Privacy Policy

A meenakar's hand enamelling an engraved gold bangle

Privacy Policy

The Museum of Meenakari Heritage is devoted to the art of meenakari, enamelling on gold. We extend the same care to the personal information that visitors entrust to us. This page explains what we collect through momhindia.org and at the Museum, why we collect it, who we share it with, and the choices you have. We collect very little. We do not sell personal data, we do not create visitor accounts, and we do not use advertising cookies or pixels.

Who We Are

The Museum of Meenakari Heritage (the "Museum", "we", "us") is located at Shekhawat Haveli, E-141, Sardar Patel Marg, Durgadas Colony, C-Scheme, Ashok Nagar, Jaipur 302001, Rajasthan, India. The Museum belongs to The House of Sunita Shekhawat and is operated by Midas Signature Jewellery Private Limited, whose registered office is at E-141, Sardar Patel Marg, C-Scheme, Ashok Nagar, Jaipur 302001, India. Midas Signature Jewellery Private Limited is the data fiduciary for the personal data described in this Policy, and the controller for the purposes of the GDPR and UK GDPR.

This Policy covers the website momhindia.org, the forms on it, and the information we collect when you visit the Museum in person. It does not cover the websites we link to, such as Google Maps or our social media pages, which have their own privacy policies.

This Policy is published in accordance with the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011. It has been drafted with regard to the Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025, and will apply their provisions as and when they are brought into force. If you are in the European Economic Area or the United Kingdom, the EU General Data Protection Regulation or the UK GDPR may also apply. Where it does, the parts of this Policy that refer to those laws apply to you.

What We Collect and Why

We collect personal information only when you choose to give it to us through one of the forms on this website, and a small amount of technical information automatically when you browse. We do not ask for passwords, bank or card details, health information or biometric data, and we ask that you do not include such details in any free-text field.

When you book a visit : The Book Your Appointment form asks for your first name, last name, email address, telephone number, city, country, occupation, group size, how you heard about the Museum, and any queries or comments. We use your name and contact details to confirm your appointment and to reach you if we need to rearrange or cancel a visit. Your city and country help us prepare for your visit. Group size tells us how many people to expect; we do not record the details of the people accompanying you. Your queries let us answer any questions before you arrive. Your occupation and how you heard about the Museum help us understand who visits the Museum and how people find us.

When you ask about a commission : The Personal Consultation form, on the Personal Consultation page, asks for your first name, last name, email address, telephone or WhatsApp number, city and country. It also asks about the piece: what you would like to create, who it is for, your preferred timeline, your design idea, budget range, your preferred way to connect, and any additional notes. We use this information solely to understand your request and to reply to you through the channel you prefer. Consultation requests are handled by the atelier team of The House of Sunita Shekhawat, which is part of the same company as the Museum. The form shows a reference-image picker. Images are not currently uploaded or sent to us; if you select a file, only its file name reaches us.

How the two forms reach us : Both forms are delivered to us by email, to info@momhindia.org, through our transactional email provider. At the same time, a confirmation email is sent to you from no-reply@momhindia.org; it greets you by name, says which kind of enquiry was received, and does not repeat anything else you submitted. Submissions from these two forms are not stored in a database on this website. The Museum retains the email correspondence in its mailbox, for the period described under Data Retention. Our mailbox is hosted by Google LLC (Google Workspace), so your enquiry is held on Google's servers for as long as we keep the email. You choose whether to use either form. Every field on the Book Your Appointment form is required. On the Personal Consultation form, your first name, email address, telephone number, city, country, what you would like to create, who it is for and your timeline are required; the remaining fields are optional.

When you join the newsletter : When you enter your email address in the newsletter box on the home page or the Craft Your Jewellery page, we store your email address, a short label recording which sign-up box you used, and the date and time of sign-up in the website's content database. We use these details to send you the Museum newsletter and to keep a record of your subscription. We do not add you to the newsletter when you book a visit or request a consultation.

When you browse : Our hosting provider keeps standard server logs (your IP address, browser type, the pages requested and the time of the request) for a short period, for security and to keep the website running. We also use the analytics tools and cookies described under Cookies and Similar Technologies. We do not use automated decision-making that produces legal or similarly significant effects on you, and we do not profile visitors for marketing.

At the Museum

When you visit in person, we collect a small amount of information on the premises.

CCTV : The Museum's galleries, entrances and grounds are monitored by closed-circuit cameras for the safety of visitors, staff and the collection, and to prevent and investigate crime. Recordings are viewed only by authorised staff. They are kept for a limited period and then overwritten, unless a recording is needed for an investigation or is requested lawfully by the police or a court.

Visitor register : At reception we may record basic details of each visiting party, such as a name, a contact number and the time of your visit. We use the register to match arrivals to appointments, to know who is in the building for safety reasons, and for security. It is kept only for as long as it is needed for those purposes and for our appointment records, and is then destroyed.

Photography : We sometimes photograph visitors, for example during events or guided walkthroughs. We will ask before photographing you and tell you how the photograph may be used, for example for the Museum's records, its website or its social media. You may decline. You may also ask us at any time to stop using a photograph in which you appear, by writing to info@momhindia.org. Children are photographed only with the agreement of a parent or guardian.

Cookies and Similar Technologies

Cookies are small text files stored on your device when you visit a website. The following cookies and browser storage are set when you use this website, either by us or by the services named:

_ga : set by Google Analytics; distinguishes visitors for traffic statistics; lasts 2 years, as declared by Google.
_ga_GK6YKXRPJ8 : set by Google Analytics; keeps session state for traffic statistics; lasts 2 years, as declared by Google.
_GRECAPTCHA : set by Google reCAPTCHA on the google.com domain, on the Book Your Appointment page only; used for spam and abuse prevention; lasts up to about 6 months (Google does not publish a fixed lifetime).
payload-token : set by momhindia.org only when a member of Museum staff signs in to the content management system; never set for visitors; lasts about 2 hours.
Google Analytics : We use Google Analytics 4, a service of Google LLC (United States), to understand how visitors use the website. When a page loads, Google Analytics receives the address of the page, your browser and operating system versions, device type and model, screen resolution, language, and the referring page. It also receives your IP address, which Google uses only to work out an approximate, city-level location and does not store. The _ga cookies give your browser a pseudonymous identifier so that repeat visits can be counted. We do not use Google Analytics for advertising: the property is not linked to any advertising product, and Google signals, which would associate our analytics data with visitors' signed-in Google accounts, is switched off. You can read how Google uses this information at How Google uses information from sites or apps that use our services and in Google's Privacy Policy.
Cookieless statistics : We also use Vercel Web Analytics and Vercel Speed Insights, services of Vercel Inc. (United States), which set no cookies. Web Analytics records the page visited, the referring site, country, region and city, browser, operating system and device type, against a hashed identifier that resets every day and cannot be traced back to you or your IP address. Speed Insights measures page-loading performance and records the page, your country, browser, operating system, device type and connection speed, without personal identifiers.
Spam protection : The Book Your Appointment page uses Google reCAPTCHA to distinguish people from automated programs. reCAPTCHA collects device and browser information, your IP address and how you interact with the page, and sets the _GRECAPTCHA cookie on google.com. Google states that this information is used for improving reCAPTCHA and for general security purposes, and is not used by Google for personalised advertising. Google processes it under its own Privacy Policy. reCAPTCHA does not load on any other page of this website.
Fonts : Playfair Display and some styles of Cormorant are delivered by Google Fonts; all other fonts on this website are served from our own website. To deliver them, Google receives your IP address, the font requested, your browser details and the page you are on. Google Fonts sets no cookies, and Google states that it does not use this information to build profiles of visitors or for advertising.
Your choices : This website does not currently show a cookie banner, so the Google Analytics cookies are set when a page loads. You can control them in the following ways:
- Block or delete cookies in your browser settings. Most browsers let you refuse all cookies, refuse cookies from particular sites, and delete cookies already stored.
- Install Google's opt-out browser add-on, which stops Google Analytics from receiving information about your visits to any website.

Blocking cookies does not affect your ability to read this website. We do not use advertising cookies, pixels, session recording or remarketing tools. We will update this section if we introduce a cookie consent control.

Lawful Basis for Processing

We process your personal data on one or more of the following bases. They are drawn from the EU General Data Protection Regulation and the UK GDPR, and from the corresponding provisions of Indian law, including the Digital Personal Data Protection Act 2023 as its provisions come into force:

Your request : to arrange and confirm the visit or consultation you have asked for, and to reply to your questions. Under the GDPR, this is processing needed to take steps at your request before entering into a contract with us. Where no contract arises, for example a free visit, we rely on our legitimate interest in answering a request you have made to us. Under the DPDP Act, once section 7 is in force, it is the use of personal data you gave us voluntarily for that purpose.
Consent : to send you the newsletter, and to photograph you at the Museum. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Safety and security : to operate CCTV and keep the visitor register, in our legitimate interest in protecting visitors, staff and the collection.
Google Analytics cookies : for visitors in India and elsewhere, our legitimate interest in understanding how the website is used. For visitors in the European Economic Area and the United Kingdom, the law requires your consent before these cookies are set. This website does not yet have a consent control; until one is in place, you can prevent these cookies by the means described under Your choices.
Legitimate interests : to run, secure and improve the website, to keep server logs, to measure page performance through cookieless tools, and to keep a record of our correspondence with you, balanced against your rights and interests.
Legal obligation : to keep records or respond to requests where a law applicable to us requires it.

We share personal data only in the following circumstances.

With service providers. We use a small number of vendors to run this website and the Museum's mailbox. Vercel and Resend, and Google in respect of Google Analytics, are bound by data-processing terms that require them to protect your data and to use the personal data they process for us only on our instructions, except for the Google Analytics data sharing described next. Each may also use limited service and usage data, such as logs, to operate and secure its own services. Our Google Analytics account also shares measurement data with Google so that Google can use it to improve its own products and services, such as its advertising tools, and contributes it, in aggregated and de-identified form, to benchmarking and modelled insights. For the data shared to improve its products and services, Google is an independent controller under the controller terms we have accepted, and Google states in our Google Analytics settings that it will not use this data for its own ad personalisation or ad targeting. We also allow Google's support staff to access our Google Analytics data when needed to resolve technical issues. Google's data-processing terms for Google Workspace apply to our mailbox, Google Cloud's data-processing terms apply to the data we keep in Google BigQuery, and Railway's published Data Processing Addendum sets out how it handles data on our behalf. Google processes reCAPTCHA and Google Fonts data under its own terms and Privacy Policy rather than under a contract with us. Google states that it does not use Google Fonts data to build profiles or for advertising, and that reCAPTCHA data is used for improving reCAPTCHA and for general security purposes and not for personalised advertising.

Google LLC (United States) : Google Analytics, reCAPTCHA, Google Fonts, and Google Workspace, which hosts the info@momhindia.org mailbox in which your enquiry is kept.
Google Cloud India Private Limited (India) : Google BigQuery, which stores our copy of the Google Analytics data and a record of emails sent from this website, in Google Cloud's Mumbai region.
Vercel Inc. (United States) : website hosting, including the servers that process your form submission and newsletter sign-up, server logs, Web Analytics, Speed Insights, and storage of the Museum's own images. Your form submission passes through Vercel's servers on its way to our email provider and is not kept there beyond the short-lived server logs.
Plus Five Five, Inc., trading as Resend (United States) : transactional email. Resend delivers your form submission to us and your confirmation to you, and keeps a copy of the message and its delivery logs for 30 days.
Railway Corporation (United States), in its EU West region in Amsterdam, the Netherlands : hosting of the website's content database, which holds the newsletter list, staff accounts and website content.

Within our company. Consultation requests are handled by the atelier team of The House of Sunita Shekhawat, which is part of Midas Signature Jewellery Private Limited, the same company that operates the Museum. For legal compliance. When required by law, court order, or to protect our legal rights or prevent fraud. We do not sell personal data to third parties. We do not share personal data with social media platforms; the social media icons on this website are links only, and no data is passed to those platforms when you click them.

Data Retention

We retain personal information only for as long as is reasonably necessary to fulfil the purposes for which it was collected, or as required by applicable law. The periods below are indicative:

Appointment and consultation emails : kept in the Museum's mailbox for 24 months after the visit or the last exchange, then deleted.
Copies of form emails and confirmation emails at our email provider, with delivery logs : 30 days.
Newsletter subscription : until you ask to be removed, when we delete your email address from the list.
Google Analytics visitor-level and event-level data : event-level data is kept for 2 months, except any events we mark as key events, which are kept for 14 months; visitor-level data is kept for 14 months after your most recent visit. Google deletes expired data monthly, so it may remain for a short time after these periods. Aggregated statistics are kept for longer, and the copy described next is kept separately.
Copy of Google Analytics data in Google BigQuery : a daily export of the Google Analytics event data and of the related pseudonymous visitor-level data, such as device and approximate location, kept in our own Google Cloud project in Google Cloud's Mumbai region, India, for analysing visitor trends over time. No automatic deletion period is currently set on this copy, so it is kept until we delete it.
Record of emails sent from this website : a one-off export, made in September 2026, of the delivery records of emails sent from this website, including recipients' email addresses and subject lines, kept in our Google Cloud project in Google Cloud's Mumbai region, India, for internal reporting on enquiries. No automatic deletion period is currently set on it.
Vercel Web Analytics : aggregated statistics are available to us for 12 months; Vercel states it may hold the underlying records for longer. The daily visitor hash is discarded within 24 hours.
Vercel Speed Insights : aggregated performance data, available to us for 7 days.
Hosting logs : the request logs available to us are kept for one day; Vercel may retain security and operational logs for longer under its own privacy policy.
CCTV recordings : a limited period, after which they are overwritten, unless needed for an investigation or a lawful request.
Visitor register : for as long as needed for security and our appointment records, then destroyed.
Photographs of visitors : for as long as we use them for the purpose we told you about; removed on request.

We periodically review the data we hold and delete records that are no longer required. You may request earlier deletion by contacting us as described in the Your Rights section, subject to any period we are required by law to keep records.

Your Rights

You have the following rights regarding your personal information:

Access : request a copy of the personal data we hold about you.
Correction : ask us to correct or complete inaccurate data.
Deletion : request that we delete your data, subject to any legal retention requirements.
Restriction : ask us to limit how we process your data.
Portability : receive your data in a structured, machine-readable format where technically feasible.
Objection : object to processing based on our legitimate interests, or to direct marketing, at any time.
Withdrawal of consent : where processing is based on consent, withdraw it at any time.
Nomination : once section 14 of the Digital Personal Data Protection Act 2023 is in force, nominate another individual to exercise your rights in the event of your death or incapacity; until then we will honour such a request as a matter of practice.

Some of these rights arise under the GDPR and UK GDPR, or under provisions of the DPDP Act that are not yet in force. We extend them to every visitor as a matter of practice, subject to the limits described above.

To exercise any of these rights, email us at info@momhindia.org or write to the address in the Contact Us section. We will use the email address you gave on the form or at newsletter sign-up to verify that the request comes from you. We respond within 30 days and free of charge. If a request is complex we may need up to two further months, and we will tell you within the first month if so.

To leave the newsletter, write to info@momhindia.org at any time and we will remove your email address.

If you are in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your local data protection authority (in the United Kingdom, the Information Commissioner's Office). If you are in India, you may raise a grievance with our Grievance Officer (details below). Once the relevant provisions of the Digital Personal Data Protection Act 2023 are in force, an unresolved grievance may be taken to the Data Protection Board of India.

Children's Data

Children are welcome at the Museum, and we are glad to see families visit. This website, however, is not directed at children. Appointments and consultation requests must be submitted by an adult aged 18 or over; the group-size field counts the people in your party, including children, without recording their details. We do not knowingly collect personal information through this website from anyone under 18.

If you believe a child has provided personal information to us, please contact us at info@momhindia.org and we will delete it promptly.

How We Protect Your Information

We take reasonable technical, administrative and organisational measures designed to safeguard the personal data we hold against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include encrypted connections (HTTPS) across the website, access controls on our content management system and mailbox, restricted access to CCTV recordings, and due diligence on the vendors we use.

No method of transmission over the internet or electronic storage is entirely secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will take steps consistent with applicable law to address the incident, and will inform affected individuals and the relevant authority where the law requires it, without undue delay.

International Data Transfers

The Museum is located in India, and your personal data is held here under this Policy and Indian law. India is not currently covered by an adequacy decision of the European Commission or of the United Kingdom.

The servers that handle your form submissions and newsletter sign-ups run in the United States, in Vercel's Washington, D.C. region. Our service providers Google LLC (Analytics, reCAPTCHA and Fonts), Vercel Inc. and Plus Five Five, Inc. (Resend) process data there. Our Google Workspace mailbox is stored in Google's data centres, which may be located outside India. The newsletter list is held in a database hosted by Railway Corporation (United States) in its EU West region in Amsterdam, the Netherlands. A copy of our Google Analytics data is also kept in India, in Google Cloud's Mumbai region. This means that enquiries, newsletter sign-ups, our mailbox and analytics data are stored or processed outside India.

For visitors in the European Economic Area and the United Kingdom, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum. These are incorporated in the data-processing terms of Google (for Google Analytics and Google Workspace), Vercel and Resend. The newsletter database is held within the European Union, and Railway's Data Processing Addendum governs any access to it from the United States. Google, Vercel and Resend are also certified under the EU-US Data Privacy Framework and its UK Extension. Because the Museum is established outside the EU and the UK, we treat that certification as an additional assurance of the protection your data receives in the United States, rather than as the legal basis for the transfer. We review these arrangements when a provider's terms or certification changes.

For all visitors, transfers are made in accordance with Indian law, including any restrictions the Central Government may notify under section 16 of the Digital Personal Data Protection Act 2023.

Contact Us

For any privacy-related questions, requests to exercise your rights, or concerns about how we handle your data, please contact:

The Museum of Meenakari Heritage
The House of Sunita Shekhawat

(Operated by Midas Signature Jewellery Private Limited)

Shekhawat Haveli, E-141, Sardar Patel Marg, Durgadas Colony, C-Scheme, Ashok Nagar, Jaipur 302001, Rajasthan, India.

Email : info@momhindia.org
Phone : +91 6377 490 417

Registered office : E-141, Sardar Patel Marg, C-Scheme, Ashok Nagar, Jaipur 302001, India.

We aim to respond to all enquiries within 30 days, subject to identity verification.

Grievance Officer

In accordance with Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, our designated Grievance Officer is:

Name : Sanjay Sharma
Designation : Company Secretary
Email : support@sunitashekhawat.com
Phone : +919119113401
Address : E-141, Sardar Patel Marg, C-Scheme, Ashok Nagar, Jaipur 302001, India.

The Grievance Officer will acknowledge receipt of a complaint within 7 days and resolve it within 30 days of receipt. The same officer will be the contact person for questions about the processing of your personal data under the Digital Personal Data Protection Act 2023 once its provisions are in force.

Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the Republic of India. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts located in Jaipur, Rajasthan, India.

This Policy does not affect any non-waivable rights you may have under the law of your country of residence. Nothing in this section limits the right of a person in the European Economic Area or the United Kingdom to complain to their supervisory authority, or to bring proceedings in the courts of their own country where the law gives them that right.

Severability and Changes

If any provision of this Privacy Policy is held by a court or competent authority to be unlawful or unenforceable, the remaining provisions shall continue in full force and effect.

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. That includes the further provisions of the Digital Personal Data Protection Act 2023, and the Rules made under it, as they come into force. The Last Updated date at the foot of this Policy shows when it was most recently revised. Where changes are material, we will give reasonable notice on this website or by direct communication.

Thank you for your interest in the Museum and in the art of meenakari. If anything on this page is unclear, write to us at info@momhindia.org and we will gladly explain.

Last Updated : 14 October 2026