Off The Wall Music

About this policy

This is Off The Wall Music's Privacy Policy. It explains what personal data we collect through this website, why we collect it, how long we keep it, and the rights you have under the Digital Personal Data Protection Act, 2023 and its Rules ("DPDP").

We're a music production studio, academy, and record label based in Kochi, India. This policy applies to offthewallmusic.in and any subdomains.

Who we are, in DPDP terms

Off The Wall Music is the data fiduciary for the personal data collected on this site. The Data Protection Officer (contact details at the bottom of this page) is your point of contact for anything privacy-related — questions, corrections, complaints, or requests to delete your data.

What we collect, and why

We only collect personal data when you actively give it to us by filling in one of our three forms:

Enrolment form (/enroll) — when you apply to a course. We ask for:

• Your full name, so we can address you properly
• Your email address, so we can respond
• Your phone number (optional), if you'd rather we call
• The course you're interested in
• An optional short message

Contact form (/contact) — when you write to us. We ask for:

• Your full name
• Your email address
• A subject line
• Your message

Studio enquiry form (/studio#enquire) — when you enquire about booking the studio for a session. We ask for:

• Your full name
• Your email address
• Your phone number (optional)
• The type of work (recording, mixing, mastering, etc.)
• An optional deadline
• Optional additional notes

At the point of submission we also record a timestamp, your IP address, and your browser's user-agent string. That's not for tracking — it's the record that you gave consent, which we need to keep under DPDP.

We do not use analytics, advertising trackers, or third-party cookies on this site.

Why we're allowed to collect it

We only collect the data above with your explicit consent. Every form has a checkbox you have to tick before submitting, and the description tells you exactly what we'll use the data for.

You can withdraw your consent at any time by writing to the Data Protection Officer listed below.

How long we keep it

Personal data submitted through the site is kept for up to one year from the date of submission, and then automatically deleted by a scheduled cleanup process. This aligns with the DPDP retention rules for a business of our size.

If your enrolment / enquiry / message becomes an active engagement (a booked session, an enrolled course, a signed artist relationship), the data related to that engagement may be kept longer as required to fulfil the purpose — but only for as long as the engagement is active or a legitimate business/regulatory reason applies.

Where your data is stored

Personal data from the forms is stored in a private database hosted by Turso in the AWS Mumbai region (ap-south-1), so your data stays within India. The database is not publicly accessible and requires an authentication token to read.

Marketing content on the site (courses, artists, images, etc.) is served through Sanity and Vercel, but no personal data touches those services.

Bot protection on the forms is provided by Cloudflare Turnstile, which briefly processes your challenge response to verify you're human. Cloudflare does not receive your form contents.

Who else touches your data

We use a small set of processors to run the site:

• Turso — stores form submissions (Mumbai region)
• Vercel — hosts the website
• Cloudflare — provides Turnstile bot protection on forms
• Sanity — hosts the site's marketing content (no personal data)
• GitHub — used only for the team login on the internal dashboard; not involved in any visitor data

Each of these is a data processor bound by its own privacy policy and, where applicable, a data-processing agreement with us.

Your rights under DPDP

You have the right to:

• Access the personal data we hold about you
• Correct anything that's inaccurate
• Erase your data
• Withdraw your consent at any time (which will trigger erasure of the linked record)
• Raise a grievance if you believe we've mishandled your data

To exercise any of these rights, email the Data Protection Officer listed at the bottom of this page. We'll respond within 90 days, and typically much sooner. If you're not satisfied with our response, you may escalate to the Data Protection Board of India.

Children (under 18)

Our courses are aimed at older students and adult learners. If a person under 18 wishes to enrol, we ask that a parent or guardian complete the enrolment on their behalf, and we treat the parent as the point of contact. We do not knowingly collect data from anyone under 18 without a parent's involvement.

Cross-border data transfers

Your personal data is stored within India. We do not currently transfer personal data outside of India for any purpose covered by this policy.

Cookies

The public site does not use cookies for analytics, advertising, or tracking. The internal team dashboard uses a session cookie strictly for staff authentication — it's not present when you're browsing the public site.

Changes to this policy

If we update this policy in a material way, we'll change the "Last updated" date at the top and, where practical, note the change on the site. We recommend checking back periodically.

Contact us

For any privacy question, correction, deletion request, or grievance, please email the Data Protection Officer whose details appear immediately below this policy.