Privacy Policy

1. Introduction & Scope

Romaa Entertainments ("we", "us", "our"), operating the online platform BookCineSpace at bookcinespace.in, is committed to protecting the privacy and personal data of our users. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and your rights in relation to it.

This Policy applies to all individuals who use the BookCineSpace website, mobile application, or any related services ("Platform"), including registered users (Customers and Hosts), visitors who browse without registering, and any other persons whose data we may process in the course of providing our services.

This Policy is issued in compliance with the Digital Personal Data Protection (DPDP) Act, 2023 of India, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Where applicable, we also observe the guidelines of the Ministry of Electronics and Information Technology (MeitY).

By using the BookCineSpace Platform, you consent to the collection, use, and sharing of your personal data as described in this Privacy Policy. If you do not consent, please do not use the Platform or submit your personal data to us.

This Policy should be read alongside our Terms and Conditions.

2. Data We Collect

We collect and process the following categories of personal data:

Account & Identity Data:

• Full name — provided during account registration or Google sign-in.
• Email address — used to create your account, send booking confirmations, and communicate important updates.
• Mobile phone number — used for booking confirmations via SMS and WhatsApp, and for two-factor verification.

Booking & Transaction Data:

• Venue selected, booking date and time, slot duration, number of guests.
• Total booking amount, platform fee, and applicable taxes.
• Razorpay Payment Reference ID — a unique transaction reference number provided by Razorpay upon successful payment. We do not store your card number, CVV, bank account number, UPI PIN, or any other sensitive payment credentials. All payment data is handled directly and securely by Razorpay.

Google Sign-In Data (if you choose to sign in with Google):

• Google account profile information: name, email address, and profile photograph as shared by Google OAuth 2.0.
• We do not receive your Google account password or payment methods stored in Google.

Device & Analytics Data:

• Browser type and version, operating system, device type.
• IP address (used for approximate geolocation and security purposes).
• Pages visited, time spent on pages, referral URL, and clickstream data.
• This data is collected via Google Analytics 4 (GA4) only after you provide explicit cookie consent.

Communications Data:

• Customer support enquiries, feedback, and grievance submissions sent to us by email or through our Platform.
• Reviews or ratings submitted for Venues.

3. How We Use Your Data

We process your personal data for the following purposes, relying on the legal bases noted:

• Processing and confirming bookings: To complete your booking transaction, generate booking confirmations, and communicate booking details to you and the relevant Venue Host. (Contractual necessity)
• Sending booking confirmations and reminders via email, WhatsApp, and/or SMS to keep you informed of your upcoming slots and any changes. (Contractual necessity / Legitimate interest)
• Customer support: To respond to your queries, resolve disputes, and handle grievance submissions. (Legitimate interest / Legal obligation)
• Platform improvement: To analyse usage patterns, identify areas for enhancement, test new features, and improve the overall user experience. (Legitimate interest, subject to consent for analytics cookies)
• Personalisation: To show you relevant Venues based on your location preferences, past bookings, and browsing behaviour on our Platform. (Legitimate interest)
• Marketing communications: To send you promotional offers, new Venue announcements, and platform updates, where you have consented to receive such communications. You may opt out at any time. (Consent)
• Legal and regulatory compliance: To maintain records required under the Goods and Services Tax (GST) Act, Income Tax Act, and other applicable Indian laws; to respond to lawful requests from government authorities or courts. (Legal obligation)
• Fraud prevention and security: To detect and prevent fraudulent bookings, unauthorised access, and other security incidents. (Legitimate interest / Legal obligation)

4. Data Sharing

BookCineSpace does not sell your personal data to third parties. We share your personal data only in the following circumstances and with the following categories of recipients:

• Venue Hosts: When you make a booking, we share with the Host only the information strictly necessary to fulfil the booking — specifically, your name, contact number, booking date and time, slot details, and number of guests. Hosts are prohibited from using this information for any purpose other than hosting your session and are bound by our Host Terms.
• Razorpay (Payment Gateway): We share transaction-relevant data (booking amount, billing name, email, phone) with Razorpay to process your payment. Razorpay is a PCI-DSS compliant payment processor and handles all sensitive payment credentials independently. Their processing is governed by Razorpay's own Privacy Policy.
• Google Analytics (GA4): We share anonymised and aggregated device and usage data with Google Analytics for platform analytics purposes. This sharing occurs only after you have given explicit cookie consent on the Platform's cookie banner. You may withdraw this consent at any time through the cookie settings.
• Government and Law Enforcement Authorities: We may disclose your personal data to Indian government agencies, regulatory authorities, police, or courts when required to do so by law, court order, or lawful government request. We will, where legally permissible, notify you of such disclosure.
• Service Providers: We may share data with trusted technical service providers (such as cloud hosting providers, email/SMS delivery services, and WhatsApp Business API providers) who assist us in operating the Platform. Such providers are contractually required to process data only on our instructions and to maintain appropriate security measures.
• Business Transfers: In the event of a merger, acquisition, sale of assets, or restructuring of Romaa Entertainments, your personal data may be transferred to the successor entity, provided the receiving entity agrees to protect your data in a manner consistent with this Policy.

5. Cookies & Tracking

We use cookies and similar tracking technologies on the BookCineSpace Platform. The following describes the types of cookies we use and your choices:

Essential Session Cookies (Always Active):

These cookies are strictly necessary for the Platform to function and cannot be disabled. They include:

• Authentication cookies — to maintain your logged-in session using JWT (JSON Web Tokens) based authentication.
• CSRF protection tokens — to protect against cross-site request forgery attacks.
• Booking session state — to retain your booking selections as you navigate the site.

These essential cookies do not track your activity across third-party websites and do not require your consent.

Analytics Cookies (Require Consent):

We use Google Analytics 4 (GA4) to understand how users interact with our Platform. GA4 uses cookies to collect anonymised data about page views, user journeys, session duration, and traffic sources. These cookies are only placed on your device after you provide explicit consent via our cookie consent banner. You may withdraw consent at any time by clicking the cookie settings option in the website footer or within the Platform settings.

When you opt out of analytics cookies, we will not place or activate GA4 tracking on your browser. Note that Google Analytics data is processed by Google LLC in accordance with Google's Privacy Policy and Data Processing Terms.

Managing Cookies:

In addition to our in-platform consent options, you may control cookies through your browser settings. Please note that disabling essential cookies may prevent certain features of the Platform from functioning correctly. For more information, please refer to your browser's help documentation.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our specific retention periods are:

• Booking Records (including payment references, invoices, GST records): Retained for a minimum of 7 years from the date of the transaction, in compliance with the Goods and Services Tax Act, 2017, and applicable financial record-keeping requirements.
• Account Data (name, email, phone): Retained for the duration of your active account and deleted within 30 days of a verified account deletion request. Note that deletion of account data does not remove booking records that must be retained for GST compliance.
• Customer Support & Grievance Records: Retained for 3 years from the date of resolution to enable review in case of subsequent disputes or regulatory enquiries.
• Analytics Data (GA4): Governed by Google's standard retention policy as configured in our GA4 account (typically 14 months for user-level data). You may request export or deletion through your Google account settings.
• Consent Records: Records of your cookie consent and marketing consent preferences are retained for the duration of your account plus 1 year to demonstrate regulatory compliance.

Upon expiry of the applicable retention period, personal data will be securely deleted or anonymised. Anonymised, aggregated data (which cannot identify you) may be retained indefinitely for statistical and analytical purposes.

7. Your Rights under the DPDP Act 2023

The Digital Personal Data Protection (DPDP) Act, 2023 grants you, as a Data Principal, certain rights over your personal data processed by BookCineSpace (the Data Fiduciary). These rights are summarised below:

How to exercise your rights: Submit a written request to our Grievance Officer at grievance@bookcinespace.in with the subject line "DPDP Data Rights Request – [Your Name]". Please include your registered email address and, if applicable, your booking reference to assist us in verifying your identity and locating your data.

We will acknowledge your request within 72 hours and endeavour to respond fully within 30 days. We may request identity verification before acting on your request. Certain rights may be limited where data retention is required for legal compliance (e.g., GST records).

If you are not satisfied with our response, you may also approach the Data Protection Board of India (once established under the DPDP Act 2023) or seek redressal through the applicable Consumer Forum.

8. Children's Privacy

The BookCineSpace Platform is not intended for use by persons under the age of 18 years. We do not knowingly collect, process, or store personal data from individuals under the age of 18. If you are under 18, please do not register for an account or submit any personal data to us.

In accordance with the DPDP Act 2023, if we become aware that we have inadvertently collected personal data from a child (a person under 18) without verifiable parental or guardian consent, we will take immediate steps to delete such data from our systems.

If you are a parent or guardian and believe that your child has provided us with personal data, please contact us immediately at grievance@bookcinespace.in.

9. Data Security

Romaa Entertainments implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• HTTPS / TLS Encryption: All data transmitted between your browser and the BookCineSpace Platform is encrypted using HTTPS (TLS 1.2 or higher). This protects your personal data from interception during transmission.
• JWT-Based Authentication: User sessions are managed using JSON Web Tokens (JWT) with appropriate expiry settings, minimising the risk of unauthorised session reuse.
• Encrypted Payment Processing: All payment transactions are processed by Razorpay, which is PCI-DSS Level 1 compliant. BookCineSpace does not store, log, or transmit sensitive payment data such as card numbers, CVVs, or UPI PINs.
• Access Controls: Personal data is accessible only to authorised personnel within Romaa Entertainments who require it for the performance of their duties. Access is governed by role-based permissions.
• Regular Security Reviews: We conduct periodic reviews of our security practices, including vulnerability assessments and dependency updates, to address emerging threats.

While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee the absolute security of your data, but we commit to notifying you promptly in the event of a data breach that is likely to adversely affect you, in accordance with the requirements of the DPDP Act 2023 and MeitY guidelines.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in applicable law, our data practices, or our services. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify registered users by email or through a prominent notice on the Platform.

We encourage you to review this Privacy Policy periodically to stay informed of how we collect, use, and protect your data. Your continued use of the Platform following the posting of changes constitutes your acceptance of the updated Policy.

11. Contact

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us: