Seventh August IT Services Pvt. Ltd. (hereafter "we", "our", "us", "Seventh August" or "the organization") respects your right to data privacy. In this statement "you" and "your" refer to the individual whose personal data we process — customers, website visitors, artists, employees or contingent workers.

Artoreal is operated from India and serves customers in India. We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000 and rules made under it. Where we process the personal data of individuals in the European Economic Area or the United Kingdom, the additional section near the end of this statement applies to them.

Definitions

Data Principal (also "data subject" or "individual") — an identified or identifiable living individual whose personal data is processed.

Data Fiduciary (also "controller") — the person who alone or with others determines the purpose and means of processing personal data. For the Artoreal website, that is Seventh August.

Data Processor — a person who processes personal data on behalf of a Data Fiduciary.

Personal Data — any data about an individual who is identifiable by or in relation to such data.

Processing — any operation performed on personal data, whether automated or not, including collection, recording, storage, use, sharing, disclosure, erasure or destruction.

Sensitive / special category data — data revealing racial or ethnic origin, religious, political or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning health or sex life.

Data Protection Officer — the individual appointed to oversee data protection compliance and to act as the point of contact for individuals and for the authorities.

What does Artoreal do?

Seventh August IT Services Private Limited is the operator and licensee of this website. Seventh August is a wholly owned subsidiary of Nihilent. Artoreal is an online marketplace for exclusive collections of photographs and paintings. For more information, please see the About us section.

Data Protection Officer and Grievance Officer

Nihilent, the parent company of Seventh August, has appointed a Data Protection Officer (DPO), who also serves as the Grievance Officer for the purposes of the DPDPA. If you have any question or complaint about how we handle your personal data, or wish to exercise any of your rights, please contact:

Name: Mr. Raja Laskar
Address: Nihilent Ltd., 4th Floor, 'D' Block, Nagar Road Weikfield, IT Citi Info Park, Pune, Maharashtra 411014, India
Email: DPO@nihilent.com
Telephone: +91-20-398 46 100

We will acknowledge a grievance promptly and respond within the period required by applicable law. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

When do we collect your personal data?

Direct interactions. You may give us your identity, contact, financial and transaction data by filling in forms or by corresponding with us by post, phone, email or otherwise, including when you:

• register an account, including user name, contact details and account details;
• order our artworks or services;
• subscribe to our services, publications or newsletters;
• request marketing notifications;
• interact with us by telephone, email or other correspondence, including instructions you give us;
• provide feedback;
• sign up to offers, news or a contest;
• send us emails or text messages (SMS, WhatsApp or chat service);
• add posts, reviews or comments to our website;
• like or dislike our offers and promotions;
• add artworks to your shopping cart or wish list;
• interact with us on social media platforms.

Automated technologies. Log files record data about your use of the service, such as IP address, browser type, referring and exit pages, operating system and date/time stamps. Cookies and similar technologies are described in our cookie statement, which also explains how to control them.

Third parties. We may receive data about you from analytics and advertising providers, and from social media platforms, as described in the cookie statement.

What personal data do we collect?

Identity data — first name, last name, username, system-generated unique ID, shop name, date of birth, gender, PAN card and driving licence (the last two only where required for artist onboarding or statutory compliance).

Contact data — billing address, shipping/delivery address, email address, telephone numbers.

Financial data — bank account number, name as per bank account, GSTIN, copy of cancelled cheque. We do not store your card, UPI or net banking credentials; those are handled by our payment gateway.

Transaction data — details of payments to and from you, and of artworks and services you have purchased, including billing and delivery address.

Technical data — IP address and login data, and information about how often you visit and use the website, collected via cookies and similar technology.

Profile data — username and password, purchases and orders, interests, preferences, feedback and survey responses, profile image and profile description.

Usage data — information about how you use our website, artworks and services, and what you view or click in our marketing emails and messages.

Marketing and communications data — your communication preferences and marketing consents.

Aggregated data — statistical or demographic data that does not identify you. If we ever combine it with your personal data so that you become identifiable, we treat the combined data as personal data under this statement.

Special category data — we do not collect data about your race or ethnicity, religious beliefs, sexual orientation, health, genetic or biometric characteristics.

Children. Our services are not directed at children. We do not knowingly process the personal data of a child except with verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

Why we process your personal data

We process personal data on the following bases:

• Your consent — for marketing communications, and for analytics and advertising cookies. You may withdraw consent at any time, as easily as you gave it; withdrawal does not affect processing already carried out.
• Performance of a contract — to create and manage your account, process your order and payment, arrange delivery, handle returns and refunds, and provide support.
• Compliance with law — to meet tax, accounting, and other statutory obligations, and to respond to lawful requests from public authorities.
• Legitimate uses permitted by law — to prevent fraud and misuse, to secure our systems, and to establish, exercise or defend legal claims.

Who we share your personal data with

We share personal data only as needed to run the service, and we require every recipient to protect it and to use it only for the purpose we specify. Our principal processors are:

• Razorpay — payment processing. Your payment credentials are provided to Razorpay directly and are not stored by us.
• Google Firebase — account authentication and sign-in.
• Delhivery and other logistics partners — delivery of your order, which requires your name, delivery address and telephone number.
• Google (Analytics, Ads, Tag Manager) and Meta (Facebook and Instagram advertising) — website analytics and advertising measurement, subject to your cookie consent.
• Artists selling on Artoreal — where you purchase an original painting, the artist is the seller and receives the information necessary to invoice and dispatch your order.
• Printing and framing partners — where you purchase a photograph, to produce and dispatch your order.
• Professional advisers, auditors and authorities — where required by law or to protect our legal interests.

We also share personal data within the Nihilent group on a need-to-know basis, under confidentiality obligations. We do not sell your personal data. If our business is sold or merged, personal data may transfer to the new owner, who must continue to handle it in accordance with this statement.

How long we keep your personal data

We keep personal data only for as long as we need it for the purpose it was collected for, and then delete it or anonymise it so it can no longer be linked to you.

• Account data — for as long as your account remains active. You may ask us to delete your account at any time.
• Transaction, invoice and tax records — seven years from the date of the transaction, as required by Indian tax and companies legislation. We keep these even if you close your account, because the law requires it.
• Marketing preferences — until you withdraw consent or unsubscribe, plus a record of the withdrawal itself so we can honour it.
• Cookies and similar technologies — for the periods set out in our cookie statement.
• Support correspondence — for as long as needed to resolve your query and to handle any related claim.
• Notification and messaging logs — 90 days.
• Photographs and documents submitted with a return or damage claim — 90 days after the claim is closed.

Your rights

It is important that the personal data we hold about you is accurate and current. Please keep your details up to date in your Artoreal account. Subject to applicable law, you have the right to:

• Access — obtain a summary of the personal data we process about you, and of the processing activities we undertake.
• Correction — have inaccurate or incomplete data corrected or completed.
• Erasure — ask us to delete personal data where we no longer need it for the purpose it was collected for, and where we are not required by law to retain it. Please make this request to the Data Protection Officer named above, who will action it; we may need to verify your identity first, and records we are legally required to keep, such as invoices, are retained for the periods set out above.
• Withdraw consent — where we rely on your consent, withdraw it at any time.
• Grievance redressal — raise a complaint with our Grievance Officer, and escalate to the Data Protection Board of India if you remain dissatisfied.
• Nominate — nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, please contact the Data Protection Officer at DPO@nihilent.com. We may need to verify your identity before acting on a request. We do not charge a fee in ordinary cases.

Marketing communications

You can ask us to stop sending you marketing messages at any time, by using the unsubscribe link in any marketing email or by contacting us. Withdrawing marketing consent does not affect messages we must send you about an order you have placed.

Automated decision-making

We do not make decisions about you that produce legal or similarly significant effects using automated processing alone. Where we use software to recommend artworks or to rank search results, this does not determine any right or entitlement of yours.

How we protect your personal data

We use appropriate technical and organizational measures designed to provide a level of security appropriate to the risk. Data in transit is protected using HTTPS and other encryption protocols; passwords are encrypted; and network controls such as firewalls and access controls protect the systems that hold personal data. Access is limited to personnel who need it for their role.

If a data breach occurs that affects your personal data, we will notify the Data Protection Board of India and affected individuals as required by law.

No system is completely secure. If you have concerns about the security of your own device, we suggest reading the guidance published by Get Safe Online or by CERT-In.

Transfers outside India

Some of our processors operate infrastructure outside India. Where personal data is transferred outside India, we do so only to countries not restricted by the Government of India for this purpose, and we require the recipient to protect the data to the standard described in this statement. You may contact our DPO for details of the countries concerned.

Additional information for individuals in the EEA and UK

If you are located in the European Economic Area or the United Kingdom, you may also have rights under the General Data Protection Regulation, including the rights to restrict or object to processing and to data portability, and the right to lodge a complaint with your local supervisory authority. Where we transfer personal data out of the EEA or the UK, we rely on an adequacy decision or on standard contractual clauses. Please contact our DPO if you wish to exercise these rights or to receive further detail on the safeguards used.

Changes to this statement

We review this statement when our processing changes, and otherwise from time to time. The date below shows when it was last updated.