Privacy Policy

This Privacy Policy explains how Just Booked Events (“Just Booked”, “we”, “us”) collects, uses, shares and protects personal data when you use the Just Booked website, mobile application and related services (the “Platform”). It applies to Hosts, Vendors, visitors, and people whose details a Host adds to a guest list. Words with capital letters have the meaning given in our Terms of Service.

Our role. For the personal data we collect to run the Platform, we decide why and how it is used. Under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are a “Data Fiduciary”, and under the Information Technology Act, 2000 (the “IT Act”) we are a “body corporate”. Vendors who receive your details are separate Data Fiduciaries (see Section 13). For guest lists, the Host decides how the data is used and we process it on the Host’s instructions (see Section 8).

The laws we follow. Today, the IT Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”) apply. The DPDP Act and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”) have been notified, and their main duties on notice, consent, rights, security and breach reporting start on 13 May 2027. We are preparing for them and already follow their main principles.

Your consent. By using the Platform and giving us information, you agree to its collection and use as described in this Policy. You can withdraw your consent at any time (see Section 11). If you do, some features may no longer work.

Sensitive personal data. Under the SPDI Rules, passwords and financial information (such as bank account, card and other payment details) are “sensitive personal data or information”. We collect passwords from all Users, and bank account and payment-method details from Vendors. We handle them with extra care and use them only for the purposes in Section 4. We do not ask for health, biometric or other sensitive information. If you choose to give us details such as a guest’s dietary or accessibility needs, we use them only to help plan your event.

Aadhaar. We do not collect or keep your Aadhaar number. If you choose Aadhaar as identity proof for Vendor verification, you must upload a masked copy that shows only the last four digits. We use it only to confirm your identity, we limit who can see it, and we delete it as set out in Section 9. If an unmasked copy is uploaded, we will ask you to replace it and will delete the unmasked copy.

We do not intentionally collect personal data from children (see Section 12).

Directly from you, when you register, fill in forms, make an enquiry, message a Vendor, add a guest, upload documents, write a review or contact us.

Automatically, through cookies and similar technologies, server logs and software on your device (see our Cookie Policy).

From other sources, such as Google when you sign in or link contacts, payment partners (which tell us whether a payment succeeded) and other Users.

Where we rely on your consent, you can withdraw it as explained in Section 11.

Vendors. When you enquire about, message or ask to reserve with a Vendor, we share the details you give (such as your name, phone number, email address, WhatsApp number and event details) with that Vendor so that it can reply. Vendors’ business information is shown to Hosts and to the public on their Listings.

Service providers. We use other companies to help us run the Platform, under written contracts that allow them to use personal data only on our instructions and require them to keep it secure. They include providers of cloud hosting and storage, email, SMS and WhatsApp messaging, payment processing, analytics (where enabled), customer support tools, identity and business verification, and security.

Legal and safety. We disclose personal data when the law, a court or a government agency requires it, for example under a lawful order or direction, or when it is needed to prevent fraud or serious harm. We tell you when we are allowed to.

Business changes. If Just Booked merges with another company or sells its business, personal data may be transferred to the new owner. We will tell you, and the new owner must honour this Policy.

With your consent, or at your direction, for example when you post a public review.

We do not sell your personal data. We do not rent it or trade it for money.

We may share data that no longer identifies you, such as aggregated statistics.

We store personal data on servers in India or in other countries where our service providers operate. Where data is transferred or stored outside India, we do so under written contracts that require the same level of protection as this Policy, in line with the SPDI Rules and, when they apply, the DPDP Act and any restrictions the Government notifies.

We send service messages that you need, such as replies to your enquiries, RSVP and booking updates, invoices and security alerts. You can choose which updates to receive in your account settings, including vendor replies, guest RSVPs, booking updates and SMS notifications.

We send marketing messages (offers, updates and event ideas) only if you have agreed. You can switch “Marketing & Offers” off in your account settings, use the unsubscribe link in any email, or tell us using the details in Section 15. We follow the rules of the Telecom Regulatory Authority of India on commercial messages, including your Do Not Disturb preferences, and WhatsApp’s policies.

Vendors may receive enquiry and booking alerts from us by WhatsApp, email or SMS. Where we send guest invitations on a Host’s behalf, the Host decides whom to invite (see Section 8).

A Host who adds guests, or links contacts from a phone or Google account, is responsible for having the right to share those details. We process guest list data on the Host’s instructions, to send invitations and record replies. We do not use linked contacts for any other purpose, and we never message them without the Host’s action.

If you have been added to a guest list and do not want to be contacted, tell the Host or write to us. We will stop sending you invitations and, where the Host agrees or the law requires, remove your details.

Hosts must not add personal data about children except where it is necessary for the event and with the authority of a parent or guardian.

After these periods we delete the data or make it anonymous.

We use reasonable security practices and procedures to protect personal data from unauthorised access, loss, misuse and disclosure. They include encryption of data in transit, access controls that limit who can see personal data, and activity logs.

No system is completely secure. You can help by using a strong, unique password, switching on two-factor authentication, and never sharing your OTP, PIN or CVV.

If a personal data breach affects you, we will tell you and the authorities as the law requires. This includes the Data Protection Board of India once the DPDP Rules apply, and CERT-In within the time it sets for reportable cyber incidents.

How we respond. We may need to confirm who you are first. We do not charge for these requests. We acknowledge a request within 24 hours and respond within one month. If we cannot do what you ask, for example because the law requires us to keep the data, we will tell you why.

At present, requests to close an account, or to access or erase personal data, are handled by our team on request. There is no self-service button for them yet.

From 13 May 2027, if you are not satisfied with our response, you may complain to the Data Protection Board of India. You should first use our grievance process.

Withdrawing consent or erasing data may mean that we can no longer provide some features, such as a Listing or a guest list.

The Platform is for people aged 18 or over, and we do not knowingly collect personal data from children. If we learn that a child has given us personal data, we will delete it. From 13 May 2027 the DPDP Act requires verifiable parental consent before a child’s personal data is processed, and we will apply that rule where it is relevant. Hosts who add details of children to a guest list are responsible for acting with a parent’s or guardian’s authority.

Once a Vendor receives your details, the Vendor is responsible for how it uses them. Vendors must use them only to respond to you and to provide the services you ask for, and must follow data protection law. This Policy does not cover how Vendors, or other third-party sites and services that the Platform links to, use personal data. Please read their privacy policies.

We may update this Policy. If a change is material, we will tell you through the Platform or by email before it takes effect. The version number and the “Last updated” date will change, and we keep earlier versions on request. At least once a year we will remind you of this Policy and of our Terms.

We acknowledge complaints within 24 hours and resolve them within one month.