Privacy Policy

1. Who We Are

Shivira Wellness ("we", "us") operates this website to present our sound healing and wellness offerings across India and to let you request a session. For the purposes of applicable data protection law — including the Digital Personal Data Protection Act, 2023 (India) — we act as the Data Fiduciary for the personal data described below, and you are the Data Principal.

2. What We Collect — and What We Deliberately Don't

The only personal data this website collects is what you voluntarily submit through the booking form:

• Full name
• Contact details (email address)
• Preferred service, date, and arrival time
• Optional notes you choose to add

In line with the principle of data minimisation — articulated in Article 5(1)(c) of the EU General Data Protection Regulation ("GDPR") and reflected in the purpose-limitation requirements of Section 6 of the DPDP Act, 2023 — we do not ask for, and ask that you do not submit, anything beyond what is needed to arrange your session. In particular:

• No cookies. This website sets no cookies of its own — no advertising, analytics, or preference cookies.
• No tracking. We run no analytics scripts, advertising pixels, fingerprinting, or behavioural profiling of any kind.
• No accounts. We do not create profiles or store credentials.
• No sale or sharing of data for marketing. Ever. Practices of unauthorised disclosure are precisely what Section 72A of the Information Technology Act, 2000 penalises, and we are aligned with both its letter and spirit.

If you include health-related details in the notes field (for example, allergies), you do so voluntarily so that we can tailor your session safely. Such information may constitute sensitive personal data under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") and "special category data" under Article 9 GDPR; we treat it with corresponding care, use it solely for conducting your session, and encourage you to share only what is relevant.

3. Why We Collect It (Purpose & Lawful Basis)

We process your booking data for one purpose: to receive, confirm, and prepare for your session, and to contact you about it. This processing rests on:

• Your consent, given when you submit the form — consistent with Sections 5–6 of the DPDP Act, 2023 (notice and free, specific, informed consent), Rule 5(1) of the SPDI Rules, 2011, and Article 6(1)(a) GDPR;
• The necessity of taking steps at your request prior to providing a service — Article 6(1)(b) GDPR.

Consistent with Section 6(4)–(6) of the DPDP Act, you may withdraw consent at any time by contacting us; we will then delete your booking details unless a legal obligation requires otherwise.

4. How Your Data Travels and Where It Rests

When you press "Confirm Booking", your form data is transmitted over an encrypted HTTPS connection to Web3Forms, a form-delivery service acting as our processor, which relays it to our private email inbox. Web3Forms retains submissions for 30 days, after which they are automatically deleted from its systems — an application of the storage-limitation principle in Article 5(1)(e) GDPR and the data-erasure expectations of Section 8(7) of the DPDP Act, 2023. The website itself is hosted on Vercel, which may process standard server logs (such as IP addresses) for security and operation of the service.

Encryption in transit and restricting access to a private inbox form part of the "reasonable security practices and procedures" contemplated by Section 43A of the Information Technology Act, 2000 read with Rule 8 of the SPDI Rules, 2011, and the security-safeguards obligation in Section 8(5) of the DPDP Act, 2023.

5. Third-Party Services We Rely On

• Web3Forms — delivers your booking form to our inbox; retains submissions 30 days.
• Vercel — hosts and serves this website over HTTPS.
• Google Fonts & content delivery networks — supply the typefaces and styling framework this site uses. When your browser fetches these resources, the provider technically receives your IP address as part of the request. No other information about you is shared with them by us.

6. Your Rights

Depending on the law applicable to you, you are entitled to:

• Access a summary of the personal data we hold about you — Section 11, DPDP Act, 2023; Article 15 GDPR;
• Correction and erasure of your data — Section 12, DPDP Act, 2023; Articles 16–17 GDPR;
• Grievance redressal — Section 13, DPDP Act, 2023 — and, in India, escalation to the Data Protection Board under the Act;
• Withdrawal of consent at any time, as described in Section 3 above.

To exercise any of these rights, contact us using the details below. We aim to respond within a reasonable period and in any event within the timelines applicable law prescribes.

7. Children

This website and our services are intended for adults. We do not knowingly collect personal data from children, and we do not undertake tracking or behavioural monitoring of children or targeted advertising of any kind, consistent with Section 9 of the DPDP Act, 2023. Sessions for minors may be arranged only by a parent or lawful guardian.

8. Changes to This Policy

If our practices change — for example, if we ever introduce analytics — we will update this page and revise the "last updated" date above before the change takes effect.

9. Contact

For any privacy question, request, or grievance, write to us at cr7fan74@gmail.com, or reach us through the booking page. We're a small sanctuary — a human reads every message.