Privacy Policy

1. Who we are

BuzzSpark E Services Private Limited (“BuzzSpark”, “we”, “us”) is a private limited company incorporated in 2019 under the Companies Act, 2013, with CIN U93090UP2019PTC115788 and registered office at B-98, Sector-C, Near Wireless Chauraha, Mahanagar, Lucknow - 226006, Uttar Pradesh, India.

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), BuzzSpark is the Data Fiduciary for personal data processed through this website and through the ventures it operates, unless a specific venture states otherwise in its own notice.

2. This notice

This notice is provided under Section 5 of the DPDP Act. It tells you what personal data we process, why, how you may exercise your rights, and how to complain. It is available in English and will be made available in any language listed in the Eighth Schedule to the Constitution of India on request to legal@buzzspark.in.

3. Personal data we process

This website does not use cookies, analytics, trackers or browser storage. Visiting it does not create a record identifying you beyond ordinary web server logs.

• Server logs. IP address, timestamp, requested path, user agent and referrer, retained for security and diagnostics.
• Correspondence. Name, email address, telephone number and message content when you write or call us.
• Business and vendor records. Contact details, GSTIN, PAN, bank details and contractual records of clients, vendors and partners.
• Venture products. Data processed inside a venture’s product is governed by that venture’s own privacy notice and its agreement with the customer.

4. Purposes and lawful basis

We process personal data for these specified purposes: responding to enquiries; providing and supporting services under a contract; issuing invoices and meeting obligations under the GST and Income-tax Acts; keeping records required by the Companies Act, 2013; verifying identity for payment gateway, banking and platform onboarding; and securing our systems.

Where the DPDP Act requires consent, we obtain it before processing and you may withdraw it at any time. Where processing is for a legitimate use under Section 7 — including a purpose for which you have voluntarily provided data, and compliance with law or a judgment — we rely on that basis.

5. Sharing

We do not sell personal data. We share it only with Data Processors engaged under contract — hosting, email, telephony, payment gateways, accounting and professional advisers — and with government authorities, courts or regulators where required by law. Processors act on our instructions and are bound to security obligations no weaker than ours.

6. Retention

We erase personal data when the specified purpose is no longer served and retention is no longer required by law. Statutory records under the Companies Act, GST and Income-tax legislation are kept for the periods those laws prescribe — generally eight years for company records and six years for tax records. Server logs are retained for up to twelve months.

7. Security

We apply reasonable security safeguards to prevent personal data breaches, including transport encryption, access control on a need-to-know basis, and separation of production systems. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under the DPDP Act.

8. Your rights as a Data Principal

• The right to obtain a summary of the personal data we process about you and our processing activities.
• The right to correction, completion, updating and erasure of your personal data.
• The right to nominate another individual to exercise your rights in the event of your death or incapacity.
• The right to grievance redressal, before approaching the Data Protection Board of India.
• The right to withdraw consent, where processing rests on consent.

To exercise any of these, write to the address in section 10. We will respond within the period prescribed under the DPDP Act and its rules. You are also required, under Section 15 of the Act, to provide authentic information and not to raise false or frivolous grievances.

9. Children

Our services are directed at businesses and are not intended for children under 18. We do not knowingly process the personal data of a child without verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

10. Grievance officer and contact

Questions, requests and grievances under this notice should be addressed to the Grievance Officer.

11. Changes

We may update this notice. The version number and effective date above will change, and material changes will be notified to affected Data Principals by email where we hold one.