Privacy

Gyan Museum operates this website. This notice explains what personal data it collects, the purpose it is collected for, how long it is kept, and what you can ask us to do with it.

India's Digital Personal Data Protection Act, 2023 is in force. Under it the museum is a data fiduciary — the party that decides why and how your data is processed — and you are a data principal. The Act requires that data be collected for a stated lawful purpose, that only what is necessary be collected, that it not be kept longer than the purpose requires, and that you be able to access, correct and erase it. This notice is written to those requirements.

The booking form

This is the only place on the site where the museum asks for personal data as a matter of course. The museum is open by prior appointment only, so a booking request is a conversation, not a transaction.

What is collected, and why.

| Field | Required | Why it is asked for | | --- | --- | --- | | Name | Yes | To greet you, and to identify your appointment | | Email address | Yes | To send the confirmation, and to reach you if the date has to change | | Date and time slot | Yes | To hold the appointment | | Number of visitors | Yes | To know how many people to expect, and whether a second guide is needed | | Telephone number | No | To reach you on the day if something changes | | City and country | No | To know how far you are travelling, which affects how firmly we hold a slot | | Occupation | No | To pitch the tour; a jeweller and a schoolchild are shown different things | | Preferred language | No | To assign a guide who can speak it | | Accessibility requirements | No | To make arrangements before you arrive | | How you heard about the museum | No | To understand which of our efforts reach people | | Notes or questions | No | Whatever you want to tell us | | WhatsApp opt-in | No | Only if you tick it, and only for messages about your visit |

The form also stores the language you were reading the site in, a hashed form of your IP address, and your browser's user-agent string. The hash cannot be reversed to your address; both exist only to detect automated abuse of the form.

Who sees it. The museum's staff. Your booking is also processed by our transactional email provider in order to deliver the confirmation, and by our database host, which is where the record is stored. The form is protected by Cloudflare Turnstile, which checks that a submission is not automated.

How long it is kept. A booking record is kept for 24 months after the visit date, so that a returning visitor can be recognised and so the museum can answer a question about a past visit. After that it is deleted. If you ask us to delete it sooner, we will.

What we never do with it. We do not sell it. We do not pass it to the family's jewellery businesses. We do not add you to a mailing list because you booked a visit — the newsletter is a separate, explicit sign-up.

Enquiries

Research, press, group and image-rights enquiries are stored in the same way and for the same period, with whatever you chose to tell us in the message.

The newsletter

If you subscribe, we store your email address and the language you subscribed in. Every message carries an unsubscribe link, and unsubscribing deletes the record. Nothing else is inferred from it.

Analytics and cookies

The site uses Plausible Analytics, which is cookieless: it stores nothing on your device and does not build a profile of you across sites. It records the page, the country, the referrer and the device type, in aggregate. Because it sets no identifier, it runs without consent.

Anything beyond that — an embedded map, the museum's film on YouTube — loads only when you ask for it. Until you press the button, no request is made to Google or to YouTube and nothing of yours reaches them. If you do press it, that service's own privacy terms then apply to the connection you have opened.

The site stores a small number of preferences in your browser's own storage: the language you chose, whether you asked for reduced motion, whether you dismissed the appointment notice, and your answer to the consent bar. These never leave your device and are not personal data to us.

Your rights

Under the DPDP Act you may ask the museum to tell you what data it holds about you, to correct it, to complete it, or to erase it, and you may withdraw a consent you have given. You may also nominate someone to exercise these rights on your behalf if you are unable to.

To exercise any of them, write to info@gyanmuseum.com, or to the museum at G-1/21-23, Gems and Jewellery Zone, EPIP, Sitapura Industrial Area, Jaipur, Rajasthan 302022, India. Say what you are asking for; the museum will ask you to confirm your identity before it acts on a request about someone's data, which is the point of asking. If you are not satisfied with the museum's response, the Act gives you the right to complain to the Data Protection Board of India.

Children

The museum does not knowingly collect data from anyone under eighteen. A visit by a school or a family group is booked by an adult, and the booking record carries that adult's details and a number of visitors, not the children's names.

Changes

The date at the top of this page is the date it was last changed. Material changes will be described here rather than made silently.