

Children

Tracklist India is a general-audience publication. We do not knowingly process the personal data of anyone under 18 without verifiable consent from a parent or lawful guardian, and we do not track, monitor behaviour or target advertising at children. If you believe a child has given us personal data without that consent, write to connect@tracklist.in and we will erase it.

We do not sell personal data. We share it only with Data Processors that help us run the site, such as hosting, email delivery and security providers, under contracts that require them to process data only on our instructions and to protect it. We may disclose data where the law requires it.

Where your data is processed

We prefer to store and process data in India. Where a service provider processes data outside India, we do so only to the extent permitted by the DPDP Act and any restrictions notified by the Central Government.

Retention

Playlist and newsletter sign-ups: until you unsubscribe, then deleted within 30 days.
Messages, corrections and grievances: for as long as needed to deal with them and keep an accurate record, generally up to three years.
Server logs: up to 90 days unless needed to investigate a security incident.

We erase personal data once the purpose is served and retention is no longer required by law.

Security and breaches

We use reasonable security safeguards, including encrypted connections, access controls and limited data collection. If a personal data breach occurs, we will inform the Data Protection Board of India and affected Data Principals in the form and manner prescribed.

Grievances

If you have a concern about how we handle your personal data, contact our Grievance Officer through the Grievance Officer page or at connect@tracklist.in. If you are not satisfied with our response, you may approach the Data Protection Board of India after exhausting this process.

Changes to this policy

We will post any changes on this page with a new "last updated" date, and will tell newsletter subscribers about material changes.