Privacy Policy & Data Protection Protocol
1. Regulatory Framework & Data Fiduciary Role
Under the Digital Personal Data Protection Act, 2023 ("DPDP Act 2023") and the Information Technology Act, 2000 (specifically Section 43A and the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules, 2011):
- Data Fiduciary: QUOSMYN GROUP determines the purpose and means of processing personal data collected across
quosmyn.com,maison.quosmyn.com,luxury.quosmyn.com, andbazaar.quosmyn.com. - Data Principal: Any individual (customer, patron, site visitor, or institutional partner) whose personal data is processed by QUOSMYN GROUP.
2. Categories of Personal Data Collected
QUOSMYN GROUP adheres strictly to the principle of Data Minimization. We collect only what is operationally indispensable to deliver products, generate tax invoices, and prevent transaction fraud:
| Identification Data | Full legal name, salutation, delivery postal coordinates, and state code (required for GST invoice generation). |
|---|---|
| Communication Parameters | Mobile phone number and email address (used strictly for WhatsApp OTP verification, courier transit updates, and delivery dispatch calls). |
| Order & Customization Data | Items ordered, transaction timestamps, dedicated inscriptions for heirloom provenance certificates, or boardroom gift dedications. |
| Technical & Telemetry Data | Anonymized IP addresses, browser user-agents, and timestamp logs retained strictly for cybersecurity defense and DDoS mitigation. |
3. Lawful Grounds for Processing
In accordance with Section 4 and Section 6 of the DPDP Act 2023, data is processed on legitimate and lawful grounds:
- Explicit Informed Consent: Provided voluntarily by the consumer when placing an order or registering for patron access.
- Performance of Contract: To process, manufacture, pack, dispatch, and fulfill the requested commercial purchase.
- Statutory & Tax Obligations: Retention of financial invoices for 8 financial years as mandated under the Central Goods and Services Tax (CGST) Act, 2017 and the Companies Act, 2013.
4. Zero Storage of Sensitive Financial Credentials
QUOSMYN GROUP operates under strict PCI-DSS Level 1 compliance guidelines:
- We NEVER view, capture, process, or store customer Credit Card numbers, Debit Card numbers, ATM PINs, CVV codes, or UPI MPINs on our internal systems.
- All electronic payments are routed directly through Reserve Bank of India (RBI) authorized payment aggregators operating under 256-bit SSL banking-grade encryption.
5. Authorized Third-Party Disclosures (Logistics Only)
Personal delivery details (Name, Shipping Address, and Delivery Phone Number) are shared exclusively with verified national and international logistics carriers (such as Bluedart Apex, DTDC Express, or India Post) for the sole purpose of physically delivering parcels to the recipient. Carriers are bound by non-disclosure and data privacy covenants.
6. Statutory Rights of the Data Principal (DPDP Act 2023)
Under the DPDP Act 2023, every consumer and patron of QUOSMYN GROUP enjoys comprehensive, legally enforceable rights:
- Right to Access Information (Section 11): Patrons may request a complete summary of all personal data held and processing activities conducted by writing to our Data Protection Desk.
- Right to Correction & Erasure (Section 12): Patrons may request correction of inaccurate data or complete erasure/anonymization of their contact details once commercial fulfillment is concluded, subject only to mandatory statutory tax retention periods.
- Right of Grievance Redressal (Section 13): Patrons have an unhindered right to register complaints with our Data Protection Officer and receive formal resolution within statutory deadlines.
- Right to Nominate (Section 14): Patrons may nominate any other individual to exercise their data rights in the event of death or incapacity.
7. Children's Data Protection & Age Gate
In accordance with Section 9 of the DPDP Act 2023:
- QUOSMYN GROUP does not knowingly solicit, process, or track the personal data of individuals under the age of 18 without verifiable parental or legal guardian consent.
- Our portals do not engage in targeted behavioral advertising directed toward minors.
8. Reasonable Security Practices & Encryption Standards
In compliance with Section 43A of the Information Technology Act, 2000 and the DPDP Act 2023:
- All web communications across
quosmyn.comand its subdomains are locked under Transport Layer Security (TLS 1.3 / HTTPS) with HTTP Strict Transport Security (HSTS). - Customer identifiers are stored behind SHA-256 and AES-256 encrypted architectural vaults with strict role-based access control (RBAC).
9. Data Protection Officer (DPO) & Privacy Grievance Redressal
In compliance with the DPDP Act 2023 and the Consumer Protection (E-Commerce) Rules, 2020, the designated Data Protection Officer for QUOSMYN GROUP is published below:
| Designated Authority | Data Protection Officer (DPO) • QUOSMYN GROUP |
|---|---|
| Direct DPO Email | privacy@quosmyn.com • corporate@quosmyn.com |
| General Grievance Desk | desk@quosmyn.com • grievance@quosmyn.com |
| Corporate Helpline | +91 8603550120 |
| Statutory Turnaround | All privacy inquiries and erasure requests are acknowledged within 48 hours and redressed within 30 days. |
10. Right to Approach the Data Protection Board of India
If a patron or consumer is not satisfied with the grievance redressal provided by QUOSMYN GROUP, they retain the statutory right to escalate the matter to the Data Protection Board of India in accordance with the provisions of the DPDP Act 2023.
11. Policy Modifications & Updates
QUOSMYN GROUP reserves the right to update this Privacy Protocol to maintain compliance with evolving statutory notifications, judicial precedents, and international data treaties. All modifications will reflect an updated effective date on this page.