Privacy Policy

Who is holding this

Mundial Image Consulting, an image consulting and corporate training practice run by Bandita Patro from Office 201, Acme Plaza No. 2, on Andheri Kurla Road in Mumbai. Under the Digital Personal Data Protection Act, 2023 we are a Data Fiduciary. That is the legal word for the party that decides what happens to your data, and it means the responsibility sits with us rather than with any tool we use.

There is no privacy department. Bandita reads the privacy email herself and one person supports her on the operations side. We are below the threshold at which the law requires a Data Protection Officer, so we have not appointed one, and we would rather say that plainly than borrow a title we have not earned.

What we collect, and where it comes from

Every row below is a real point of contact on the site or in the practice. If a surface is not on this list, it is not collecting anything.

What we do not ask for

No date of birth. No identity document. No salary figure, no bank statement, no medical history. A wardrobe consultation does not need any of it, and holding data you have no use for is how small practices end up with a problem they cannot manage.

Card numbers never touch us either. Payments run through the gateway or straight to the bank, and what comes back to us is a name, an amount and a reference.

Why we hold each thing

Indian law asks us to name a lawful basis for every use. In almost every case here it is your consent, given when you filled the thing in. The exceptions are the ones the law calls legitimate uses, and they are listed as such.

Withdrawing consent is as quick as giving it, and it stops the future use rather than unpicking the past. If we have already sent you the Blueprint, we cannot un-send it. Everything after the withdrawal stops.

Cookies and measurement

Two categories run on this site. The first keeps it working: a session cookie so a form remembers what you typed, and a preference cookie so the consent banner stops asking. Those cannot be switched off without breaking the page.

The second is Google Analytics 4, and it is the only measurement tool here. It tells us which pages get read, where people leave, and whether the two doors on the homepage are being clicked. It is set to record a handful of named events, and there is no reason to be coy about what they are called.

Who else can see it

We do not sell data and we do not trade it. A short list of companies process it on our instructions because we run the practice on their software, and each of them is bound to use it only for the job we gave them.

Two of those hold data outside India. The DPDP Act permits transfers of this kind except to countries the Central Government has specifically restricted, and nothing on that list applies to us today. For readers in the UK or EU, the transfer runs on the standard contractual clauses those vendors publish.

Beyond that list, your data leaves only in two situations. A court, a tax authority or the police asks for it under a power they actually hold. Or the practice is sold or merged, in which case you would be told before anything moved, not after.

When your employer is paying

This is the part most people in a corporate cohort want to know and almost nobody asks out loud. Your company commissioned the programme. It does not follow that your company gets to read your file.

Where a group is small enough that an aggregate would identify one person, we say so and give the number rather than the breakdown. Six people in a cohort is not enough for a departmental split, and pretending otherwise would hand your employer an individual score dressed as a statistic.

Photographs and the studio

A colour drape produces photographs. So does a wardrobe evaluation, a body-line analysis and most of what happens in a three-hour session. Those images are working documents. They go into your file, they go into the lookbook that reaches you a week later, and they stop there.

Nothing gets posted, printed or put in a deck without a signed release naming the specific use. That release is a separate piece of paper from your booking, it is written in plain language, and declining it changes nothing about the session you receive.

How long we keep it

Data with no purpose left is a liability, not an asset. These are the clocks we actually run.

Your rights, and how to use them

The DPDP Act gives you four, and they cost nothing to exercise.

If the UK or EU regime applies to you, you also have portability, the right to object to processing based on legitimate interests, and the right to complain to your own supervisory authority instead of ours.

Anyone under eighteen

The site is built for working adults and we do not knowingly take data from anyone under eighteen through it. If a finishing school programme includes a younger participant, we take a parent's or guardian's written consent before anything starts, the parent receives the report, and no behavioural tracking or advertising is applied to that participant at all.

If you are a parent and you think we hold something about your child that we should not, write to the address in section 14. It gets deleted, and you get told when it is done rather than being left to assume.

Security, and what we would do

The site runs over HTTPS. Two-factor authentication is on every account that holds client data. Two people have access to the client files and nobody shares a password. Client folders are backed up, and paper from a session goes into a locked drawer at Acme Plaza rather than a laptop bag.

If something did go wrong, the Act tells us what to do and we would do it. Every affected person gets told what happened, what of theirs was involved, and what to watch for. The Data Protection Board gets told as well. You would hear it from Bandita, in writing, and not from somebody else first.

Where Indian law stands right now

This is worth knowing, because a good deal of what you read on Indian privacy pages is a year or two behind.

The Digital Personal Data Protection Act was passed in 2023. Its Rules were notified on 13 November 2025, and they roll out in stages. The institutional parts took effect immediately. Consent manager registration follows twelve months later. The substantive obligations, meaning notice, consent, the duties of a Data Fiduciary and your rights as a Data Principal, commence on 12 May 2027.

So on the date at the top of this page, some of what is written above is not yet legally enforceable against us. We have written it as though it is. Waiting until May 2027 to start being clear about what we hold would be a strange way to run a practice built on how people are read.

Until those provisions commence, the operative law is the Information Technology Act, 2000 and the 2011 rules on sensitive personal data made under it. If you are in the UK or the EU, the UK GDPR or the EU GDPR applies to you and we honour those rights on request.

Changes to this page

The review date at the top is the whole mechanism. When a practice changes, this page changes and the date moves. Nothing is edited quietly.

If a change materially affects what we do with data we already hold, and we have an email address for you, you get an email. Not a banner you might miss, and not a line in a footer.

Contact and grievances

One person answers privacy mail here, and it is the same person whose name is on the practice.

If we do not fix it

Take it to the Data Protection Board of India, which is the statutory body set up under the Act to hear exactly this kind of complaint. You are expected to have raised it with us first, and thirty days is the window in which we are meant to have sorted it out. Readers in the UK or the EU can go to their own supervisory authority instead, and do not need our permission to do it.