Privacy concerns regarding my data on a website
<p>Recently, I signed up on <a href="https://www.eyewinawards.com/" rel="nofollow noreferrer">this</a> website. As soon as I registered, they sent me an activation email.</p>

<p>After seeing the activation email, I was a little disturbed. The activation email consisted of the following info:</p>

<ul>
<li>Activation URL</li>
<li>Username</li>
<li>Password</li>
</ul>

<p>Yes, they explicitly mentioned my password in the activation email.</p>

<p>This is very bad practice because of the following reasons:</p>

<ul>
<li>If I have made a typo in my email then the person who receives the email gets to know my really sensitive info.</li>
<li>Even if typo is not there, but let's say, somehow someone manages to get access to my email, he will also now get access to my information on this new website where I registered. </li>
</ul>

<p>Moreover, to the best of my knowledge, user sign-up forms are designed such that the party offering the service doesn't themselves get access to my password (this is usually done by first encrypting the password - one way hashing - and then storing it). But since they sent my password back again to my email, so it is possible that they indeed have access to my actual password.</p>

<p>I have submitted a query to them regarding this issue but I am not sure if some action will be taken soon or not.</p>

<p>So, I would like to know, in case they don't take any action at all, where can I submit my complaint regarding this?</p>

<p>Besides, I am not very confident if I can actually register a complaint because there <a href="https://www.eyewinawards.com/terms-and-conditions" rel="nofollow noreferrer">terms and conditions page</a> doesn't talk about anything related to this. And also, they never asked me if I agree to those terms and conditions.</p>

<p>Because the company that runs the contest is not in the banking or medical industry, or in another business or organization (NGO or governmental) that has to protect personal information by law, your login, email and password can be stored on pieces of paper scattered around their office and it's not illegal. And there are no laws regarding sending your information in plain text in an email.</p>

<p>Yes, those are bad security and privacy policies, but they are not illegal. <em>(This may vary by jurisdiction).</em></p>

<p>The TOS (Terms of Serivice) you agreed to are at <a href="https://www.eyewinawards.com/privacy-policy" rel="nofollow noreferrer">Eye Win Awards Privacy Policy</a>. Part of it reads:</p>

<blockquote>
  <p>By providing us your Information or by making use of the facilities
  provided by the Website, You hereby consent to the collection,
  storage, processing and transfer of any or all of Your Personal
  Information and Non-Personal Information by us as specified under this
  Privacy Policy. You further agree that such collection, use, storage
  and transfer of Your Information shall not cause any loss or wrongful
  gain to you or any other person.</p>
</blockquote>

<p>and</p>

<blockquote>
  <p>We cannot guarantee the security of our database, nor can we guarantee
  that information you supply will not be intercepted while being
  transmitted to us over the Internet. And, of course, any information
  you include in a posting to the discussion areas is available to
  anyone with Internet access.</p>
</blockquote>

<p>You agree to the TOS and Privacy Policy simply by registering and using the site. This is known as a <a href="https://en.wikipedia.org/wiki/Click_wrap" rel="nofollow noreferrer">click wrap (Wikipedia)</a> contract. You can choose to stop using the service, or by the company can choose to void the contract and close your account.</p>

<p>You can complain, but it is entirely up to the company to address your complaint or even reply to you. The Grievance Redressal contact in India is at the bottom of the link above. There are probably consumer advocacy groups in India; Google will show you those.</p>

<p>Depending on what you're hoping to get out of the process, you can complain to the company, the <a href="https://www.ftccomplaintassistant.gov/#crnt&amp;panel1-1" rel="nofollow noreferrer">Federal Trade Commission</a>, or the <a href="https://www.bbb.org/consumer-complaints/file-a-complaint/nature-of-complaint/" rel="nofollow noreferrer">Better Business Bureau</a>.</p>

privacy data-protection online