Privacy Policy

Effective date: 2 October 2026. This Privacy Policy supersedes and replaces in its entirety the privacy policy of Lensdump dated 25 June 2023 and every earlier version, which are withdrawn and cease to apply from the effective date.

This Policy constitutes the notice required under section 5 of the Digital Personal Data Protection Act, 2023, and describes, in a clear and plain manner, the personal data that Lensdump processes, the purposes and manner of such processing, the rights available to you and the means by which you may exercise them. It is to be read together with, and forms part of, the Terms of Service.

Contents

1. Scope and application
2. Definitions
3. The Data Fiduciary
4. Personal data we collect
5. Sources of personal data
6. Purposes of processing
7. Grounds of processing and consent
8. Information visible to others
9. Disclosure to Data Processors and third parties
10. Transfer of personal data outside India
11. Retention and erasure
12. Security safeguards and breach notification
13. Cookies and similar technologies
14. Marketing communications
15. Your rights as a Data Principal
16. Your duties as a Data Principal
17. Children
18. Aggregated and anonymised data
19. Corporate transactions
20. Third-party websites and services
21. Changes to this Policy
22. Grievance Officer and the Data Protection Board
23. Contact

# 1. Scope and application

1.1 This Policy applies to all personal data processed by Lensdump in connection with the website lensdump.com, its sub-domains and file domains (including l3n.co), and every product, feature and service offered through them (the "Service"), whether you are a registered Member or a visitor. It applies irrespective of the device or means by which you access the Service.

1.2 By accessing or using the Service, you acknowledge that you have read and understood this Policy. Where processing is based on your consent, that consent is sought separately, by a clear affirmative action, and may be withdrawn in accordance with clause 7.

# 2. Definitions

2.1 In this Policy, unless the context otherwise requires: (a) "Act" means the Digital Personal Data Protection Act, 2023 and the rules made thereunder; (b) "personal data" means any data about an individual who is identifiable by or in relation to such data; (c) "processing" means any wholly or partly automated operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, combination, indexing, sharing, disclosure, restriction, erasure or destruction; (d) "Data Principal", "you" and "your" mean the individual to whom the personal data relates; (e) "Data Fiduciary", "Lensdump", "we", "us" and "our" mean Lensdump Private Limited; (f) "Data Processor" means any person who processes personal data on behalf of Lensdump; and (g) other capitalised terms have the meanings given to them in the Terms of Service or the Act.

# 3. The Data Fiduciary

3.1 The Data Fiduciary responsible for your personal data is Lensdump Private Limited, a company incorporated under the Companies Act, 2013 (CIN U63120BR2026PTC083813), having its registered office at Road Number 9, Rajeev Nagar, Keshri Nagar, Patna, Bihar 800024, India. Lensdump determines the purposes and means of the processing described in this Policy.

# 4. Personal data we collect

4.1 Lensdump collects only such personal data as is necessary for the purposes described in clause 6. Depending on how you use the Service, this may comprise the following categories:

  • Account and identity data: username, email address, name, and password, which is stored only in the form of a one-way cryptographic hash and is never stored or retrievable in readable form; together with any profile picture, cover image, biography and website that you choose to provide.
  • User Content and associated data: the images, videos and other files that you upload, their titles and descriptions, albums, tags, likes and follows. Where you elect to retain EXIF data, your files retain embedded metadata, which may include camera particulars and the geographical location at which a photograph was taken.
  • Billing and transaction data: the name, state and country to be shown on invoices; where provided, your postal address and the GSTIN and legal name of your business; and, as received from our Payment Processor, the amount, currency, date, status and reference numbers of each payment and the means of payment (the card network and the last four digits of a card, or the UPI identifier). Lensdump does not receive or store complete card numbers or card security codes.
  • Technical and usage data: Internet Protocol (IP) addresses, recorded when you register an Account, sign in, upload a file, create an album, submit a message or record an email consent; the browser and operating system indicated by your browser's user agent; the country from which you connect, as determined by our network provider; information about signed-in sessions and devices; and diagnostic and security logs.
  • Communications data: the content of messages you submit through the contact page or by email, together with the IP address, browser and page from which a message was sent.
  • Consent and preference data: your settings and email preferences, and, for each email list, a record of your consent, comprising the wording to which you agreed, the date and time and the IP address from which consent was given or withdrawn.
  • Email interaction data: whether links contained in newsletters and offers sent by Lensdump are clicked. Lensdump does not use tracking pixels or similar means to determine whether an email has been opened.
  • Connected account data: where you sign in with or connect a Discord, Google or Facebook account, the identifier and display name made available by that service, including, in the case of Discord, your Discord user identifier.

4.2 Lensdump does not intentionally collect sensitive personal data, such as data concerning health, religion or sexual orientation, other than as may be contained in User Content that you choose to upload, for which you are responsible under the Terms of Service.

# 5. Sources of personal data

5.1 Personal data is obtained (a) directly from you, when you register, complete your profile, upload User Content, make a purchase, change your settings or contact us; (b) automatically, through your use of the Service, by means of server logs, cookies and similar technologies; and (c) from third parties, namely our Payment Processor in respect of transactions, and the sign-in services you choose to connect.

# 6. Purposes of processing

6.1 Lensdump processes personal data for the following specified purposes:

  • to create and administer Accounts, authenticate Members, and provide, operate and maintain the Service, including the storage, display and sharing of User Content in accordance with your privacy settings and the enforcement of Plan limits;
  • to process payments, administer Memberships, renewals, upgrades, offers and refunds, and to issue tax invoices and credit notes;
  • to comply with obligations under the Goods and Services Tax laws, the Income-tax Act, the Companies Act, 2013 and other Applicable Law, including the maintenance of books of account and the filing of returns;
  • to secure the Service and its Users, to detect, investigate and prevent fraud, abuse, unauthorised access and breaches of the Terms of Service (including by comparing the origin of a payment with its currency), and to provide sign-in alerts and a list of signed-in devices;
  • to review, moderate and act upon User Content and complaints, and to respond to the Grievance Officer's complaints process;
  • to send account, billing, security and legal communications, which are integral to the Service;
  • with your consent, to send newsletters, offers and product updates;
  • with your consent, to measure and analyse the use of the Service through analytics, in order to maintain and improve it;
  • to determine the currency in which prices are offered to you;
  • to respond to lawful requests and orders of courts, law enforcement agencies and other competent authorities, and to establish, exercise or defend legal claims.

6.2 Lensdump shall not process personal data for any purpose incompatible with the purposes stated above without informing you and, where required, obtaining your consent.

# 7. Grounds of processing and consent

7.1 Lensdump processes personal data (a) on the basis of your consent, given by a clear affirmative action, in respect of marketing communications and analytics; and (b) for the legitimate uses recognised under section 7 of the Act, including where you have voluntarily provided personal data for a specified purpose, for the performance of any function under any law, and for compliance with any judgment, order or legal obligation.

7.2 You may withdraw any consent at any time, with the same ease with which it was given, including through the email preferences in your Account settings or the unsubscribe link in each marketing email. Withdrawal shall not affect the lawfulness of processing carried out before it, and Lensdump shall, within a reasonable time, cease and cause its Data Processors to cease processing the relevant personal data, save where processing is otherwise permitted or required by law.

# 8. Information visible to others

8.1 Your public profile, your public albums and the files within them, and your username, name, profile picture and biography may be viewed by any person. The visibility of each album and its files is determined by the privacy setting you select. Where you elect a private profile, your profile page and your name on your files are hidden from others, but the visibility of files continues to be governed by the privacy setting of each album.

8.2 Your email address, billing data, IP addresses and payment details are not displayed to other Users. Information that you make public may be viewed, copied and redistributed by others beyond the control of Lensdump.

# 9. Disclosure to Data Processors and third parties

9.1 Lensdump does not sell personal data, and does not share it with advertisers. Lensdump discloses personal data only to the following categories of recipients, to the extent necessary for the stated purpose and, in the case of Data Processors, under contracts or terms that require them to process it only on Lensdump's instructions or for the provision of their services:

  • Razorpay, as Payment Processor, for the processing of payments by card, UPI and e-mandate;
  • Cloudflare, for the delivery of the Service and its protection against attacks, through whose network your traffic passes;
  • Scaleway, for the delivery of account and security emails, and Mailtrap, for the delivery of newsletters and offers to persons who have consented to receive them;
  • Google, for analytics through Google Analytics, and for sign-in where you elect to sign in with Google;
  • Discord and Facebook, for sign-in where you elect to use them, and, in the case of Discord, for the assignment of your role on the Lensdump Discord server;
  • Lensdump's chartered accountants and professional advisers, for the purposes of tax compliance, audit and legal advice, under duties of confidentiality;
  • courts, law enforcement agencies, regulators and other competent authorities, where disclosure is required by law or legal process, or is necessary to protect the life, safety or rights of any person.

# 10. Transfer of personal data outside India

10.1 Certain Data Processors process personal data outside India. Any such transfer is made in accordance with section 16 of the Act and shall not be made to any country or territory to which transfer has been restricted by the Central Government by notification. Lensdump requires that personal data so transferred continue to be protected in a manner consistent with this Policy.

# 11. Retention and erasure

11.1 Lensdump retains personal data only for as long as is necessary for the purposes for which it was collected, or as required by law, and in particular:

  • Account data and User Content, for as long as the Account exists, and thereafter in backups for a limited period, after which it is deleted in the ordinary course;
  • invoices, credit notes, payment and billing records, for the period prescribed by the tax and company laws of India (presently not less than eight years from the end of the relevant financial year in respect of books of account), notwithstanding the deletion of the Account;
  • consent records, for as long as the consent applies and for such further period as may be required to demonstrate that consent was obtained;
  • the User Content of an Account that has been banned, for thirty (30) days from the ban, after which it may be permanently deleted;
  • logs and security records, for such period as is necessary for the security and operation of the Service, or for such longer period as Applicable Law may require.

11.2 Upon the expiry of the applicable period, or upon the withdrawal of consent or a valid request for erasure (where retention is not otherwise required by law), Lensdump shall erase the personal data and cause its Data Processors to do so, within a reasonable time.

# 12. Security safeguards and breach notification

12.1 Lensdump implements reasonable security safeguards, as required by section 8(5) of the Act, to protect personal data against breach, including encryption of data in transit, storage of passwords only as one-way hashes, access to files in private or password-protected albums only through links signed for authorised persons, restriction of internal access to those who require it, and the optional use of two-factor authentication and remote sign-out by Members.

12.2 No method of transmission or storage is completely secure, and Lensdump cannot guarantee absolute security. In the event of a personal data breach, Lensdump shall intimate the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under the Act.

# 13. Cookies and similar technologies

13.1 Lensdump and its service providers use cookies and similar technologies, which fall into the following categories:

  • Strictly necessary: a session cookie, a sign-in cookie that keeps you signed in for up to thirty (30) days, and the security cookies of our network provider. These are required for the Service to function and cannot be disabled through the Service.
  • Preference: cookies that remember your choices, such as the Grid or Stream view of an album during your visit.
  • Analytics: cookies set by Google Analytics to measure the use of the Service.

13.2 You may block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent you from remaining signed in and may impair the functioning of the Service.

# 14. Marketing communications

14.1 Lensdump sends newsletters, offers and product updates only to Members who have consented to receive them, through an unticked option or their email preferences. Each such communication contains a means of unsubscribing. Account, billing, security and legal communications are not marketing communications and are sent to every Member as part of the Service.

# 15. Your rights as a Data Principal

15.1 Subject to the Act, you have the following rights in respect of your personal data:

  • Right to access information (section 11): to obtain a summary of the personal data being processed and the processing activities undertaken, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared, together with a description of the data shared;
  • Right to correction and erasure (section 12): to the correction, completion and updating of inaccurate or incomplete personal data, much of which you may effect yourself through your Account settings, and to the erasure of personal data that is no longer necessary for the purpose for which it was processed, unless retention is necessary for compliance with law; a request for erasure of your Account may be made as set out in clause 15.2;
  • Right of grievance redressal (section 13): to have readily available means of grievance redressal through the Grievance Officer named in clause 22;
  • Right to nominate (section 14): to nominate any other individual to exercise your rights in the event of your death or incapacity;
  • Right to withdraw consent (section 6), as described in clause 7.2.

15.2 Requests to exercise these rights may be submitted to the Grievance Officer from the email address registered on your Account, or through the contact page while signed in. Lensdump may take reasonable steps to verify your identity before acting on a request, and shall respond within the period prescribed under the Act. Members may additionally download their albums or selected files as an archive at any time while signed in. Persons residing in other jurisdictions may have further rights under their local law, which Lensdump shall honour to the extent applicable.

# 16. Your duties as a Data Principal

16.1 In accordance with section 15 of the Act, you shall comply with Applicable Law in exercising your rights; shall not impersonate another person while providing personal data; shall not suppress any material information while providing personal data for any document or proof issued by the State; shall not register a false or frivolous grievance or complaint; and shall furnish only verifiably authentic information when exercising the right to correction or erasure.

# 17. Children

17.1 The Service is intended solely for persons who have attained the age of 18 years, and every person registering an Account is required to confirm that they have attained that age. Lensdump does not knowingly process the personal data of children, does not undertake tracking, behavioural monitoring or targeted advertising directed at children, and shall, upon becoming aware that an Account belongs to a child, close that Account and erase the associated personal data, save as required by law.

# 18. Aggregated and anonymised data

18.1 Lensdump may create and use aggregated or anonymised information, which does not identify any individual, for statistical, operational and business purposes. Such information is not personal data and is not subject to this Policy.

# 19. Corporate transactions

19.1 In the event of a merger, amalgamation, acquisition, reorganisation or sale of all or part of the business or assets of Lensdump, personal data may be transferred to the successor entity, which shall be bound to process it in accordance with this Policy and the Act. Any such transfer shall be undertaken in accordance with section 17 of the Act.

# 20. Third-party websites and services

20.1 The Service may contain links to, or integrations with, third-party websites and services that are not operated by Lensdump. Their processing of personal data is governed by their own privacy policies, and Lensdump is not responsible for their practices.

# 21. Changes to this Policy

21.1 Lensdump may amend this Policy from time to time, including to reflect changes in the Service, its processing activities or Applicable Law. Amendments take effect on publication on the Service, or on any later date stated in them, and the effective date at the top of this Policy shall be updated. Where an amendment materially affects the manner in which your personal data is processed, Lensdump shall give notice of it on the Service or by email before it takes effect and, where the Act so requires, seek your consent afresh.

# 22. Grievance Officer and the Data Protection Board

22.1 Lensdump has designated the following person to respond to communications and grievances of Data Principals under the Act and the Information Technology Act, 2000:

Swadesh Shanker Parasher, Director, Lensdump Private Limited
Email: grievance@lensdump.com
Address: Road Number 9, Rajeev Nagar, Keshri Nagar, Patna, Bihar 800024, India

22.2 The Grievance Officer shall acknowledge a grievance within twenty-four (24) hours and resolve it within fifteen (15) days of receipt, or such other period as may be prescribed. Under section 13(3) of the Act, you must exhaust this grievance redressal mechanism before approaching the Data Protection Board of India, to which you may thereafter make a complaint in the manner prescribed.

# 23. Contact

23.1 Questions concerning this Policy may be addressed to the Grievance Officer at grievance@lensdump.com, through the contact page, or by post to Lensdump Private Limited, Road Number 9, Rajeev Nagar, Keshri Nagar, Patna, Bihar 800024, India.