Privacy Policy for EFY Group Events
Last updated: 12 October 2026
1. Who we are and what this policy covers
This policy explains how EFY Enterprises Pvt Ltd ("EFY Group", "we", "us", "our") collects, uses, shares and protects personal data when you register for, attend, speak at, exhibit at, sponsor or volunteer at any of our events, or use our event websites, registration portals and communications.
It applies to every event we organise, including Open Source India, India Electronics Week, IOTshow, BharatAI and AI DevCon, and to our conferences, expos, workshops, roadshows, awards, webinars and online events, whether held in person, online or in hybrid format.
For the personal data covered here, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). We follow the Information Technology Act, 2000 and the rules made under it, and the DPDP Act and the Digital Personal Data Protection Rules, 2025 as their provisions come into force.
Some events are co-hosted with partners. Where a partner runs registration on its own website or form, that partner's privacy policy governs what it collects. We tell you at registration which organisation collects your details.
You can ask for this policy in English or in any language listed in the Eighth Schedule to the Constitution of India by writing to privacy@efy.in (section 15).
2. Personal data we collect
We collect only what we need to run the event you sign up for and the purposes in section 3. Most of it comes from you directly; some comes from your activity at the event or on our websites.
| Category | Examples | How we get it |
|---|---|---|
| Identity and contact | Name, email address, mobile number, city, state, country | Registration forms, enquiries, account sign-in |
| Professional profile | Job title, organisation, industry, department, company size, areas of interest, role in purchase decisions | Registration forms, surveys |
| Registration and attendance | Pass type, workshops booked, badge QR code, check-in times, sessions attended, badge scans at booths, certificates issued | Registration system, entry scanners, session and booth scanners |
| Payment and billing | Amount paid, transaction reference, payment status, billing name and address, GST number | Registration system and payment gateway |
| Images, audio and video | Photographs, video, audio and livestreams recorded at the venue or in online sessions | Our photographers, video teams and streaming platforms (see section 4) |
| Speaker, exhibitor and sponsor details | Bio, headshot, presentation files, social profile links, staff badge details, travel and stay details | Speaker and exhibitor forms, contracts, email |
| Communications and feedback | Emails, WhatsApp and SMS replies, support requests, survey and feedback responses, Q&A and chat in online sessions | You, our messaging and survey tools |
| Device and usage | IP address, browser and device type, pages visited, referring site, cookie identifiers, email opens and clicks | Cookies, analytics and email tools (see section 7) |
| Visa letter details | Passport name and number, nationality, travel dates | Only if you ask us for a visa invitation letter |
| Accessibility and dietary needs | Mobility or seating needs, dietary preferences | Only if you choose to tell us |
We do not need your Aadhaar number, and we ask you not to send it. We do not collect or store your full card number, CVV, UPI PIN or net banking password: these go directly to the payment gateway.
If you give us details about another person (for example, when registering colleagues as a group), you confirm that they know you are sharing their details with us and have seen this policy.
3. Why we use your data, and on what basis
We use your personal data only for the purposes below. Where we rely on your consent, you can withdraw it at any time, as easily as you gave it (section 13). Withdrawal does not affect anything we did lawfully before it.
| Purpose | Data used | Legal basis |
|---|---|---|
| Register you, issue your pass, badge and invoice, and run the event (entry, seating, workshops, certificates, lunch, recordings you are entitled to) | Identity, contact, professional, registration, payment | You provided it voluntarily for this purpose (a legitimate use under Section 7 of the DPDP Act) |
| Send service messages: confirmations, badge, schedule or venue changes, safety notices, post-event access | Contact, registration | Legitimate use for the purpose you registered for |
| Process payments, refunds, GST invoices and accounting | Payment and billing | Compliance with tax and company law |
| Keep the venue safe and secure, verify entry, prevent misuse of passes or discount codes, enforce our Code of Conduct | Identity, registration, attendance | Legitimate use, and compliance with law |
| Respond to medical emergencies or safety incidents at the venue | Identity, contact, details you or others give us | Legitimate use for medical emergencies and safety, as permitted by law |
| Photograph, record, livestream and publish the event (section 4) | Images, audio and video | Your consent, given at registration and through notice at the venue |
| Share your details with sponsors or exhibitors (section 5) | Identity, contact, professional | Your consent, given by an opt-in, by letting them scan your badge, or by registering for a sponsored session |
| Send you news, invitations and offers about our events and publications (section 6) | Contact, professional, attendance | Your consent |
| Improve our events and websites, measure campaigns, and show relevant ads (section 7) | Device and usage, feedback | Your consent, which you can refuse or withdraw through your browser and ad settings (section 7) |
| Comply with legal obligations, court orders and lawful requests from authorities | Any relevant data | Compliance with law |
We do not use your personal data to make decisions about you by automated means that produce legal or similarly significant effects.
4. Photography, video, livestreams and recordings
Photographs and video are taken throughout our events and published online. If you attend, you may appear in them. This section explains what we record, where it goes and how to opt out.
What we record. We, our appointed photographers and video crews, and media we accredit photograph, film, record and livestream our events. This covers keynotes, conference sessions, workshops, panel discussions, the exhibition floor, booths, registration areas, networking and lunch areas, and award ceremonies. Online and hybrid sessions may be recorded, including the names, video, questions and chat messages of participants.
Where it is published. Photos and recordings may appear, during and after the event, on:
- our event websites, galleries and post-show reports
- our social media and video channels, including YouTube, LinkedIn, Instagram, Facebook, X and WhatsApp channels
- our publications and their websites, newsletters and emails
- brochures, presentations and advertising (including paid online ads) for this and future editions of our events
- platforms where pass holders watch session recordings
We may also give photos and video to speakers, sponsors and exhibitors for coverage of their own participation, and to news media.
Speakers. Talks, slides and panel discussions are recorded and may be published in full. The speaker agreement or speaker form governs recording and publication rights in more detail. Audience members who ask questions from the floor or in an online Q&A may appear or be heard in a recording.
How we tell you. We tell you at registration, and we place notices at venue entrances and in halls where recording is in progress.
If you do not want to be photographed or filmed:
- At registration, use the photography preference on the form where it is offered.
- At the venue, tell the registration desk or the photographer. Our crews will avoid photographing you deliberately.
- In session halls, avoid the front rows and areas marked as camera zones.
- After the event, ask us to remove or blur a photo or video of you through the account removal page or by writing to privacy@efy.in. Include a link to, or description of, the image. We will remove or blur it from the channels we control within 5 working days.
What we cannot do. We cannot recall printed material already distributed, or copies that other people have downloaded, saved or reshared. Where you appear incidentally in a crowd or wide shot, we may blur you rather than remove the whole image. Other attendees and independent media also take photos and video at events, and we do not control what they publish.
Children. We do not knowingly publish identifiable images of anyone under 18 without the consent of a parent or lawful guardian.
CCTV. Venues may operate CCTV for security. That footage is controlled by the venue operator under its own policies, not by us.
5. Who we share your data with
We share your personal data only with the recipients below, and only as much as each needs.
| Recipient | What they receive | When |
|---|---|---|
| Sponsors and exhibitors | Name, organisation, job title, email, phone, city, and the interests you selected | When you let them scan your badge or share your details at their booth; when you register for a session, workshop or webinar that the form says is presented by a sponsor; or, if you agree to it at registration, as part of the delegate list we give to that event's sponsors and exhibitors |
| Speakers and workshop trainers | Names and organisations of participants in their session | To run the session, take attendance and issue certificates |
| Service providers working for us (Data Processors) | Only the data needed for their task | Registration and ticketing, payment gateways, email, SMS and WhatsApp messaging, cloud hosting, badge printing, event apps, photography, video and livestreaming, surveys, analytics and advertising, venue, logistics, travel and hotel booking for speakers |
| Our group publications | Contact and professional details | To send you related events and content, subject to your marketing choices in section 6 |
| Venue operators and security agencies | Names and badge details where needed | For entry control and safety at the venue |
| Government, police, courts and regulators | What the law requires | When required by law, a court order or a lawful request, or to protect the safety of people at the event |
| A buyer or successor of our business or an event | The relevant event records | If an event or our business is sold, merged or transferred, under the same protections as this policy |
Sponsors and exhibitors use your data under their own privacy policies. Once you share your details with them, they decide how to contact you. To stop hearing from a sponsor, use the unsubscribe option in their messages or contact them directly.
Service providers act on our instructions under contracts that require them to keep your data secure and confidential and use it only for the services they provide to us.
Public information. Speaker names, photos, bios and session details are published on our websites. Anything you post in a public event chat, community channel or social media group is visible to other participants.
6. Messages we send you
Service messages about an event you registered for (confirmation, badge, invoice, schedule or venue changes, safety notices, access to recordings) are sent by email, SMS or WhatsApp. These continue while you hold a registration, even if you opt out of marketing.
Marketing messages about our events, publications and offers are sent only with your consent, by email, SMS, WhatsApp or phone call. You can stop them at any time:
- Email: use the unsubscribe link at the bottom of any email.
- WhatsApp: tap "Stop promotions" or reply STOP.
- SMS and calls: reply as instructed in the message, or register on the National Do Not Call registry. We send commercial SMS and calls in line with the TRAI Telecom Commercial Communications Customer Preference Regulations, 2018.
- All channels at once, or our whole group: use the Subscription and Account Removal page, where you can choose which messages to stop, including all promotions from EFY Group.
We act on an opt-out within one month. To make sure we do not contact you again, we keep your email address or mobile number on a suppression list.
7. Cookies, analytics and advertising
Our event websites and registration portals use cookies and similar technologies to keep you signed in, remember your choices, measure how the sites are used, and show you relevant ads on other sites and apps.
| Type | What it does | Examples |
|---|---|---|
| Essential | Sign-in, registration and checkout, security | Session and checkout cookies |
| Analytics | Counts visits and shows which pages and campaigns work | Google Analytics |
| Advertising and remarketing | Measures ad results and shows our ads to people who visited our sites | Google Ads, Meta Pixel, LinkedIn Insight Tag |
| Embedded content | Plays videos and maps on our pages | YouTube, Google Maps |
| Email measurement | Records whether an email was opened and which links were clicked | Our email service provider |
You can block or delete cookies in your browser settings, and manage ad personalisation in your Google, Meta and LinkedIn account settings. Blocking essential cookies may stop registration or checkout from working.
These providers may combine information from our sites with what they already hold about you, under their own privacy policies.
8. Payments
Payments are processed by third-party payment gateways that are authorised under Reserve Bank of India rules. You enter card, UPI or net banking details on the gateway's own secure page. We receive only the transaction reference, amount, payment method type and status, which we use for your pass, invoice, refunds and accounts.
9. How long we keep your data
We keep personal data until you ask us to delete it or withdraw your consent, except where the law requires us to keep it longer.
| Data | How long we keep it |
|---|---|
| Registration, attendance and profile data | Until you ask us to delete it or withdraw your consent |
| Invoices, payment and tax records | At least 8 years, as required by tax and company law, even if you delete your account |
| Published photos, video and recordings | Until you ask us to remove them (section 4) |
| Visa letter details | Until you ask us to delete them |
| Accessibility and dietary information | Until you ask us to delete it |
| Badge scans and delegate lists shared with sponsors | Our copy: until you ask us to delete it. Each sponsor keeps its copy under its own policy |
| Security and access logs | At least one year, as required by law |
| Suppression list (email or mobile only) | Kept indefinitely so that we never contact you again after an opt-out or deletion |
10. Security and data breaches
We protect personal data with reasonable security safeguards, including encryption in transit, access limited to staff who need it, password and access controls on our systems, contracts with service providers, regular backups, and logging of access.
No system is completely secure. If a personal data breach affects you, we will inform you without delay through your registered email or phone number, explaining what happened, the likely impact, what we are doing and what you can do. We will also report the breach to the Data Protection Board of India and to CERT-In where the law requires.
11. Where your data is stored
Our service providers may store or process your data on servers outside India, for example cloud hosting, email and advertising platforms. We transfer data outside India only as permitted by Indian law, and not to any country the Central Government restricts by notification.
12. Children
Our events are meant for professionals and students aged 18 and over. Anyone under 18 may register or attend only with verifiable consent from a parent or lawful guardian, who must contact us before the event. We do not track the behaviour of children or direct targeted advertising at them. If we learn that we hold data about a child without that consent, we will delete it.
13. Your rights
You have the right to:
- Access: get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction and update: have inaccurate or incomplete data corrected, completed or updated.
- Erasure: have your data deleted when it is no longer needed for the purpose, or when you withdraw consent, unless the law requires us to keep it.
- Withdraw consent: at any time, for any purpose that relies on consent.
- Grievance redressal: have your complaint handled by our privacy team.
- Nominate: name another person to exercise your rights if you die or become unable to act.
- Complain to the regulator: approach the Data Protection Board of India if you are not satisfied with our response.
To use any of these rights, write to privacy@efy.in (section 15) or use the Subscription and Account Removal page. We may ask you to confirm your identity, for example through a one-time password sent to your registered email or mobile, before acting. We respond within one month.
Please give us accurate information, do not impersonate anyone, and do not file false or frivolous complaints.
14. Deleting your account
You can ask us to delete your account, or stop specific messages, at any time on the Subscription and Account Removal page. This page handles requests for all EFY Group events, not only Open Source India.
When we delete your account:
- We erase your profile, registration history and preferences, and stop all marketing to you.
- Deletion is permanent. If you hold a pass for an upcoming event, deleting your account may cancel your badge, certificate and access to recordings, so request deletion after the event if you still plan to attend.
- We keep only what the law requires (such as invoices and tax records, section 9) and your email or mobile number on our suppression list.
- We ask our service providers to delete their copies. Sponsors and exhibitors who received your details with your consent hold them under their own policies, so contact them directly.
- Removing your account does not remove photos or video you appear in. To request that, say so on the same page or write to us with a link to the image (section 4).
15. Contact us about privacy
For any question, request or complaint about your personal data, contact:
Privacy team, EFY Enterprises Pvt Ltd
D-87/1, Okhla Industrial Area, Phase I, New Delhi 110020, India
Email: privacy@efy.in
Phone: +91-98111 55335
We resolve complaints within one month. If you are not satisfied, you may complain to the Data Protection Board of India.
16. Changes to this policy
We may update this policy when our events, services or the law change. The "Last updated" date at the top shows the latest version. If we make a significant change to how we use your data, we will tell you by email or on our event websites before it takes effect, and ask for fresh consent where the law requires.