Privacy Policy

1. Who we are and scope

The Engineer Owl ("we", "us", "our"), a sole proprietorship registered at New Delhi, India, is the Data Fiduciary for personal data collected through https://theengineerowl.com/ and any related pages, forms, quests, contests and communications (together, the "Services"). "You" means any person who visits or uses the Services. "Personal data" means any data about an individual who is identifiable by or in relation to that data, as defined in the Digital Personal Data Protection Act, 2023 ("DPDP Act").

This policy is written to meet the DPDP Act, the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. By using the Services or ticking the consent box where shown, you agree to this policy. If you do not agree, please do not use the Services.

Contact for all privacy matters: Utkarsh Dristant, support@theengineerowl.com, New Delhi.

2. Personal data we collect

We collect only what we need for the purposes in Section 3.

We do not knowingly collect sensitive personal data such as health, biometric, caste, religion or political information. Please do not submit it. If you share any government ID number, we collect it only where a specific law requires it, and we do not store it longer than necessary.

3. Why we use your data and our legal basis

We process your personal data only for lawful purposes, mainly on the basis of your free, specific, informed and unambiguous consent under Section 6 of the DPDP Act, and for "certain legitimate uses" under Section 7 where applicable.

• Providing the Services: creating accounts, running quests and contests, recording scores, publishing leaderboards, delivering prizes and certificates. Basis: consent, and legitimate use where you voluntarily provide data for a stated purpose.
• Payments and refunds: processing entry fees or purchases and issuing receipts. Basis: consent and legal obligation.
• Legal and tax compliance: TDS on prizes, GST records, accounting and responding to lawful requests from courts or authorities. Basis: legal obligation.
• Communication: replying to queries, sending service messages and updates about your participation. Basis: consent.
• Marketing: newsletters and promotional messages. Basis: separate, optional consent. You can withdraw it at any time with no effect on your access to the Services.
• Security and fraud prevention: detecting cheating, duplicate accounts, abuse and unauthorised access. Basis: legitimate interest and legal obligation.
• Improving the Services: aggregated analytics on how pages and quests are used. Basis: consent for non-essential cookies, otherwise anonymised data.

We will not use your data for a new purpose without telling you and, where required, asking for fresh consent. Each time we ask for consent, we show a notice describing the data, the purpose, how to withdraw consent and how to complain to the Data Protection Board of India. You may withdraw consent as easily as you gave it, by writing to the contact in Section 9.

4. Cookies and tracking

Cookies are small files stored on your device. We use:

Non-essential cookies are set only after you accept them in our cookie banner. You can change or withdraw your choice at any time, or by clearing cookies in your browser. Blocking strictly necessary cookies may stop parts of the Services from working.

We do not track or profile children, and we do not show targeted advertising to anyone we know to be under 18. Our website does not currently respond to "Do Not Track" browser signals.

5. Sharing, processors and cross-border transfers

We do not sell your personal data. We share it only as follows:

• Data Processors acting on our instructions under written contracts: our payment gateway Razorpay, and the hosting, email and other technical service providers we use to run the Services. These providers handle your data only to deliver their service to us. On request, we will tell you which processors we have shared your data with.
• Public display: your chosen display name and score may appear on leaderboards and winner lists. We do not publish your email, phone number or address.
• Sponsors and partners: only with your separate consent, and only the data named in that consent.
• Authorities and courts: where required by law, court order or lawful government request, or to protect our rights, users or the public from fraud or harm.
• Business transfers: if we merge, sell or restructure, your data may pass to the successor, who must honour this policy.

Some of our processors may store or process data outside India. We transfer personal data abroad only to countries and entities not restricted by the Central Government under Section 16 of the DPDP Act, and we require equivalent safeguards by contract. Where sector laws require data to stay in India, we keep it in India.

6. Retention, security and breach handling

Retention. We keep personal data only as long as needed for the purpose it was collected, or as the law requires, then erase it or make it anonymous.

Security. We use reasonable safeguards, including encryption in transit (HTTPS/TLS), hashed passwords, role-based access control, access logging, regular backups and vendor security checks. No system is completely secure, and we cannot guarantee absolute security. Please protect your password and tell us if you suspect misuse of your account.

Breach handling. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Act and Rules, including a detailed report to the Board within 72 hours of becoming aware of it.

7. Children's data

Under the DPDP Act, a child is any person under 18. The Services are intended for users aged 18 and above. A person under 18 may take part only with verifiable consent from a parent or lawful guardian, before creating an account or processing the child's data.

For users under 18, we do not carry out tracking, behavioural monitoring or targeted advertising, and we do not process data in any way that is likely to harm the child's well-being. If we learn that we hold a child's data without valid parental consent, we will delete it. Parents and guardians can write to the contact in Section 9 to review, correct or erase their child's data, or to withdraw consent.

8. Your rights and grievance redressal

As a Data Principal, you have the right to:

• Access: get a summary of your personal data we process, the processing activities, and the identities of the processors and other Data Fiduciaries we have shared it with.
• Correction and completion: correct inaccurate or misleading data and complete incomplete data.
• Erasure: ask us to erase your data when it is no longer needed for its purpose, unless the law requires us to keep it.
• Withdraw consent: at any time, as easily as you gave it. Withdrawal does not affect processing done before it.
• Grievance redressal: raise a complaint with us about our handling of your data or your rights.
• Nominate: name another person to exercise your rights if you die or become incapacitated.

To use any right, email support@theengineerowl.com with the subject "Data Rights Request" and enough detail for us to verify your identity. We acknowledge requests within 48 hours and respond within 30 days at most, and in any case within the period prescribed by the DPDP Rules.

Grievance Officer: Utkarsh Dristant, Founder, support@theengineerowl.com, New Delhi, India. We will resolve grievances within the time prescribed under the DPDP Rules, and no later than 90 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India. Please use our grievance process first, as the law expects. You must also act in good faith: giving false information or filing frivolous complaints may attract penalties under the DPDP Act.

9. Third-party links, changes, governing law and contact

Third-party links. The Services may link to other websites, such as YouTube, social media or sponsor pages. We do not control them and are not responsible for their privacy practices. Please read their policies.

Automated processing. We do not make decisions that significantly affect you solely by automated means. Anti-cheating checks are reviewed by a person before any disqualification.

Changes to this policy. We may update this policy to reflect changes in law or our practices. We will post the new version here with a revised "Last updated" date, and notify you by email or a site notice for material changes. Where the law requires fresh consent, we will ask for it.

Governing law and jurisdiction. This policy is governed by the laws of India. Subject to any rights you have under the DPDP Act, courts at New Delhi, India have exclusive jurisdiction over disputes arising from it.

Contact. The Engineer Owl, New Delhi, India. Privacy contact: Utkarsh Dristant, support@theengineerowl.com. Website: https://theengineerowl.com/.