This notice explains what personal data Open Window News collects about you, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It is written to meet the notice requirements of the Digital Personal Data Protection Act, 2023.
1. Who we are
Open Window News operates this website. Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") we are the Data Fiduciary for the personal data described in this notice, which means we decide why and how it is processed. You are the Data Principal.
Our address is Kattappana. Questions about this notice go to our Grievance Officer, whose details are in section 11.
2. What we collect, and why
We collect only what a particular feature needs. If you simply read the site, the only data we hold about you is described in the last two rows of this table.
| When | What we collect | The purpose we collect it for |
|---|---|---|
| You create an account | Username, email address, and your password, which we store only as a one-way hash and cannot read | To create your account, sign you in, and contact you about your account |
| You sign in with Google, Facebook or VK | The account identifier, email address, display name and profile picture that the provider returns to us | To create or match your account without you needing a separate password |
| You fill in your profile | Display name, profile and cover images, your "about me" text, and any social media links you choose to add | To show your public profile alongside your comments and any articles you write |
| You post a comment | Your name, email address, the comment itself, and the IP address you posted from | To publish your comment, to contact you about it if we need to, and to identify and block abuse and spam |
| You use the contact form | Your name, email address and message | To read and answer your enquiry |
| You subscribe to the newsletter | Your email address | To send you the newsletter, and to let you unsubscribe |
| You vote in a poll or react to an article | Your vote or reaction, linked to your account where you are signed in | To count the result and to stop the same person voting twice |
| You are paid as a contributor | Your PayPal email address, or your bank details: account holder name, IBAN or SWIFT details, bank name and address | To pay you what you are owed under our contributor programme |
| You browse the site | A session identifier, your IP address, your browser's user agent string, and which pages were viewed | To keep you signed in, to keep the site available and secure, and to count how often articles are read |
| You answer our consent banner or tick a consent box | Your choice for each purpose, the version of this notice you were shown, the time, your IP address and your user agent | To honour your choice, and to be able to demonstrate that you made it |
We do not buy personal data from third parties, we do not sell your personal data, and we do not build advertising profiles about you ourselves.
3. The basis on which we process your data
We rely on two grounds, and no others.
Your consent, under section 6. This covers everything you opt in to: creating an account, receiving the newsletter, and allowing analytics and advertising cookies. We ask for consent separately for each purpose, we never pre-tick a box, and we never make consent to an optional purpose a condition of using the site.
Data you voluntarily give us for a specific purpose, under section 7(a). When you send us a message through the contact form, post a comment, or submit a request under section 9 of this notice, you are handing us that data for an obvious and stated purpose. We use it for that purpose and nothing else.
Where we process personal data to keep the site secure and to prevent abuse - principally the IP address recorded with your session and with any comment you post - we do so as part of delivering the service you asked for, and we describe it here so that it is transparent to you. We keep it to the minimum needed and for no longer than the periods in section 6.
4. Cookies and similar technologies
Strictly necessary cookies are always set. These are your session cookie, the security token that protects forms against cross-site request forgery, your language choice, your light or dark mode preference, and the record of the cookie choice you made. The site cannot function without them, and they are not used to track you across other websites.
Analytics and advertising cookies are off unless you turn them on. No analytics or advertising script loads until you give consent through our banner. If you reject them, or simply ignore the banner, they are never loaded at all.
You can change your mind at any time. Withdrawing is as easy as consenting was:
Withdrawing your consent does not make our earlier processing unlawful, and it does not delete data we already hold. To have data deleted, use the form in section 9.
5. Who we share your data with
We share personal data only with the following recipients, and only for the purposes described. Each of them processes data on our instructions under a contract, as section 8(2) of the DPDP Act requires.
| Recipient | What they receive | Why |
|---|---|---|
| Our hosting provider | All data stored by the site | To run the servers and the database |
| Our email provider | Your email address and the message content | To deliver account emails and the newsletter |
| Amazon Web Services (S3) | Media files you upload | To store images and other uploads, where this storage option is in use |
| Google (reCAPTCHA) | Your IP address and how you interacted with the page | To tell real visitors from automated abuse when you submit a form. This runs on forms that are open to the public, because without it those forms are flooded with spam |
| Google (Analytics) | Your IP address, pages viewed, and a cookie identifier | To understand which articles are read. Only if you consent |
| Google (AdSense / Google Ads) | Your IP address and advertising cookie identifiers | To show and measure advertising. Only if you consent |
| Google Maps | Your IP address, when you open our contact page | To display the map showing where we are |
| Google, Facebook or VK | The fact that you signed in | Only where you choose to sign in using one of those accounts |
We will also disclose personal data where we are required to do so by law, by a court, or by a lawful order of a public authority.
6. Where your data is processed
Our servers and several of the providers listed above process data outside India. Section 16 of the DPDP Act permits transfers of personal data outside India except to territories that the Central Government has restricted by notification. We do not transfer personal data to any territory that is subject to such a restriction, and if a provider we use becomes subject to one, we will move that processing or stop using them.
7. How long we keep it
We delete personal data once the purpose we collected it for is served. In practice that means:
| Data | How long we keep it |
|---|---|
| Your account and profile | Until you ask us to delete it, or you delete your account |
| Your comments | Until you ask us to delete it, or you delete your account |
| Contact form messages | 1 year |
| Newsletter subscription | Until you ask us to delete it, or you delete your account |
| Records of your consent choices | 7 years |
| Requests you make under section 9 | 7 years |
| Session data | 30 days |
| Server logs | 90 days |
We keep records of your consent choices, and of requests you make to us, for the periods shown above because we may need them to demonstrate that we handled your data and your requests properly. We keep them for that reason alone.
Where you have deleted your account, we may keep the minimum record needed to comply with a legal obligation, or to establish, exercise or defend a legal claim, for as long as that obligation or claim lasts.
8. How we protect your data
We take reasonable security safeguards to prevent a personal data breach, as section 8(5) of the DPDP Act requires. Passwords are stored as one-way hashes and are never readable by us or by anyone who obtains the database. Access to the administration panel is limited by role, so staff can reach only the data their role requires. Forms are protected against cross-site request forgery and against automated abuse. We keep the platform patched and review our security configuration on an ongoing basis.
If a personal data breach does occur, we will notify the Data Protection Board of India and every affected Data Principal, in the form and within the time the DPDP Act and the rules made under it require.
9. Your rights
You have the following rights over the personal data we hold about you.
- To know what we hold and what we do with it (section 11). You can ask us for a summary of the personal data we hold about you, the processing we carry out on it, and the identities of the other Data Fiduciaries and Data Processors we have shared it with, together with a description of what was shared.
- To have it corrected, completed or updated (section 12). If anything we hold about you is inaccurate or misleading, we will correct it. If it is incomplete, we will complete it.
- To have it erased (section 12). We will erase your personal data on request, unless we are required by law to keep it.
- To withdraw your consent (section 6(4)). At any time, and as easily as you gave it. Withdrawal applies going forward and does not affect processing we already carried out lawfully.
- To nominate someone (section 14). You can nominate another individual to exercise these rights on your behalf if you die or become unable to exercise them yourself.
- To have your grievance addressed (section 13). You can complain to us about anything in this notice, and we will respond.
The way to exercise any of these is our data rights request form, or an email to our Grievance Officer. We will respond within 30 days.
We may need to confirm that you are who you say you are before we act on a request, particularly one to erase data or to disclose it. We will ask for no more than we need to establish that.
10. Your duties
Section 15 of the DPDP Act places some duties on you as a Data Principal. You must not impersonate anyone else when giving us your personal data. You must not suppress material information when giving personal data for a document or identifier issued by the State. You must not register a false or frivolous grievance or complaint. And when you ask us to correct or erase data, the information you give us must be genuine.
11. Children
This website is intended for a general adult audience. It is not directed at children, and we do not knowingly collect the personal data of anyone under the age of 18 without the verifiable consent of a parent or lawful guardian, as section 9 of the DPDP Act requires.
We do not carry out behavioural monitoring of children, and we do not direct advertising at children. If you believe a child has given us personal data, contact our Grievance Officer and we will delete it.
12. Grievance redressal
If you have any question or complaint about how we handle your personal data, contact our Grievance Officer. This is the person responsible for answering your questions about our processing, as section 13 of the DPDP Act requires.
Grievance Officer: MC Boban
grievance@openwindownews.com
Kattappana
We will acknowledge your grievance and respond within 30 days. If you are not satisfied with our response, or we do not respond, you have the right to complain to the Data Protection Board of India.
13. Changes to this notice
If we change how we handle personal data, we will update this notice, raise the version number shown at the top, and publish the new effective date. Where the change is material - a new purpose, a new recipient, or a new category of data - we will ask you for your consent choices again rather than assume your existing consent carries over.
This notice is available in every language this site is published in. If there is any difference between translations, the English text is the one that governs.