Privacy Policy

At Bhagya Lakshmi ("Platform", "we", "our"), protecting the confidentiality, security, and integrity of your personal information is foundational to our mission of total transparency.

This Privacy Policy outlines how we collect, process, store, and safeguard your personal information when you use our web application, purchase entry packages (₹2,100 Classic Plan and ₹3,100 Premier Plan), participate in milestone draws, or use our Refer & Earn system. We strictly comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

We collect only the following specified categories of information:

• Identity & Contact Information: Full name, active Indian mobile telephone number (for SMS OTP login and ticket receipt dispatch), email address, and residential city/state.
• KYC & Statutory Compliance Data (Winners Only): Permanent Account Number (PAN) and government identity verification (Aadhaar/Passport/Voter ID) collected exclusively for high-tier prize claimers to satisfy Section 194B Income Tax TDS reporting requirements.
• Financial Payout Information: Verified Indian Bank Account details (Account Number, IFSC Code) or Virtual Payment Address (UPI ID) submitted voluntarily by users to withdraw affiliate referral commissions or prize settlements.
• Technical & Security Telemetry: IP address, device type, browser user-agent, and transaction timestamps utilized solely for anti-fraud monitoring, velocity checking, and preventing automated bot entries.

Your information is processed exclusively for the following lawful purposes:

• Generating unique, tamper-proof cryptographic Entry Certificates and verifiable SHA-256 ticket identifiers.
• Sending instant booking confirmation receipts and draw status notifications via SMS and WhatsApp.
• Broadcasting real-time draw announcements when entry milestones (750 for ₹2,100 plan or 550 for ₹3,100 plan) are achieved.
• Validating and executing direct bank account/UPI payouts for referral commissions with zero platform deductions.
• Fulfilling vehicle delivery and RTO registration for winners in coordination with authorized brand dealerships.
• Complying with statutory duties, including depositing 30% TDS under Section 194B and generating Form 16A certificates.

Our platform reconciles two essential requirements: Complete Public Auditability and Total Participant Privacy:

No third party, competitor, or observer can reverse-engineer or harvest participant contact details from the public transparency tables. Only the authenticated ticket owner and our compliance officers have visibility of the full certificate credentials.

All financial transactions are conducted under bank-grade security protocols:

• PCI-DSS Certified Payment Switches: Payments are processed directly through Reserve Bank of India (RBI) authorized payment aggregators (e.g., Razorpay, Cashfree, PayU).
• Zero Card/UPI Storage: The Platform never stores complete credit/debit card numbers, CVVs, expiry dates, or NetBanking passwords on any server or database.
• 256-bit SSL/TLS Encryption: All data transmissions between your browser and our servers are encrypted with modern TLS 1.3 standards.

We maintain an absolute Zero-Sale Policy: We do not sell, rent, lease, or monetize your personal data to advertisers, telemarketers, or commercial brokers.

Data is shared solely with the following essential entities under strict Non-Disclosure Agreements (NDAs):

• Authorized Payment Gateways: For processing entry bookings and referral payouts.
• Cloud Infrastructure Providers: ISO 27001 certified data center providers maintaining encrypted servers located within Indian territory.
• Automotive Dealerships & RTO Logistics: Winner contact and address data is shared solely with authorized dealerships (e.g., Toyota, Audi, Mahindra) for vehicle registration and delivery handover.
• Statutory Authorities: Income Tax Department of India for Section 194B TDS remittance and compliance filings.

In compliance with the Digital Personal Data Protection Act, 2023, all primary databases containing user records, ticket allocations, and audit logs are physically and logically hosted within tier-4 data centers located inside the Republic of India (Mumbai/Hyderabad zones).

Data is encrypted both in transit (TLS 1.3) and at rest (AES-256). Periodic automated off-site backups are maintained in cold storage with strict multi-factor authentication (MFA) access controls.

As a data principal under Indian law, you are entitled to the following rights:

• Right of Access & Summary: You may request an itemized summary of the personal data held about you and processing activities undertaken.
• Right to Correction & Updation: You have the right to request correction of inaccurate or incomplete personal contact details in your profile.
• Right to Erasure (Subject to Tax Law): You may request deletion of your account. However, transaction records, entry hashes, and Form 16A TDS filings must be retained for the minimum statutory period (7 years) required by Indian tax statutes.
• Right to Nominate: In the event of death or incapacity, you have the right to nominate an individual to exercise data rights on your behalf.

Our platform utilizes strictly functional and performance-related storage mechanisms:

• Session & Language Preference: Storing your selected language (English, Gujarati, Hindi) in localStorage to ensure a seamless interface on subsequent visits.
• Permanent Dark Mode Lock: Storing the permanent dark mode theme preference (bld-theme: dark).
• Authentication Tokens: Secure HTTP-only session tokens to maintain your verified login state across pages.
• No Invasive Ad Trackers: We do not deploy cross-site behavioral tracking cookies, Facebook Pixel, or invasive retargeting scripts.

If you have any questions, concerns, complaints, or wish to exercise your data rights under the DPDP Act 2023, please reach out to our designated Data Protection Officer: