PRIVACY POLICY

Comprehensive Privacy & Data Protection Policy

Drafted in compliance with the Digital Personal Data Protection Act, 2023 (India) & Global Privacy Standards

At Kalawheel, we view privacy not merely as a legal obligation, but as a mutual pact of trust. As you engage with our creative portfolio, digital games, merchandise, and animated content, we pledge to protect your personal data with the highest technical and legal rigor. In return, this policy outlines the parameters within which we operate to protect our studio, our proprietary assets, and our community from misuse.

1. The Pact of Mutual Consent & Data Collection

Under the Digital Personal Data Protection Act, 2023 (DPDPA), data collection must be purpose-driven, transparent, and consensual. We operate strictly as a "Data Fiduciary," collecting only what is essential to deliver our services.

A. Information You Voluntarily Provide

• Identity & Contact Data: When you register an account, open a support ticket, or make a purchase, we collect your name, email address, and phone number. Our authentication systems utilize secure OTPs (One-Time Passwords) to verify your identity without requiring excessive personal profiling.
• Commerce Data: When purchasing physical merchandise (such as t-shirts) or digital assets, we collect your shipping and billing addresses. Note: Financial processing is strictly handled by encrypted, PCI-DSS compliant third-party gateways. Kalawheel does not capture, store, or process your raw credit/debit card numbers or UPI PINs.
• Interactive & Gaming Data: When participating in interactive features (such as Scrabble, KalaPop, hidden object games, or 3D environments), we may temporarily process session data, game states, and leaderboard scores to facilitate multiplayer functionality and ensure fair play.

B. Information Collected Automatically

• Technical Data: IP addresses, browser types, device identifiers, and operating systems are logged to maintain the security of our infrastructure and prevent automated attacks (DDoS) or unauthorized access.
• Usage Analytics: Anonymized interaction data (such as time spent on animations or gameplay patterns) is collected to help us optimize our storyboards, character designs, and user interfaces.

2. Protection of Minors (Absolute Compliance)

In accordance with Section 9 of the DPDPA and the global Children's Online Privacy Protection Act (COPPA):

• We do not knowingly process personal data of individuals under the age of eighteen (18) for the purposes of targeted advertising, tracking, or behavioral profiling.
• Verifiable parental or lawful guardian consent is strictly required before any personal data of a minor is processed.
• Our children's games and animated content are engineered to function fully without requiring the minor to input personally identifiable information (PII).
• If we discover that data belonging to a minor has been submitted without verified guardian consent, we reserve the right and hold the obligation to purge this data from our active databases immediately.

3. Customer Rights (Your Protections)

As a "Data Principal" under Indian law, you possess robust rights regarding your personal information. We respect and uphold your ability to exercise the following:

• Right to Access & Information: You may request a summary of the personal data we hold about you and the identities of all third-party processors with whom it has been shared.
• Right to Correction & Erasure: You may update inaccurate data or request the complete deletion of your account and associated personal data. (Subject to our legal retention rights outlined in Section 4).
• Right to Grievance Redressal: You have the right to a timely resolution of any privacy-related complaint through our designated Grievance Officer.
• Right to Nominate: You may nominate an individual to exercise your privacy rights on your behalf in the event of your death or incapacity.

4. Kalawheel’s Rights (Our Protections)

As a Data Fiduciary, Kalawheel retains the following absolute rights:

• Right to Retain Data for Legal Compliance: Even if you request the erasure of your data, we reserve the legally protected right to retain transaction histories, communication logs (such as support tickets), and billing records for up to the period mandated by Indian taxation, corporate, and IT laws. This protects us against future disputes or fraudulent chargeback claims.
• Right to Refuse Service based on Data Integrity: If we detect that a user has provided falsified data, utilized disposable/fraudulent email addresses, or engaged in abusive behavior through our support channels, we reserve the absolute right to terminate the account, block the IP address, and refuse all current and future services without liability.
• Protection of Proprietary Analytics: While you own your personal data, Kalawheel retains sole ownership of all aggregated, anonymized analytics, gameplay logic, and system interaction data. This data cannot be reverse-engineered or claimed by any user.
• Immunity from Third-Party Breaches: While we enforce strict security protocols, Kalawheel shall not be held liable for data breaches occurring at the level of our third-party infrastructure providers (e.g., global payment gateways or primary cloud hosts), provided we have acted with legally required due diligence.

5. Authorized Data Sharing

Kalawheel does not, and will never, sell your personal data to data brokers or marketing agencies. Your data is only shared under the doctrine of strict necessity:

• Operational Partners: We share necessary details with logistics providers for shipping physical merchandise and with secure gateways for processing payments. These partners are legally bound by confidentiality agreements.
• Legal Authorities: We will disclose personal data to law enforcement agencies, cyber-crime cells, or judicial courts located in India if presented with a valid, legally binding warrant, subpoena, or order under the Information Technology Act, 2000.

6. Security Infrastructure & Breach Protocol

We implement robust organizational and technical measures to secure our systems. This includes OTP-based password resets, encrypted database storage for user credentials, and secure session management.

Breach Notification: In the highly unlikely event of a severe data breach that compromises your unencrypted personal data, Kalawheel is legally committed to notifying both the Data Protection Board of India and you, the affected user, within the timelines mandated by the DPDPA, allowing you to take immediate protective action.

7. Governing Law & Jurisdiction

This Privacy Policy, and any disputes arising from the collection or processing of data, shall be governed exclusively by the laws of the Republic of India, specifically the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000.

By utilizing Kalawheel's services, you irrevocably agree that any legal proceedings, grievances, or litigations must be filed and resolved exclusively in the competent courts of jurisdiction located in West Bengal, India. We strictly reject the jurisdiction of any foreign courts or international arbitration bodies.

8. Grievance Redressal Officer

In compliance with Indian law, Kalawheel has appointed a Grievance Officer to address any concerns regarding your personal data. All formal privacy requests, erasure demands, or legal notices must be directed here:

• Email: support@kalawheel.com
• Attention: The Privacy & Grievance Officer, Kalawheel Studio.
• Response Time: We are committed to acknowledging and resolving valid privacy grievances within the timeframe stipulated by the DPDPA.