Privacy Policy
Effective 4 October 2026 · Version 2026-10-04
This policy is intended to give effect to the Digital Personal Data Protection Act, 2023 and Rules, 2025, as their provisions become applicable. Other applicable privacy and consumer protections remain in place.
Morbin is a product of Grabit India. Business address: Office No 01-02, F. F. 3642-43, Maruti Market, Gali Lohe Wali, Chawri Bazar, Delhi - 110006, India. Privacy requests and grievances: submit a data request or parth@grabitindia.com. Privacy and grievance contact: Parth K, Founder at Grabit India.
1. Scope and responsibility
This policy covers Morbin's event registration, ticketing, organiser applications, accounts, payment administration and support. Morbin decides how information is used for platform accounts, security, billing and support. The event organiser decides which event information it needs and how it uses the booking details it receives. Where Morbin handles a list or event record on an organiser's instructions, it acts as that organiser's service provider. The organiser remains responsible for its own lawful collection and use.
2. Information and purposes
For applications we collect the organisation name and type, contact name, email, phone, city, event volumes, business description and optional GSTIN to assess and respond to the application. For organiser accounts we hold login email, name, password hash, membership and terms acceptance; organisation profiles and payout records may include address, tax details and bank account information. For bookings we collect names, email addresses, phone numbers when requested, ticket selections, event-specific answers and eligibility identifiers, consent records, payment references and check-in status. These support eligibility checks, ticket delivery, admission, event communications, refunds, payouts and accounting. Organisers may upload eligibility lists; they must have authority to do so. Avoid submitting Aadhaar, payment credentials or other information an event does not need.
3. Choices and consent
The application and checkout show their purposes before asking you to agree. Required information is identified in the form; without it we may be unable to review an application or complete a booking. A privacy notice is not permission for unrelated advertising. We use booking emails for sign-in, receipts and service updates, not unsolicited organiser marketing. Where applicable law permits processing without consent, such as statutory recordkeeping, we use that basis only for its permitted purpose. You can request withdrawal of consent through the data-request route below. We stop the relevant consent-based use, subject to legal retention and obligations already incurred; withdrawal does not automatically cancel a ticket or reverse a payment.
4. Recipients
Booking details are available to the relevant organiser and its authorised team for that event, not other organisers. Morbin personnel may access information when needed for support, security, financial administration or a data request. Infrastructure providers operate hosting and backups; Amazon SES delivers emails and Razorpay handles payment processing. If you choose Google sign-in, Google processes the authentication exchange under its own policy. These providers receive the information needed for their service; payment providers may have independent regulatory duties. Morbin does not sell personal data or provide attendee lists to unrelated advertisers. Disclosure may also be necessary to comply with a lawful order, investigate fraud or protect legal rights, subject to applicable law.
5. Hosting, cookies and security
The application and its database run on infrastructure managed for Morbin. Access is restricted to authorised operations and service providers. Providers may process information in their configured regions, subject to applicable transfer restrictions. Morbin uses essential cookies for sign-in and checkout, access controls, hashed passwords and one-time credentials; payout account numbers are encrypted by the application. Technical logs and rate-limit records support reliability and abuse prevention. Campaign parameters attached to a booking identify its referral source. No system can promise zero security risk. Organisers must restrict team access and protect downloaded records.
6. Retention
The checkout states the event's configured retention period. The current platform default is 24 months after the event; when that period ends, the scheduled retention process anonymises event attendee information and removes ticket PDFs. Abandoned checkouts are removed after 30 days and email content is cleared after 90 days. Financial documents and audit records currently have an eight-year platform retention setting, which is a platform policy rather than a claim that every record has the same statutory deadline. Records subject to a dispute, refund, investigation or legal retention duty may need longer retention. Accounts, applications, eligibility lists, waitlist entries and organiser exports require separate purpose-based review. You may request earlier erasure. Backup expiry follows the deployment's rotation policy; a deletion must be reapplied if an older backup is restored.
7. Requests and grievances
Use the data-request form to request a copy or summary of your information, correction, erasure, consent withdrawal or to raise a privacy grievance. We verify the request through your email and may need proportionate evidence of authority; do not send passwords or payment secrets. We aim to resolve verified requests and grievances within 90 days, or any shorter applicable legal deadline, and explain any lawful retention or refusal. You may ask how to nominate someone to exercise applicable rights on death or incapacity. For information an organiser holds separately, contact that organiser too. After using the grievance process, you may approach the Data Protection Board of India when the relevant statutory route is available. Statutory rights are not waived by this policy.
8. Children
Morbin's self-service applications, accounts and checkout are for people aged 18 or above. Do not submit a child's personal information through these forms or upload children's records into an eligibility list. Events requiring children's information need a separately approved process for lawful, verifiable parental consent and other applicable safeguards before using Morbin for that purpose. Morbin does not authorise behavioural monitoring or targeted advertising directed at children.
9. Incidents and changes
If a personal-data breach occurs, Morbin will investigate, contain it and make the notifications required by applicable law to affected individuals and the relevant authorities. Organisers must promptly report suspected misuse of their access or exported records. We publish material policy changes with a new version and request fresh consent where the changed purpose requires it. This policy does not grant permission to use previously collected information for an undisclosed purpose.