What happens to what you tell us.

What this covers

This notice covers the website. It does not cover what happens after you and we are already talking.

The Jaipur World Record Carnival is run by Manmohan Agarwal, in Jaipur, Rajasthan, India. For the purposes of the Digital Personal Data Protection Act, 2023, he is the Data Fiduciary for the information described here — the person responsible for it, and the person to complain to.

Everything below applies to jaipurworldrecordcarnival.in and to the enquiry form on the Take part page. It does not apply to what you send us afterwards by phone, by WhatsApp or by email, or to what is agreed once an attempt is actually being planned — by then you are dealing with a person, not a website.

What we ask for, and why

Your name, a number to call, and one line about what you have in mind. Everything else on the form is optional and says so.

The form is the only place on this site that collects anything. Nothing is gathered as you read the other pages. This is the whole of it:

Three further things are recorded automatically with each enquiry, and they are worth naming because most sites do not name them:

• Which page you sent it from and, if you arrived from another site, which site that was. This is how we learn which page actually brings people. The site's referrer policy reduces a cross-site referrer to the site's name alone, so what is recorded is “you came from a search engine”, not which search you ran to get here.
• Your browser's user-agent string — the line every browser sends identifying itself and the operating system it runs on. It is kept so that a form failing on one kind of phone can be diagnosed rather than guessed at.
• A salted hash of your IP address — never the address itself. The address is put through a one-way function together with a secret held only on the server. Two enquiries from the same connection produce the same hash, which is how five submissions in an hour are recognised as a script rather than five schools. The hash cannot be turned back into an address, and we could not tell you what yours was if you asked.

The lawful basis is your consent, given when you send the form. You can withdraw it at any time — see section 09.

What this site does not do

There is no analytics, no advertising, no tracking of any kind, and no third-party code running on these pages.

This is unusual enough to be worth listing rather than merely claiming. Each of these is a statement about the code that is actually served to you, and can be checked by opening the network tab of any browser:

If any of this changes, it changes here first, and the date at the top of the page changes with it.

The one thing kept on your device

Your choice of light or dark theme. It never leaves your browser.

If you pick a theme using the control in the menu, that choice is written to your browser's local storage under the name jwrc-theme, so the site does not forget it on the next page. It holds one word — light or dark — and nothing else. It is not sent to the server, it is not a cookie, it cannot identify you, and clearing your browsing data removes it. Leaving the control on System stores nothing at all.

One cookie does exist on this domain, and you will never receive it: a signed session cookie issued only when the administrator signs in to read enquiries. It is set to HttpOnly so no script can read it, SameSite=Strict so no other site can cause it to be sent, and it expires after twelve hours.

Who else handles it

The company that hosts the site, and the company that runs the database. Nobody else, unless you choose WhatsApp.

An enquiry passes through two service providers, both acting on our instructions and neither permitted to use it for anything of their own:

• Vercel, which currently serves these pages and runs the small piece of code that receives the form.
• The database provider holding the enquiries table, hosted in a managed PostgreSQL service.

Both operate infrastructure outside India, so an enquiry may be stored or processed abroad. The DPDP Act permits this except to countries the Central Government has restricted, and we do not use any such country.

WhatsApp is different, and it is your choice. The form offers a second button that opens WhatsApp with your message already written out. If you use it, your message goes to WhatsApp rather than to our database, and it is handled under WhatsApp's terms and Meta's privacy policy, not this one. The ordinary button does not involve them. Likewise, if you write to the email address on this site, that email is held in a Gmail mailbox and Google handles it as it handles any email.

Beyond that, nothing is shared. Not with sponsors, not with record-keeping bodies, not with anybody — except where a law, a court or a government authority in India requires it, which has not happened and would be complied with only to the extent actually required.

How long it is kept

Twenty-four months after we last spoke, then it is deleted. Ask sooner and it goes sooner.

An enquiry is kept while it is live and for twenty-four months after the last contact about it. Attempts are planned over long horizons — a school that writes in October is often attempting in the following academic year — and a record deleted at six months would mean asking somebody to explain themselves twice. After that period it is deleted.

If you would rather it went before then, say so and it will be deleted, normally within seven days. There is no form to fill in for this; a phone call is enough.

Where an attempt actually goes ahead, the paperwork that a record body requires of us is a separate matter, is agreed with you at the time, and is kept for as long as that body requires. That is not covered by this notice.

How it is protected

Encrypted in transit, behind a password, readable by one person, and never written into anything public.

• The whole site is served over HTTPS, so what you type into the form is encrypted between your device and the server.
• Enquiries are readable only through a console that requires a password. The password lives in the host's environment — it is not in the website's code, and it is not in the public repository the site is built from.
• The password is compared in constant time, so the comparison itself cannot be used to guess it a character at a time, and a session is a signed statement of when it expires rather than the password travelling back and forth.
• Enquiries are written to the database with bound parameters, never by pasting your text into a query — the ordinary cause of a database being read by somebody who should not be reading it.
• Your IP address is hashed before storage, so a copy of the database does not contain the addresses of the people who wrote in.
• Every page is served with a permissions policy that refuses the camera, the microphone and location outright — so even a fault in this site's code could not reach them — along with headers that stop the pages being framed by another site or having their content type second-guessed.

No system is beyond reach, and anybody who tells you otherwise is selling something. If a breach ever affects your information, you will be told, and so will the Data Protection Board of India, as the Act requires.

Children, schools and consent

The form is for adults. Children take part in attempts through their school, and this site never collects anything about them.

Much of what the Carnival does happens with schools, and many of the people in a record attempt are under eighteen. None of them use this form. It is meant to be filled in by a teacher, a principal, a coordinator or a parent — an adult who can decide on behalf of an institution.

Please do not send us a child's name, photograph, phone number or class through this form. If you are under eighteen and want to take part, ask a parent or a teacher to write in for you.

Where a school does go ahead with an attempt, consent for the children taking part — including for photographs — is arranged with the school and the parents in writing at that point, under the DPDP Act's requirement for verifiable parental consent. It is not something this website handles.

Your rights, and how to use them

Ask what we hold, have it corrected, or have it deleted. A phone call is enough, and it costs nothing.

Under the Digital Personal Data Protection Act, 2023, you may:

• Ask what we hold about you, and who it has been shared with.
• Have it corrected or completed if it is wrong or out of date — a mistyped number, a changed school.
• Have it erased, unless a law requires us to keep it.
• Withdraw your consent, as easily as you gave it. Withdrawing it means we stop processing the enquiry and delete it; it does not undo a call that has already happened.
• Nominate someone to exercise these rights for you in the event of your death or incapacity.
• Complain — first to us, and then, if we have not resolved it, to the Data Protection Board of India.

To use any of them, ring +91 80030 03000 or write to manmohan.agarwal015@gmail.com. Quote the reference the site gave you when you sent the form if you still have it — it makes the enquiry findable in one step — but it is not required, and neither is a reason. We aim to answer within seven days and will not take longer than thirty.

The Act also asks something of you: that what you send is true, and that you do not impersonate somebody else or file a complaint you know to be baseless.

Changes to this notice

The date at the top is the whole history. If it has not moved, nothing has.

This notice will change if the site changes — if a form asks for something new, or a service is added. When it does, the last changed date at the top of this page moves, and the change applies from that date onward. If a change is substantial and we hold an email address for you, we will tell you rather than leave you to notice.

Earlier versions are recorded in the public repository the site is built from, so what this page said on any given day can be established rather than remembered.