Privacy Policy — Spacekart India

Spacekart India Pvt. Ltd ("Spacekart", "we", "us", or "our") operates the website www.spacekart.in and provides virtual office, co-working, and related business services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or otherwise interact with us.

By accessing or using our services, you agree to the terms of this Privacy Policy. If you do not agree, please do not access or use our services.

1. Information We Collect

Personal information you provide

We may collect the following personal information that you voluntarily provide:

Name, date of birth, gender
Contact details — email, phone, postal address
Identity documents — PAN, Aadhaar, passport, driving licence
Company information — incorporation certificate, GSTIN, director details
Payment information — billing address and transaction references (card data is processed by our PCI-DSS-compliant payment gateway and is never stored on our servers)

Information collected automatically

IP address, browser type, operating system, device identifiers
Pages visited, time spent, referring URLs
Cookies and similar tracking technologies (see our Cookie Notice)

2. How We Use Your Information

To provide, operate, and maintain our services
To process your registration, KYC verification, and plan activation
To handle mail, parcels, calls, and meeting-room bookings on your behalf
To issue invoices, receipts, and compliance documents (NOC, rental agreement, utility bill)
To communicate with you — service updates, renewal reminders, security alerts
To improve our website, services, and customer experience
To comply with applicable legal and regulatory obligations

3. Legal Bases for Processing

We rely on one or more of the following legal bases under the Digital Personal Data Protection Act, 2023 and other applicable laws:

Performance of a contract with you
Your consent (which you may withdraw at any time)
Compliance with a legal obligation
Our legitimate interests, provided these are not overridden by your rights

4. Sharing Your Information

We do not sell your personal information. We may share information with:

Service providers — payment gateways, KYC vendors, cloud hosting, communication platforms (bound by confidentiality obligations)
Government authorities — when required to comply with applicable law, court order, or regulatory request
Business transfers — in connection with a merger, acquisition, or sale of assets (with notice to you)
Professional advisors — auditors, lawyers, tax consultants under confidentiality

5. Data Retention

We retain personal information for as long as necessary to fulfil the purposes set out in this policy, including to satisfy legal, accounting, or reporting requirements. Typical retention periods:

Data Category	Retention Period
Active customer KYC	Duration of service + 7 years
Inactive customer KYC	7 years from last interaction
Financial transactions / invoices	8 years (statutory requirement)
Mail handled on customer's behalf	Until forwarded / collected, max 90 days (then destroyed)

We delete or anonymise personal information when it is no longer needed for the purposes for which it was collected.

6. Data Security

We implement appropriate technical and organisational safeguards to protect personal information, including encryption in transit (TLS 1.2+), encryption at rest for sensitive documents, access controls with role-based permissions, and quarterly security reviews. No method of transmission over the internet, however, is 100% secure.

7. Your Rights

Subject to applicable law, you have the right to:

Access a copy of the personal information we hold about you
Request correction of inaccurate or incomplete data
Request deletion of your personal information (subject to legal retention obligations)
Withdraw consent where processing is based on consent
Lodge a complaint with the Data Protection Board of India

To exercise any of these rights, write to [email protected]. We respond within 15 business days.

8. Children's Privacy

Our services are not directed to anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us so we can delete it.

9. International Transfers

We primarily store data within India. Where a service provider processes data outside India (for example, a global cloud vendor), we ensure contractual safeguards consistent with the DPDP Act, 2023.

10. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email at least 15 days before they take effect. Continued use of our services after the effective date constitutes acceptance of the updated policy.

11. Contact

Questions about this Privacy Policy can be sent to [email protected] or by post to Spacekart India Pvt. Ltd, Kochi, Kerala, India.