This policy explains what personal data Alfa Entertainments collects when you use alfaentertainment.in, join a guestlist, or attend one of our events, and what we do with it. It is written for India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Where this policy says "we" or "us", it means Alfa Entertainments.
Who we are
Alfa Entertainments is a sole proprietorship based in Bengaluru, Karnataka. We promote and organise nightlife events at partner venues in the city. For anything in this policy, write to privacy@alfaentertainment.in. We are the "data fiduciary" for the personal data described here, which is the law's term for the party that decides why and how your data is processed.
What this policy covers
The website at alfaentertainment.in, guestlist registration on our event pages, our contact with you about events, and photography and filming at events (which has its own notice), and the messages we send you on WhatsApp. It does not cover our partner venues, ticketing platforms we link to, or your own use of Instagram and WhatsApp, which is governed by their privacy policies.
What we collect
We collect only what the table shows. We do not buy data about you or combine it with data from brokers.
| When | What | Why | Basis |
|---|---|---|---|
| You join a guestlist | Your name and the names of the guests you add, your phone number, the entry type you choose (stag, ladies, couple or mixed), the number in your party, the event, and the time you registered. | To put your party on the door list for that event, to prevent duplicate registrations, and to contact you about that event if we need to. | Your consent, given when you submit the form. |
| You join a guestlist | How you reached us: a referral code identifying the promoter or artist whose link you used, the platform the link came from (for example Instagram or WhatsApp), whether it was a paid ad, and the placement or ad name. These come from the link you clicked, not from your device. | To know which promotion brought you here and to credit the right promoter. This never identifies you beyond your registration. | Legitimate use: measuring our own promotions. |
| You have joined more than one guestlist | A guest record linking your phone number and name to the events you registered for, with a count of visits and the dates of your first and most recent registration. | To recognise returning guests and manage door lists across events. | Legitimate use: running our events. |
| You browse the site | Usage analytics through Google Analytics 4: pages viewed, approximate location from your IP address, device and browser type, and the site that referred you. Google does not store your full IP address. We also record what you do on the site: opening an artist or venue card, playing a video, tapping for directions, adding an event to your calendar, tapping a reservation or ticket link, and each step of the guestlist form, including whether it succeeded. These carry the event, artist or venue name and details like entry type and party size, never your name or phone number. If you arrived through a tagged promotion link, we attach which promotion and which promoter it was. | To understand what people look at, which artists and events draw interest, where people give up on the guestlist form, and which promotions work, so we can improve the site and our events. | Consent (see Cookies below). |
| You browse the site or register | Meta Pixel: page views, and events for viewing an event page, starting the guestlist form, opening an artist card and tapping a reservation link. These carry the event or artist name, not yours. On a completed registration we also send Meta a one-way hashed (SHA-256) version of your phone number and first name, which Meta uses to match the registration to a Meta account for ad measurement. We never send Meta your name or number in readable form. | To measure our Instagram and Facebook advertising and to build audiences for it: showing ads to people who started a guestlist registration without finishing it or who looked at a particular artist, and excluding people who already registered from further ads for that event. | Consent (see Cookies below). |
| You contact us | What you send us and your contact details, whether by phone, WhatsApp, Instagram message or email, including table reservation requests. | To answer you and, for reservations, to pass the booking to the venue. | Legitimate use: responding to you. |
| We message you on WhatsApp | Your choices about WhatsApp messages (event updates, and separately promotions) and when you made them, a log of each message we send you with its delivery status, and any reply you send us, such as STOP. | To send only what you agreed to, to avoid sending the same message twice, and to show your consent if asked. | Your consent, and legitimate use in keeping a record of it. |
| We decide you should not be shown our ads, or should not be admitted | Your phone number, your name where we have it, which of three reasons applies (you are one of our own team, we already know you are coming, or we have decided not to accept your registrations), and a short internal note recording why. | So that we do not pay to advertise to people who should not be receiving those ads, and so that the guestlist form can decline a registration we have decided not to accept. A declined attempt is not recorded: nothing new is stored about it. | Legitimate use: running our events and managing our own advertising. |
| You attend an event | Photographs and video in which you may appear. | Promotion of our events. See the Photography and Filming Notice. | Your acknowledgement on entering, and legitimate use for publicly held events. |
What we do not collect
- Payment details. The site takes no payments. Door charges are paid to the venue; tickets, where offered, are sold by a separate ticketing platform under its own policy.
- Identity documents. Venues check your ID at the door. We do not copy, scan or store it.
- Email addresses, unless you email us.
- Precise location. We do not ask for or read your device's location.
- Anything from your contacts, photos or other apps.
How we use your data
- To run the guestlist for each event: putting your party on the door list, catching duplicate registrations, and letting the door team confirm you on arrival.
- To contact you about an event you registered for, such as a change of time or venue, a cancellation, or a problem with your registration. We may do this by phone, SMS or WhatsApp.
- To measure our promotions: which links, promoters and ads bring people to our events.
- To keep the site and our records secure, and to detect misuse such as fake or automated registrations.
- To stop our ads reaching people who should not see them: our own team, people we already know are coming, people who have already registered for that event, and anyone we have decided not to accept.
- To decline a guestlist registration from someone we have decided not to accept. We tell you the registration could not be accepted, and you can contact us if you think it is a mistake.
- To meet legal obligations, and to respond to lawful requests from authorities.
We will not send you promotional messages about other events unless you have separately agreed to receive them. Where we offer that option, it is a separate, unticked choice on the form, and you can withdraw it at any time.
Who we share it with
- The door team at the venue. Guest names, party size and entry type for that event, so you can be admitted. Phone numbers are shown to door staff only when needed to resolve a question about a registration. The venue does not receive our guest list for its own use.
- Our service providers, who process data only on our instructions: Railway (database and media hosting), Netlify (website hosting and image delivery), Google (analytics and web fonts), Meta (advertising measurement, and the WhatsApp Business Platform that carries the WhatsApp messages we send you), and Tempestronics, the studio that builds and maintains the site and the messaging integration and has administrative access for that purpose.
- Meta, as one-way hashed lists used only to exclude people from ads. We upload phone numbers that have been hashed (SHA-256) on our own systems so that Meta can stop showing our ads to people who have already registered for an event, and to people on the list described above. Meta never receives a readable phone number, and we use these lists only to exclude people from ads, never to target them.
- Calendar providers, only if you tap "Add to calendar": the event details open in Google Calendar or Outlook, or download as a file. Nothing about you is sent.
- Authorities, where the law requires it or to protect the safety of people at an event.
We do not sell personal data, and we do not share it with other event companies or venues for their marketing.
Where your data is stored
The website is served by Netlify from its global network, so the server that answers you may be outside India. Our database and event media are hosted by Railway, whose infrastructure may also be outside India. Google and Meta process analytics and advertising data on their global infrastructure. Indian law permits these transfers unless the Central Government restricts a specific country, and we will move data if that happens.
Cookies and storage on your device
We use a small number of cookies and browser storage entries. Analytics and advertising cookies are set by Google and Meta. You can block or clear them in your browser settings at any time, and the site keeps working without them.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
_ga, _ga_* | Google Analytics | Tells repeat visits apart from new ones. | Up to 2 years |
_fbp, _fbc | Meta Pixel | Ad measurement and audience matching; _fbc is set only when you arrive from a Meta ad. | 90 days |
al-theme-mode, nuxt-color-mode | Us (local storage) | Remembers your light, dark or automatic theme choice. | Until you clear it |
al-attr-first, al-attr-last | Us (local storage) | Remembers which link brought you to the site so your registration can be credited to the right promotion. | 7 days |
No cookie is used to identify you by name. The admin area uses a separate login session that only staff have.
Messages from us
Registering for an event means we may contact you about that event. We keep this to what you need: a confirmation, a reminder on the day, and any change or cancellation. Where we send these on WhatsApp, they travel through Meta's WhatsApp Business Platform, which tells us whether each message was delivered and read; we keep that with our message log.
You can stop WhatsApp messages at any time by replying STOP or tapping the button under any message. We keep a record of that choice so we do not message you again by mistake. Promotional messages about other events are sent only with your separate agreement, and each one includes a way to stop them.
How long we keep it
| Data | Kept for |
|---|---|
| Guestlist registrations | 24 months after the event, then deleted or reduced to anonymous counts. |
| Guest records (visit history) | 24 months after your most recent registration. |
| WhatsApp consent records and message logs | 24 months after the event they belong to, the same as the registration. |
| Opt-out records | Kept until you ask us to message you again, so that we never message you by mistake. |
| Records of people not to be shown ads or not to be admitted | Kept while the reason still applies, and reviewed at least every 24 months. Removing a record is what allows the ads and the guestlist form to treat you normally again, so we keep it only as long as it is needed. |
| Messages you send us | Until the matter is closed, and no longer than 24 months. |
| Backups | Up to 90 days, after which deleted data is gone from backups too. |
| Analytics and advertising data | Per Google's and Meta's retention settings, which we set to the shortest option available. |
| Event photography and video | For as long as the material is in use. See the Photography and Filming Notice for removal requests. |
We keep data longer only where the law requires it or to resolve a dispute.
How we protect it
The site is served over HTTPS. Guest data is stored in access-controlled collections that cannot be read without a staff login, staff passwords are stored hashed, and hosting is with providers that maintain their own security certifications. Registration details are validated on our server, not just in your browser. No system is perfectly secure; if a breach affects your data we will inform you and the Data Protection Board of India as the law requires.
Your rights
Under the Digital Personal Data Protection Act you can ask us to:
- Tell you what personal data we hold about you and who we have shared it with.
- Correct anything that is inaccurate or incomplete.
- Delete your data, unless we must keep it to meet a legal obligation.
- Withdraw consent for anything that rests on consent, such as promotional messages or analytics cookies. Withdrawing does not affect what was done before.
- Nominate someone to exercise these rights for you if you are unable to.
- Raise a grievance, and if we do not resolve it, complain to the Data Protection Board of India.
To use any of these, email privacy@alfaentertainment.in with the phone number you registered with. We will confirm it is you, usually with a call or a one-time code to that number, and respond within 30 days. You can also ask for this policy in another Indian language and we will provide a translation.
Age
Our events and this site are for adults. You must be at least 18 to register, and venues that serve alcohol admit only guests aged 21 and over, as Karnataka law requires. We do not knowingly collect data from anyone under 18; if you believe we have, tell us and we will delete it.
Grievance officer
Sanju, Alfa Entertainments, Bengaluru
privacy@alfaentertainment.in
We acknowledge grievances within 3 working days and aim to resolve them within 30 days. If you are not satisfied you may approach the Data Protection Board of India.
Changes to this policy
When we change this policy we update the effective date at the top and, for changes that affect what we collect or why, we tell registered guests through the channel they used to register. Earlier versions are available on request.