Privacy Policy

Art for Awareness ("we," "us," "our," or the "Platform") is the organiser of a free art contest. We are committed to protecting the privacy and personal data of all users, especially children. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit artforawareness.art (the "Website") or participate in our art contests.

This policy is designed to comply with the General Data Protection Regulation (GDPR) (EU), the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), and India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data Fiduciary & Contact Information

2. Information We Collect

We collect personal data that you voluntarily provide when registering, submitting artwork, or communicating with us. The categories of personal data we collect include:

3. Legal Basis for Processing (GDPR & DPDP Act)

We process personal data based on the following lawful grounds:

• Consent: Explicit consent obtained at registration, including verifiable parental consent for participants under 18.
• Contractual Necessity: Processing required to manage competition entries, judging, and prize distribution.
• Legal Obligation: Compliance with Indian non-profit regulations, tax laws, and child protection statutes.
• Legitimate Interests: Platform security, fraud prevention, and improving user experience.

4. Consent Framework

Consent is a core pillar of our data processing practices:

• Explicit Opt-In: All data collection requires affirmative action (checking a box) during registration.
• Parental Consent (COPPA / DPDP Act): For participants under 18, we require verifiable parental or guardian consent before any personal data is collected or processed. Parent contact details are collected solely for this purpose.
• Granular Consent: Users can separately consent to marketing communications, gallery display of artwork, and third-party sharing.
• Withdrawal of Consent: You may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. How We Use Your Information

We use personal data strictly for the following purposes:

We do not sell or rent your personal data.

6. Cookies & Tracking Technologies

We use cookies and similar technologies to enhance your experience. For detailed information, please see our Cookie Policy. Categories include:

• Essential Cookies: Required for core platform functionality (login, session management, security).
• Analytics Cookies: Help us understand how visitors interact with our Website (Google Analytics, Microsoft Clarity).
• Functional Cookies: Remember preferences such as language and display settings.

7. Third-Party Sharing & Data Processors

We do not sell, rent, or trade personal data. We share data only in the following ways:

With Sponsors — Aggregated Data Only

Sponsors receive a monthly Impact Report showing total submissions, states covered, age group breakdown, and school count. This is aggregate and anonymised. We never share individual names, emails, or artwork with sponsors without your separate consent.

With Service Providers

All processors are contractually bound to process data only on our instructions and to maintain appropriate security measures consistent with GDPR Article 28 and DPDP Act requirements.

Winner Artwork Publication

Winners and shortlisted participants have their artwork, first name, and school name published on our website and social media. This is covered by the consent given at submission. You can request removal at any time by writing to us.

Legal Requirements

We may share data if required by Indian law or a court order. We will inform you where legally permitted.

8. Cross-Border Data Transfers

As an India-registered non-profit with global participants, your data may be transferred to and processed in countries outside your jurisdiction, including India, the United States, and the European Union.

• GDPR Compliance: Transfers to non-EEA countries are protected by Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.
• DPDP Act Compliance: Cross-border transfers are limited to countries notified by the Indian Government as having adequate data protection, or are subject to approved contractual safeguards.
• CCPA Compliance: California residents' data is handled with the same protections regardless of processing location.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Submission data and artwork: 3 years after the competition month, then deleted.
• Winner name and school: Kept in our records for archival purposes. Full personal details deleted after 3 years.
• Account data: Kept while your account is active, plus 1 year after deletion.
• Newsletter subscription: Kept until you unsubscribe, plus 1 year.
• Analytics data: 14 months (Google Analytics 4 default).

Upon expiry of the retention period, data is securely deleted or anonymised in accordance with our data destruction procedures.

10. Children's Data and Parental Consent (COPPA & DPDP Act)

Protecting children's privacy is paramount. We apply extra protections to personal data of any participant under 18, in line with India's Digital Personal Data Protection Act 2023:

• Our platform is designed for students in grades 1-12, typically aged 6 to 18.
• Participants under 18 must provide a parent or guardian's name and email at registration.
• We send a consent confirmation email to the parent or guardian. We do not process the child's data until they confirm.
• We do not display the full names of participants under 13 in public galleries — first name and initial only.
• We do not collect financial information from participants under 18.
• We do not track or profile participants under 18 for advertising purposes.
• Parents/guardians have the right to review, correct, or delete their child's personal data at any time.
• Parents may withdraw consent at any time by writing to us. We will remove the child's data within 30 days.
• Schools submitting on behalf of students must confirm they have obtained parental consent for every student included in a bulk submission.
• If we learn that we have collected personal data from a child without proper consent, we will delete that information promptly.

11. Data Security & Breach Notification

We implement industry-standard technical and organisational security measures, including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256).
• Role-based access control and regular security audits.
• Secure authentication via OAuth 2.0 and hashed passwords.
• Regular backups and disaster recovery procedures.

Breach Notification: In the unlikely event of a personal data breach, we will:

• Notify affected users without undue delay and within 72 hours of becoming aware of the breach.
• Notify the relevant supervisory authority (India's Data Protection Board under DPDP Act, or EU supervisory authorities under GDPR) as required by law.
• Provide clear guidance on steps users should take to protect themselves.

12. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention obligations.
• Right to Data Portability: Receive your data in a structured, machine-readable format and transfer it to another controller.
• Right to Restriction: Request limitation of processing under specific circumstances.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing.
• Right to Non-Discrimination (CCPA): We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at artforawareness.official@gmail.com. We will respond within 30 days of receiving a verified request.

Self-Service Account Deletion: You may delete your account and all associated personal data at any time by visiting your Dashboard → Profile → Danger Zone → Delete My Account. This action is immediate and cannot be undone. We will retain anonymized audit logs for legal compliance purposes.

13. Data Fiduciary Duties (DPDP Act 2023)

As a Data Fiduciary under India's DPDP Act, 2023, we are obligated to:

• Process personal data in a fair, transparent, and reasonable manner.
• Collect only data that is necessary for the specified purpose (data minimisation).
• Maintain accurate and up-to-date personal data.
• Implement reasonable security safeguards to prevent personal data breaches.
• Notify the Data Protection Board and affected Data Principals of any breach.
• Appoint a Grievance Officer to address complaints from Data Principals.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. We will notify registered users by email at least 14 days before any significant change takes effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

15. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us: