Privacy Policy

Art for Awareness ("we," "us," "our," or the "Platform") is the organiser of an art contest. We are committed to protecting the privacy and personal data of all users, especially children. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit artforawareness.art (the "Website") or participate in our art contests.

This policy is designed to comply with the General Data Protection Regulation (GDPR) (EU), the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), and India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data Fiduciary & Contact Information

2. Information We Collect

We collect personal data that you voluntarily provide when registering, submitting artwork, or communicating with us. The categories of personal data we collect include:

3. Legal Basis for Processing (GDPR & the DPDP Act)

We process personal data based on the following lawful grounds:

• Consent: Explicit consent obtained at registration, including verifiable parental consent for participants under 18.
• Contractual Necessity: Processing required to manage competition entries, judging, and gift distribution.
• Legal Obligation: Compliance with applicable Indian laws, including tax and child protection law.
• Legitimate Interests: Platform security, fraud prevention, and improving user experience.

4. Consent Framework

Consent is a core pillar of our data processing practices:

• Explicit Opt-In: Consent and terms boxes are never pre-ticked; you must tick them yourself.
• Parental Consent (DPDP Act): For participants in school grades (LKG to Grade 12), we require the parent or guardian's name and email and a consent confirmation. The server rejects a school-grade entry that does not include them. Where email verification is switched on, we also email the guardian a link to a confirmation page; the guardian reads what we collect and taps a confirm button, and we do not accept the entry until they do. That confirmation is valid for one entry and for a short time only. The consent tick-box is never pre-ticked. Parent contact details are used for consent and competition communication.
• Adults: For college, adult and similar categories, participants tick a box confirming they are 18 or older.
• Marketing email: Campaign emails include an unsubscribe link and a one-click unsubscribe option in your email app. Unsubscribing adds your address to a suppression list that we check before every campaign.
• Withdrawal of Consent: You may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. How We Use Your Information

We use personal data strictly for the following purposes:

We do not sell or rent your personal data.

6. Cookies & Tracking Technologies

We use cookies and similar technologies to enhance your experience. For detailed information, please see our Cookie Policy. Categories include:

• Essential Cookies: Required for core platform functionality (sign-in session, security). The full list of cookies and browser-storage keys is in our Cookie Policy.
• Security check: Sign-in and our forms may run a Cloudflare Turnstile "Verify you are human" check, and a connection that loads unusually many pages may be asked to complete it. It uses your IP address and browser signals only to tell people from automated scripts; it sets no tracking cookie. Passing it sets a short-lived (30 minute) essential cookie.
• Analytics Cookies: Help us understand how visitors interact with our Website (Google Analytics, Microsoft Clarity). These load only if you choose "Accept all" on the cookie banner. If you choose "Essential only", they do not load. You can change your choice at any time with the "Cookie Settings" link in the footer. Session-replay tools mask form fields and personal data.
• No analytics where children enter or appear: We do not load Google Analytics, Microsoft Clarity or any advertising pixel on the home and entry page (where participants and guardians fill in forms), the gallery, the results page, or our kindergarten and school landing pages, whatever your cookie choice. Our host's cookie-free aggregate page-view counter (Vercel Web Analytics) may still count visits to those pages.
• Your device: Some forms keep your own entry details and your cookie choice in your browser's local storage so they are quicker to complete; this stays on your device. See the Cookie Policy.

7. Third-Party Sharing & Data Processors

We do not sell, rent, or trade personal data. We share data only in the following ways:

With Sponsors — Aggregated Data Only

Sponsors receive a monthly Impact Report showing total submissions, states covered, age group breakdown, and school count. This is aggregate and anonymised. We never share individual names, emails, or artwork with sponsors without your separate consent.

With Service Providers

All processors are contractually bound to process data only on our instructions and to maintain appropriate security measures consistent with GDPR Article 28 and DPDP Act requirements.

Winner Artwork Publication

Winners and shortlisted participants have their artwork, first name, and school name published on our website and social media. This is covered by the consent given at submission. You can request removal at any time by writing to us.

Legal Requirements

We may share data if required by Indian law or a court order. We will inform you where legally permitted.

8. Cross-Border Data Transfers

Because our participants and service providers are in several countries, your data may be transferred to and processed in countries outside your jurisdiction, including India, the United States, and the European Union.

• GDPR Compliance: Transfers to non-EEA countries are protected by Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.
• DPDP Act Compliance: Cross-border transfers are limited to countries notified by the Indian Government as having adequate data protection, or are subject to approved contractual safeguards.
• CCPA Compliance: California residents' data is handled with the same protections regardless of processing location.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Submission data and artwork: 3 years after the competition month, then deleted.
• Winner name and school: Kept in our records for archival purposes. Full personal details deleted after 3 years.
• Account data: Kept while your account is active, plus 1 year after deletion.
• Newsletter subscription: Kept until you unsubscribe, plus 1 year.
• Analytics data: 14 months (Google Analytics 4 default), only for visitors who accepted analytics cookies.

Upon expiry of the retention period, data is securely deleted or anonymised in accordance with our data destruction procedures.

10. Children's Data and Parental Consent (COPPA & the DPDP Act)

Protecting children's privacy is paramount. We apply extra protections to personal data of any participant under 18, in line with India's DPDP Act:

• Our school categories are for students in LKG to Grade 12. We treat every school-grade participant as a child under 18. We use the grade category, not a date of birth, to decide this.
• Participants under 18 must provide a parent or guardian's name and email, and confirm consent, when they enter.
• Where guardian email verification is switched on, we send a confirmation email to the parent or guardian and do not accept the entry until they confirm.
• Approved artworks appear in the public gallery with the artwork title, the participant's name, grade and school. Guardian consent at entry covers this. To have a child's artwork or name removed, write to us or use our Report Artwork page.
• We do not collect financial information from participants under 18.
• We do not run advertising or analytics trackers on the pages where children enter or appear (see section 6), and we do not profile participants under 18 for advertising.
• Parents/guardians have the right to review, correct, or delete their child's personal data at any time.
• Parents may withdraw consent at any time by writing to us. We will remove the child's data within 30 days.
• Schools submitting on behalf of students must confirm they have obtained parental consent for every student included in a bulk submission.
• If we learn that we have collected personal data from a child without proper consent, we will delete that information promptly.

11. Data Security & Breach Notification

We implement industry-standard technical and organisational security measures, including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256).
• Role-based access control and regular security audits.
• Secure authentication via OAuth 2.0 and hashed passwords.
• Regular backups and disaster recovery procedures.

Breach Notification: In the unlikely event of a personal data breach, we will:

• Notify affected users without undue delay and within 72 hours of becoming aware of the breach.
• Notify the relevant supervisory authority (India's Data Protection Board under the DPDP Act, or EU supervisory authorities under GDPR) as required by law.
• Provide clear guidance on steps users should take to protect themselves.

12. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention obligations.
• Right to Data Portability: Receive your data in a structured, machine-readable format and transfer it to another controller.
• Right to Restriction: Request limitation of processing under specific circumstances.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing.
• Right to Non-Discrimination (CCPA): We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at contact@artforawareness.art. We will respond within 30 days of receiving a verified request.

Delete my data

To have your data (or your child's data) deleted, email contact@artforawareness.art with the subject Delete my data. Please send it from the email address you entered with, and tell us the participant's name, grade and school (for a child, the parent or guardian should write). We will delete the data within 30 days of verifying your request. Some records may be kept where the law requires it (see section 9).

Self-Service Account Deletion (if you have an account): You may delete your account and all associated personal data at any time by visiting your Dashboard → Profile → Danger Zone → Delete My Account. This action is immediate and cannot be undone. We will retain anonymized audit logs for legal compliance purposes.

13. Data Fiduciary Duties (DPDP Act)

As a Data Fiduciary under India's Digital Personal Data Protection Act, 2023, we are obligated to:

• Process personal data in a fair, transparent, and reasonable manner.
• Collect only data that is necessary for the specified purpose (data minimisation).
• Maintain accurate and up-to-date personal data.
• Implement reasonable security safeguards to prevent personal data breaches.
• Notify the Data Protection Board and affected Data Principals of any breach.
• Provide a Grievance Officer to address complaints from Data Principals (see section 15).

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. We will notify registered users by email at least 14 days before any significant change takes effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

15. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us: