Barista Station ("we") runs live coffee bars, barista hire, chai and mocktail stations at events across India. This policy explains, in plain language, what personal data we collect from you on baristastation.in, why, and what you can do about it. Under the DPDP Act you are the Data Principal; we are the Data Fiduciary that decides how your data is used.
What we collect
We only ask for what we need to quote your event. We do not buy contact lists, and we do not track you across other websites.
| Data | Where it comes from | Is it required? |
|---|---|---|
| Name | Quote form, popup, or chat | Yes — to address the quote |
| Phone / WhatsApp number | Quote form, popup, or chat | Yes — how we reply |
| Email address | Quote form, popup, or chat | Optional |
| Event details (city, occasion, setup, date, guest count, notes) | Quote form, popup, or chat | Optional — improves the quote |
| Consent record (what you agreed to, policy version, timestamp) | Recorded when you submit | Yes — proof your consent was given |
| Analytics identifiers (cookie ID, pages viewed, approximate region) | Google Analytics 4, only if you accept analytics | No — off unless you opt in |
| IP address | Automatically, on form submission | Yes — used transiently to rate-limit abuse |
We never ask for payment card details on this website. Invoicing happens separately once an event is confirmed.
Why we collect it
Every purpose below is specific. We do not repurpose your enquiry data for anything you did not agree to.
- To prepare and send your quote — the menu, per-guest price and availability for your date.
- To contact you about that enquiry — by phone, WhatsApp or email, and to follow up on it.
- To run and protect the site — remembering your privacy choice, and limiting automated abuse of the enquiry form.
- To understand what the site gets wrong — aggregate analytics, only with your consent.
Consent and withdrawal
Our lawful basis is your consent. When you submit an enquiry you tick an unticked box agreeing to be contacted about it — that consent is specific to your enquiry, is not bundled with anything else, and is recorded with a timestamp and the version of this policy you were shown.
Analytics and marketing cookies are a separate choice, made in the privacy banner. Both start switched off.
Change or withdraw your cookie consent at any time — it takes effect immediately, with no questions asked:
To withdraw consent for us to hold your enquiry, email [email protected]. Withdrawal does not undo processing that already lawfully happened before you withdrew.
Who else sees it
Your enquiry is delivered to our events team through a third-party lead-collection service acting as our processor on our instructions. It is used only to route your enquiry to us — never sold, never rented, never used for anyone else's advertising.
If you accept analytics or marketing cookies, Google receives the corresponding data as described in its own privacy terms. If you decline, Google Analytics runs in a cookieless mode that does not identify you.
We may also disclose data where the law requires it — a court order, or a lawful request from a government agency.
How long we keep it
| Data | Kept for | Then |
|---|---|---|
| Enquiries that became events | 7 years | Deleted; retained only as required for tax and contract records |
| Enquiries that did not convert | 24 months from last contact | Deleted |
| Consent records | As long as the related data, plus 12 months | Deleted |
| Rate-limiting IP data | Transient — minutes, in memory | Discarded automatically |
| Analytics data | 14 months (Google Analytics default) | Deleted by Google |
We erase personal data once the purpose it was collected for is served and no law requires us to keep it, as the DPDP Act requires.
Your rights as a Data Principal
The DPDP Act gives you these rights. Exercising them is free.
- Right to access — ask what personal data of yours we hold and who we shared it with
- Right to correction and completion — have inaccurate or incomplete data fixed
- Right to updating — keep your details current
- Right to erasure — have your data deleted where no law requires us to keep it
- Right to withdraw consent — at any time, as easily as you gave it
- Right to nominate — name someone to exercise your rights if you die or become incapacitated
- Right to grievance redressal — a reply from us before you escalate
To exercise any of these, email [email protected] from the address or phone number you contacted us with, telling us which right you want to use. We respond within 30 days. We may ask you to confirm your identity first, so we do not hand your data to someone else.
Children's data
This site is meant for adults booking event services. We do not knowingly collect personal data of anyone under 18 without verifiable consent from a parent or legal guardian, and we never use children's data for behavioural advertising or tracking — both are prohibited under the DPDP Act. If you believe a child has given us data, email [email protected] and we will delete it.
How we protect it
- Enquiries travel over HTTPS and are validated on our server before being stored or forwarded.
- Credentials for our lead systems are held in server-side environment variables, never in the website's code that your browser downloads.
- Submission rate limits and automated-abuse checks protect the form.
- Access to enquiry data is limited to the events team members who need it.
If a personal data breach affects you, we will notify you and the Data Protection Board of India as the Act requires.
Grievance redressal
If you are unhappy with how we have handled your data or your request, contact our Grievance Officer. We acknowledge every grievance and aim to resolve it within 30 days.
Barista Station — Data Protection & Grievances
- Email: [email protected]
- Phone: +91 96731 98867 (Mon–Sun, 8:00 AM – 10:00 PM)
- WhatsApp: +91 96731 98867
Still unsatisfied? You may escalate to the Data Protection Board of India.
We update this policy when our practices change. Material changes reset your cookie consent, so you will be asked to choose again. Last updated 14 October 2026.