1. Who is responsible for your data

Mehta Biz Space, a brand of MEHTA & CO (GSTIN 29AEYPM5838A1ZZ), #N-505 to N-508, 5th Floor, Property No. 71, Brigade Plaza, Gubbi Veeranna Road, SC Road, Gandhi Nagar, Bengaluru 560009, decides why and how your personal data is processed. Under the DPDP Act we are the "Data Fiduciary". You are the "Data Principal".

Contact for any question about your data: Rakesh Prithviraj Mehta, Grievance Officer, Mehta Biz Space, #N-505 to N-508, 5th Floor, Property No. 71, Brigade Plaza, Gubbi Veeranna Road, SC Road, Gandhi Nagar, Bengaluru 560009. Email mehtabizspace@gmail.com, phone +91 91089 68345.

We already follow the DPDP Act and the DPDP Rules, 2025, ahead of the date most of their duties take effect (13 May 2027).

2. What we collect, why, and on what basis

We collect only what we need for the purpose listed. We do not collect sensitive information such as health, religion or financial account details.

Personal data	Purpose	Basis
Name, mobile number, email, service of interest, your message	Reply to your enquiry, arrange a tour, give you a quote	You provided it voluntarily for this purpose (DPDP Act, section 7(a))
Booking details: space, date, time, number of seats, amount, payment status	Hold and confirm your booking, prevent double bookings	Performing the booking you asked for (section 7(a))
Business name, GSTIN, billing address, invoice and payment records	Issue GST invoices, keep accounts	Required by law (GST and income-tax laws)
Identity and business documents for a virtual office	Verify who uses our address, as registration authorities require	Required by law and for the service you asked for
Email address used to sign in to your account	Let you sign in and manage your bookings	Your consent and the service you asked for
Campaign source of your visit (for example the ad name), pages viewed, device and browser type	Know which pages and ads work so we can improve them	Your consent (see section 4 on cookies)
If you message us on Instagram or Facebook: your name or username, account ID and the messages you send and receive	Reply to you and keep a record of the enquiry in our customer system so our team can follow up	You contacted us and gave it voluntarily for this purpose (section 7(a))
Scrambled (hashed) phone number or email sent to Meta after an enquiry	Measure whether an enquiry came from our Meta ads	Your consent, which you can withdraw at any time

We do not see or store your card, UPI or bank account details. Online payments are handled by Razorpay, a payment aggregator regulated by the Reserve Bank of India.

3. Who we share it with

We use these service providers (Data Processors) only to run our service, under their contracts and data protection terms. They may process data on servers in India or abroad.

Provider	What it does for us
Hostinger	Hosts this website
Supabase	Our database (servers in Mumbai, India)
Brevo	Sends booking and enquiry emails
Telegram	Sends instant alerts about new enquiries and bookings to our team
Razorpay	Processes online payments
Google (Analytics, Maps, Search Console)	Website analytics and the map on our contact page
Meta (Pixel and Conversions API)	Ad measurement
Meta (Instagram and Messenger messaging)	Delivers the messages you send our Instagram account or Facebook Page to our customer system

We may also share data with tax authorities, courts, police or other government bodies when the law requires it, and with professional advisers (such as our chartered accountant) who are bound to keep it confidential.

We do not sell your personal data. We do not let anyone use it for their own marketing.

Transfers outside India happen only through the providers above and only to countries the Government of India has not restricted under section 16 of the DPDP Act.

4. Cookies, analytics and ads

This website uses Google Analytics and the Meta Pixel, which set cookies to count visits and measure ads. The map on our contact page is served by Google and may set its own cookies. You can block or delete cookies in your browser, or use an ad blocker. The website, forms and bookings keep working if you do.

5. How long we keep it

Data	How long
Enquiries that do not become a booking or plan	Up to 24 months after our last contact with you, then deleted
Bookings, invoices and payment records	At least 8 years, as GST and income-tax laws require
Virtual office documents	For the plan period, then as long as the law requires
Sign-in account	While your account is active, and 12 months after your last sign-in
Security and access logs	At least one year, as the DPDP Rules require

When the purpose ends and no law requires us to keep the data, we delete it. Before we delete data because you have been inactive, we will tell you if the DPDP Rules require it.

6. How we protect it

All traffic to this website is encrypted (HTTPS).
Only authorised team members can open the customer system, each with their own sign-in and role-based access.
Our providers use encryption and access controls on their servers.
We keep access logs and back up data so we can detect misuse and recover from failures.

No system is completely secure. If a personal data breach affects you, we will tell you without delay in plain language: what happened, the likely impact, what we are doing and what you can do. We will also report it to the Data Protection Board of India as the law requires.

7. Your rights

Access: ask for a summary of the personal data we hold about you and how we use it, and the names of those we shared it with.
Correction, completion and update: ask us to fix data that is wrong, incomplete or out of date.
Erasure: ask us to delete your data. We will, unless the law requires us to keep it (for example invoices).
Withdraw consent: as easily as you gave it, at any time. This does not affect processing done before you withdrew. If you withdraw, we stop processing for that purpose, though we may not be able to provide a service that depends on it.
Grievance redressal: complain to us about how we handle your data.
Nominate: name another person to use these rights for you in case of death or incapacity.

How to use them: email mehtabizspace@gmail.com with the subject "Data request", from the email or phone number you used with us. We may ask you to confirm your identity before we act. We will reply as soon as possible and in any case within 90 days, the maximum period the DPDP Rules allow.

8. Complaints

Please contact us first: Rakesh Prithviraj Mehta, Grievance Officer, Mehta Biz Space, #N-505 to N-508, 5th Floor, Property No. 71, Brigade Plaza, Gubbi Veeranna Road, SC Road, Gandhi Nagar, Bengaluru 560009. Email mehtabizspace@gmail.com, phone +91 91089 68345. We acknowledge complaints within 48 hours. If you are not satisfied after using our grievance process, you may complain to the Data Protection Board of India, which accepts complaints online.

9. Children

Our services are meant for adults. We do not knowingly collect data from anyone under 18 without verifiable consent from a parent or lawful guardian. If you believe a child has given us personal data, contact us and we will delete it.

10. Your duties

Under section 15 of the DPDP Act, please give us accurate information, do not impersonate anyone, and do not file false or frivolous complaints.

11. Language and changes

This notice is in English. On request, we will provide it in any language listed in the Eighth Schedule to the Constitution of India, including Kannada and Hindi. We may update this notice when our services or the law change. The date at the top shows the current version; for important changes we will tell existing customers.

Privacy policy and data protection notice