Privacy Policy

1. Introduction

Peoples International Film Festival of India (hereinafter referred to as "PIFFI", "we", "us", or "our") is committed to protecting and respecting the privacy of all individuals who interact with our festival, website, and related services. This Privacy Policy explains how we collect, use, store, share, and protect your personal data.

This Policy applies to all attendees, filmmakers, film submission applicants, delegates, volunteers, sponsors, partners, jury members, accreditation holders, and visitors to our website (collectively, "you" or "Data Principal").

By accessing our website, submitting a film, registering for the festival, or otherwise engaging with PIFFI, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy.

2. Data Fiduciary / Data Controller

The Data Fiduciary (as defined under the DPDP Act, 2023) responsible for your personal data is:

Peoples International Film Festival of India
Address: 6, Malviya Nagar, Raj Bhawan, Bhopal-462003
Email: info@piffi.in
Phone: +91 95899 83990
Website: www.piffi.in

3. Personal Data We Collect

We collect the following categories of personal data:

3.1 Identity and Contact Information

• Full name, date of birth, nationality
• Email address, mobile number, postal address
• Photographs or videos submitted for accreditation or press credentials
• Government-issued identification details (where required for accreditation or legal compliance)

3.2 Film Submission Information

• Film title, synopsis, genre, language, duration, and year of production
• Director, producer, and cast biographical details and contact information
• Screener links, promotional materials, and supporting documents
• Submission fee payment details (processed through secure third-party payment gateways)

3.3 Registration and Ticketing Information

• Delegate/attendee registration details including name, affiliation, and contact information
• Ticket purchase records and payment information (card details are never stored by us — processed by PCI-DSS compliant payment partners)
• Dietary preferences or accessibility requirements where voluntarily provided

3.4 Technical and Usage Data

• IP address, browser type and version, device type and operating system
• Pages visited, time spent on pages, referring URLs, and navigation patterns
• Cookie identifiers and similar tracking technologies (see Section 8)

3.5 Communications Data

• Emails, messages, feedback forms, and survey responses sent to or received from us
• Social media interactions where you engage with our official accounts

4. Purposes and Legal Basis for Processing

In accordance with the DPDP Act, 2023, we process your personal data only for lawful purposes, with your consent, or for legitimate uses permitted under law. The table below sets out our purposes and corresponding legal bases:

5. Consent and How We Obtain It

Under the DPDP Act, 2023, consent must be free, specific, informed, unconditional, and unambiguous. We obtain your consent through:

• Explicit opt-in checkboxes on registration and submission forms (not pre-ticked)
• A clear notice presented at the time of data collection explaining the purpose
• Separate consent for optional communications such as newsletters and promotional emails
• Separate and explicit consent for the collection of any Sensitive Personal Data

Right to Withdraw Consent:

You may withdraw your consent at any time by contacting us at info@piffi.in. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal. Please note that withdrawing consent for essential purposes (such as processing your film submission) may affect our ability to provide you with festival-related services.

6. Sharing and Disclosure of Personal Data

6.1 With Service Providers (Data Processors)

We engage trusted third-party service providers who process data on our behalf, under contractual obligations ensuring data protection equivalent to this Policy. These include:

• Payment gateway providers (e.g., Razorpay, PayU, or equivalent PCI-DSS compliant processors)
• Film submission management platforms
• Email marketing and communication platforms
• Website hosting and cloud storage providers
• Analytics providers (e.g., Google Analytics)
• Event management software providers

6.2 With Festival Partners and Sponsors

With your explicit consent, we may share your name and professional details with festival sponsors, co-presenters, or institutional partners for networking and industry purposes only. You may opt out of such sharing at any time.

6.3 For Legal and Regulatory Compliance

We may disclose personal data when required to do so under Indian law, by court order, or by a lawful request from a government authority, law enforcement agency, or regulatory body. We will notify you of such disclosures where legally permissible.

6.4 For Film Publication and Promotion

By submitting a film to PIFFI, you grant us permission to use the film title, stills, posters, director name, and synopsis for the purpose of festival programming, promotional materials, press releases, and publications. Any broader use will require separate written consent.

7. Cross-Border Transfer of Personal Data

As an international film festival, some of your personal data may be transferred to, stored in, or processed in countries outside India — for example, when using cloud-based services or international film submission platforms.

All cross-border transfers of personal data are conducted in accordance with Section 16 of the DPDP Act, 2023, which permits transfer to countries notified by the Central Government of India as providing an adequate level of protection, or pursuant to other lawful grounds.

We ensure that any overseas recipient of your data is contractually bound to protect it to a standard comparable to Indian data protection law.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience, analyse traffic, and measure the effectiveness of our communications.

8.1 Types of Cookies We Use

• Strictly Necessary Cookies: Essential for the website to function (e.g., session management, security). These cannot be disabled.
• Functional Cookies: Remember your preferences (e.g., language, region) to improve your experience.
• Analytics Cookies: Collect anonymised data about how visitors use the site (e.g., Google Analytics). Used to improve our website.
• Marketing/Targeting Cookies: Used to deliver relevant promotional content. Only placed with your explicit consent.

You may manage or disable cookies through your browser settings or our Cookie Consent banner. Please note that disabling certain cookies may affect website functionality.

9. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Indian law. Our general retention periods are:

• Film submission data: retained for up to 3 years from the date of submission for festival archival and reporting purposes
• Registration and ticketing data: retained for up to 2 years from the date of the relevant festival edition
• Payment records: retained for 7 years in accordance with the Companies Act, 2013 and applicable tax and accounting laws
• Marketing communications opt-in records: retained until you withdraw consent, plus 1 year thereafter
• Website analytics data: typically retained for 26 months (as per Google Analytics default settings)

Upon expiry of the retention period, personal data will be securely deleted or anonymised.

10. Security of Personal Data

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for data transmitted through our website
• Secure, password-protected servers with restricted access controls
• Use of PCI-DSS compliant payment processors; we never store card numbers
• Regular security reviews and vulnerability assessments
• Data access restricted to authorised personnel on a need-to-know basis
• Staff training on data protection and confidentiality obligations

11. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you (as a "Data Principal") have the following rights:

• Right to Access (Section 11, DPDP Act) — You have the right to request a summary of the personal data we hold about you and the processing activities carried out.
• Right to Correction and Erasure (Section 12, DPDP Act) — You may request that we correct inaccurate or incomplete data, or erase data that is no longer necessary for the purpose it was collected, subject to legal retention requirements.
• Right to Grievance Redressal (Section 13, DPDP Act) — You have the right to have your privacy grievances addressed in a timely and effective manner.
• Right to Nominate (Section 14, DPDP Act) — You may nominate another individual to exercise your data rights in the event of your death or incapacity.
• Right to Withdraw Consent — You may withdraw consent for any processing based on consent, at any time, as described in Section 5 above.
• Right to Opt Out of Marketing Communications — You may unsubscribe from promotional emails at any time by clicking the unsubscribe link in any email or by contacting us directly.

To exercise any of these rights, please contact our Grievance Officer (see Section 14). We will respond to all requests within 72 hours of acknowledgement, and resolve grievances within 30 days, in line with the DPDP Act, 2023.

12. Children's Privacy

PIFFI is mindful of its obligations under Section 9 of the DPDP Act, 2023 with respect to children (individuals below the age of 18 years). We do not knowingly collect personal data from children without verifiable parental or guardian consent.

Where a child wishes to:

• Submit a film: verifiable consent from a parent or legal guardian will be obtained prior to processing
• Attend or register for the festival as a minor: a parent or guardian must complete the registration on their behalf

We will not engage in behavioural monitoring or targeted advertising directed at children. If you believe we have inadvertently collected data from a child without appropriate consent, please contact us immediately and we will take steps to delete such data.

13. Photography, Videography, and Media Coverage

PIFFI conducts photography and videography at festival events, including screenings, award ceremonies, panel discussions, and public areas, for the purposes of archiving, press coverage, and promotional use.

By attending PIFFI events, you acknowledge that:

• You may be captured in photographs or videos taken in public areas of the festival
• Such images and footage may be used in PIFFI's promotional materials, website, social media, and press releases
• If you do not wish to be photographed, please notify our staff and we will make reasonable efforts to accommodate your request

For press and media accreditation holders, images taken in the course of press duties are subject to the accreditation terms and conditions.

14. Grievance Redressal

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, 2023, we have appointed a Grievance Officer to address your data protection concerns.

Grievances can be submitted in writing to the above contact details. We will acknowledge receipt of your grievance within 24 hours and endeavour to resolve it within 15 days.

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India established under the DPDP Act, 2023, once operationalised.

15. Links to Third-Party Websites

Our website may contain links to third-party websites, social media platforms, or partner organisations. This Privacy Policy applies solely to PIFFI's website and services. We are not responsible for the privacy practices of any third-party sites, and we encourage you to review their respective privacy policies before providing any personal data.

16. Changes to this Privacy Policy

We may revise this Privacy Policy periodically to reflect changes in our data practices, legal requirements, or festival operations. All updates will be posted on our website with the revised effective date.

Where changes are material, we will notify you by email (if we hold your contact details) or by a prominent notice on our website at least 15 days prior to the change taking effect, giving you the opportunity to review and, if necessary, withdraw consent before the updated policy becomes binding.

Your continued use of our website or services after any changes constitutes acceptance of the updated Privacy Policy.

17. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us at: