Privacy Policy

Draft status

This page is a draft for review. It has not been approved. It is not a final policy, and it does not create a legal commitment that has not been written down here. Version draft-2026-10-28.

The Digital Personal Data Protection Act, 2023 (22 of 2023) did not start in full on the day it was enacted. Ministry of Electronics and Information Technology notification G.S.R. 843(E), dated 13 November 2025, appoints different provisions on different dates. Definitions and the provisions listed for the date of that notification are the ones brought in on publication. Consent-manager provisions are appointed for one year after publication. Notice, consent, security safeguards, personal-data rights, children's-data duties, penalties, and the remaining substantive duties are appointed for eighteen months after publication. The Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025) use the same staged commencement. This draft does not treat a provision as already in force unless that notification has brought it in. Reviewers should read the gazette text rather than this summary.

Data fiduciary and processor

The legal name of the organisation that decides why account data is processed is [Not recorded: data fiduciary legal name]. Its address is [Not recorded: data fiduciary address].

Whether that organisation is a data fiduciary, a data processor, or both for each kind of record is [Not recorded: fiduciary and processor roles]. A mosque tenant's operational records are stored for that tenant. The platform does not treat a tenant's private records as public directory data.

Categories of personal data

The running service stores the account name, email address, mobile number, password hash, role, workspace, and, for a mosque request, the organisation name and city. It also stores the draft terms and privacy version accepted at registration, the time of that acceptance, and the user id. Optional marketing preference is stored separately.

A contact or data-request form stores the name, email, category, and message the person typed. Session cookies are HttpOnly. The public mosque directory returns a mosque name, city, zone, and Halka only.

Purposes and lawful grounds

Account data is used to sign the person in, to keep the session, to route a mosque approval, and to record which draft legal text they accepted. Contact-form data is stored so a request exists. It is not sent to a logging service as message text.

The lawful ground for each purpose, including any ground under the Digital Personal Data Protection Act once the relevant provisions are in force, is [Not recorded: lawful ground for each purpose]. Consent and legitimate-use provisions of that Act are in the later commencement stage described above and are not treated as already in force in this draft.

Tenant-controlled records

After approval, a mosque workspace is a tenant. Membership, roles, and mosque operations for that tenant stay scoped to it. Row-level security is one of the controls. A signed-in mosque admin does not receive another tenant's private verification queue.

The public directory does not include tenant identifiers.

Personal Salah and Qaza

Personal Salah and Qaza are designed to belong to the user, not to a mosque tenant. They are not part of the public homepage. A live Qaza store is not what the public pages display.

Students and guardians

Student and guardian records are described in the draft Child and Guardian Privacy page. They are not published in the mosque directory. A live student register is not part of the public site.

Hosting and service providers

The hosting provider is [Not recorded: hosting provider]. The hosting location is [Not recorded: hosting location]. Other processors are [Not recorded: list of service providers].

Security

Passwords are stored as hashes. The session cookie is HttpOnly. Database row-level security limits which rows an application role can see. Role and tenant come from the server session, not from a value the browser chooses.

A certification, a penetration-test date, and a breach-notice process are [Not recorded: security certification and breach process]. Breach-notice duties in the Digital Personal Data Protection Rules are in the later commencement stage and are not treated as already in force here.

Retention

How long each category is kept, and when it is deleted, is [Not recorded: retention period]. This draft does not invent a number of days or years.

User rights

Access, correction, erasure, grievance redressal, and nomination under the Digital Personal Data Protection Act are among the provisions appointed for the later commencement stage. This draft does not treat those rights as already in force.

A grievance officer is [Not recorded: grievance officer]. A response time is [Not recorded: grievance response time]. A person can still submit a privacy request through the contact form. The form stores the request. It does not confirm that a person will reply.

Complaints

The Data Protection Board is part of the provisions brought in with the 13 November 2025 notification for its establishment. Penalty and inquiry powers sit in the later commencement stage. This draft does not tell a person that a penalty route is already open.

Where to send a complaint today is [Not recorded: complaint contact].

Contact

A privacy email address is [Not recorded: privacy email]. Use the contact form and choose the privacy category. Do not send account passwords in that message.