01 Introduction and Data Controller

This Privacy Policy governs the collection, use, storage, disclosure, and protection of personal data by The Good City (‘the Portal’, ‘we’, ‘us’, ‘our’), a media portal registered and operated in India. The Portal publishes content across lifestyle, culture, wellness, and related areas of general interest, and does not engage in the publication of news or current affairs.

The Portal is not subject to the Digital Media Ethics Code under Part III of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (‘IT Rules, 2021’), which governs online news publishers and current affairs content. Accordingly, those provisions do not apply to this platform or to content contributed hereunder.

We are committed to protecting your privacy in accordance with the Information Technology Act, 2000 (‘IT Act’), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (‘SPDI Rules’), and the Digital Personal Data Protection Act, 2023 (‘DPDPA’), to the extent applicable and notified.

The Portal is owned, registered, and operated by Raintree Media Private Limited (‘the Company’), CIN U51396KA2004PTC033191, incorporated under the Companies Act, 2013, with its registered office at Rainmakers Workspace, Office 213, 2nd Floor, #18, Ramanashree Arcade, MG Road, Bengaluru – 560 001.

02 Information We Collect

The Portal operates on a two-tier basis:

Unregistered visitors may browse and read all content freely. We collect only anonymised usage and analytics data (device type, browser, pages visited, referral source, approximate location). No personally identifiable information is collected from unregistered visitors.

Registered users and subscribers provide personal data voluntarily at the point of registration or subscription. We may collect the following categories of personal data:

• Identity data: name, username, date of birth
• Contact data: e-mail address, telephone number, postal address
• Account data: login credentials, subscription preferences, saved content
• Usage data: pages visited, content read, time spent, referring URLs, device type, browser type, IP address
• Communications data: messages sent to us via contact forms, comments, or e-mail
• Payment data: billing name and address, transaction reference numbers (we do not store full card details; payments are processed by PCI-DSS-compliant third-party processors)
• Preference data: newsletter preferences, notification settings, content interests

We do not knowingly collect sensitive personal data or information (‘SPDI’) as defined under the SPDI Rules unless strictly necessary and with your explicit consent. Should we ever need to collect SPDI (for example, health data in connection with a special feature), we will obtain explicit, separate consent and display a dedicated SPDI consent notice.

03 How We Collect Information

We collect information in the following ways:

• Directly from you when you register, subscribe, comment, or contact us
• Automatically through cookies, web beacons, and analytics tools when you use the Portal
• From third-party login providers (for example, Google or Facebook) if you choose to use social sign-in
• From third-party analytics and advertising partners, subject to their own privacy policies

04 Purpose and Legal Basis for Processing

We process your personal data for the following purposes:

• To create and manage your account and provide access to content
• To process payments and manage subscriptions
• To send newsletters, content updates, and promotional communications (with your consent)
• To personalise your experience on the Portal
• To analyse usage and improve our content and services
• To comply with applicable legal obligations
• To detect and prevent fraud, abuse, or unlawful activity

Under the DPDPA, processing is based on your consent or on legitimate uses as prescribed. You may withdraw consent at any time, subject to legal or contractual limitations.

Consent is obtained via active opt-in (for example, an unchecked checkbox at registration). Pre-ticked boxes or implied consent are not used. You may withdraw consent at any time via the ‘Unsubscribe’ link in any e-mail we send, or by contacting our Grievance Officer. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

05 Cookies and Tracking Technologies

The Portal uses cookies and similar tracking technologies to enhance user experience, remember preferences, and gather analytics data. Cookies used include:

• Strictly necessary cookies: essential for the Portal to function correctly
• Analytics cookies: to understand how visitors interact with the Portal
• Preference cookies: to remember your settings and personalisation choices
• Marketing cookies: to deliver relevant advertising, where applicable

A cookie consent banner is displayed on your first visit, allowing you to accept or reject non-essential cookies before they are set. You may manage cookie preferences through your browser settings or our cookie consent tool at any time. Disabling certain cookies may affect the functionality of the Portal.

06 Sharing and Disclosure of Personal Data

We do not sell your personal data. We may share data in the following circumstances:

• Service providers: hosting, payment processing, e-mail delivery, and analytics providers — all bound by data processing agreements
• Content partners: in anonymised or aggregated form only, unless you have consented otherwise
• Regulatory and law enforcement authorities: where required by applicable Indian law, court order, or government direction
• Successors in business: in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections

Any cross-border transfer of personal data will comply with DPDPA requirements once notified. Until such time, we restrict transfers to countries deemed adequate or use standard contractual clauses with data processors. Users may request details of any data transfers by contacting our Grievance Officer.

07 Data Retention

We retain personal data only for as long as is necessary for the purpose for which it was collected:

• Account data: retained while the account is active, and for two years following the last login (unless a legal obligation requires a longer period)
• Payment data: deleted immediately after the transaction is completed; only transaction reference numbers are retained for five years for tax compliance purposes
• Newsletter data: retained until you unsubscribe, or for three years following a period of inactivity, whichever is earlier
• Anonymised analytics data: retained indefinitely, as it cannot be linked to individual users

Data is securely deleted or anonymised once the applicable retention period expires.

08 Your Rights as a Data Principal

Under the DPDPA and SPDI Rules, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Withdraw consent to processing at any time
• Nominate another individual to exercise your rights in the event of your death or incapacity
• Seek grievance redressal through our designated Grievance Officer (see Section 13 below)

To exercise any of these rights, please contact our Grievance Officer. We will respond within the timeframe prescribed under applicable law.

09 Children’s Privacy

The Portal is not intended for users under the age of 18. We do not knowingly collect personal data from individuals under 18.

• All registration forms include an age declaration. Users under 18 are blocked from creating accounts.
• We do not seek parental consent for users under 18, as such users are not permitted to register. If we discover that data of a minor was collected without our knowledge, we will immediately delete it and suspend the relevant account.
• Unregistered visitors who are minors may browse anonymously; only anonymised analytics data is collected.

Parents or guardians who believe their child has provided personal data to the Portal should contact our Grievance Officer immediately.

10 Security

We implement reasonable security practices and procedures as required under the SPDI Rules, including encryption of sensitive data in transit, access controls, and periodic security reviews. However, no method of transmission over the internet is entirely secure and we cannot guarantee the absolute security of your data.

11 Third-Party Links

The Portal may contain links to third-party websites, including those of our content partners. This Privacy Policy does not apply to such external sites. We encourage you to review the privacy policies of any third-party websites you visit.

12 Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify registered users by e-mail or via a prominent notice on the Portal at least seven days in advance of the change taking effect. Continued use of the Portal after the notice period constitutes acceptance of the updated policy.

13 Grievance Officer

Our Grievance Officer is based in India and available during Indian business hours. In the event of an unresolved grievance, users may escalate the matter to the Data Protection Board of India once it has been established under the DPDPA.