Privacy Policy

1. Introduction and scope

1.1 This Privacy Policy ("Policy") is published by Lasyaa Brand Studios LLP, a limited liability partnership incorporated under the laws of India, having its registered office at 1605, D-Wing, Hubtown Greenwoods, Pokhran Road, Thane West, Thane, Maharashtra 400602, carrying on business under the name "Nebula Brand Labs" ("Company", "we", "us" or "our").

1.2 This Policy is published in compliance with, and is to be read in accordance with, the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules notified thereunder, the Information Technology Act, 2000 and the rules made thereunder, including, to the extent applicable, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and any other applicable law in India (together, "Applicable Law").

1.3 This Policy describes how we collect, use, store, share, transfer, retain and otherwise process Personal Data when you (a) access or use our website at www.nebulabrandlabs.com and any associated sub-domains, landing pages or microsites ("Website"); (b) contact us by any means; (c) engage us, or are a representative of an entity that engages us, for services; (d) apply for employment, internship or freelance engagement; (e) supply goods or services to us; or (f) subscribe to our communications (together, the "Purposes of Interaction").

1.4 This Policy does not apply to Personal Data that we process solely on behalf of and under the instructions of our clients in the course of providing services to them (for example, leads generated through a client's advertising campaign). In such cases, the client is the Data Fiduciary, the client's privacy notice governs, and the Company acts as a Data Processor in accordance with its contract with the client.

1.5 By accessing the Website or providing Personal Data to us, you acknowledge that you have read and understood this Policy. Where processing is based on consent, we shall seek your consent through a separate, clear and affirmative action in accordance with Section 5.

2. Definitions

In this Policy, unless the context otherwise requires:

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
• "Data Principal" means the individual to whom the Personal Data relates and, where such individual is a child or a person with a disability, includes their parent or lawful guardian, as applicable.
• "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing Personal Data.
• "Data Processor" means any person who processes Personal Data on behalf of a Data Fiduciary.
• "Processing" means a wholly or partly automated operation or set of operations performed on digital Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.
• "Consent Manager" means a person registered with the Data Protection Board of India who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw consent.
• "Personal Data Breach" means any unauthorised processing of Personal Data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to Personal Data that compromises its confidentiality, integrity or availability.
• "Board" means the Data Protection Board of India established under the DPDP Act.

Capitalised terms not defined in this Policy shall have the meanings given to them under Applicable Law.

3. Role of the Company

3.1 In respect of Personal Data processed for the Purposes of Interaction described in Section 1.3, the Company acts as a Data Fiduciary.

3.2 In respect of Personal Data processed on behalf of clients, the Company acts as a Data Processor and processes such data only in accordance with the client's documented instructions and the terms of the applicable agreement.

4. Categories of Personal Data collected

4.1 Data provided by you. Depending on your interaction with us, we may collect:

• Identity and contact data — name, designation, organisation, email address, telephone and mobile number, postal address.
• Enquiry and engagement data — information about your business, project requirements, budgets, briefs and communications with us.
• Commercial and financial data — billing name and address, GSTIN, PAN, bank account details for payments or refunds, invoices and transaction records. We do not store full payment card details.
• Recruitment data — curriculum vitae, portfolio, educational and professional history, references, current and expected compensation, notice period, interview notes and assessment results.
• Vendor data — business registration details, PAN, GSTIN, bank details, contact persons and contractual information.
• Marketing preferences — your preferences regarding receipt of communications from us.
• Image and voice data — photographs, video and audio recordings where you participate in events, shoots or recorded calls, subject to notice and, where required, consent.

4.2 Data collected automatically. When you access the Website, we and our service providers may automatically collect technical data, including Internet Protocol (IP) address, browser type and version, device identifiers, operating system, time zone setting, referring URLs, pages viewed, click-stream data, session duration and approximate geolocation derived from IP address, through cookies, pixels, tags and similar technologies, as further described in our Cookie Policy.

4.3 Data obtained from third parties. We may receive Personal Data from advertising and social media platforms (including lead-generation forms), professional networking sites, recruitment portals and agencies, event organisers, business partners and persons who refer you to us, in each case subject to such third parties having the right to share such data.

4.4 No intentional collection of sensitive data. We do not intentionally collect sensitive categories of Personal Data such as health data, biometric data, sexual orientation, religious beliefs, caste, or financial account passwords through the Website. Please do not submit such data unless specifically requested for a lawful purpose.

5. Lawful basis for processing

5.1 Consent. We process Personal Data on the basis of your free, specific, informed, unconditional and unambiguous consent, signified by a clear affirmative action, for the specified purposes set out in Section 6. Each request for consent shall be accompanied by or reference a notice describing the Personal Data and the purposes of processing, the manner in which you may exercise your rights and the manner in which you may make a complaint to the Board.

5.2 Legitimate uses. We may also process Personal Data without consent for certain legitimate uses permitted under Section 7 of the DPDP Act, including where you have voluntarily provided Personal Data for a specified purpose and have not indicated that you do not consent to its use; for compliance with any law, judgment or order; for responding to medical emergencies; and for purposes of employment or safeguarding the Company from loss or liability, as permitted by Applicable Law.

5.3 Withdrawal of consent. You may withdraw consent at any time, with the same ease as it was given, by writing to the Grievance Officer at the address in Section 15 or by using the unsubscribe or withdrawal mechanism provided in our communications or on the Website. Withdrawal shall not affect the lawfulness of processing carried out before withdrawal. On withdrawal, we shall, within a reasonable time, cease and cause our Data Processors to cease processing the relevant Personal Data, unless its retention is required or authorised under Applicable Law. Withdrawal of consent may result in our inability to provide services or consider an application, and you shall bear the consequences of such withdrawal.

5.4 Consent Managers. Where Consent Managers are operational under Applicable Law, you may give, manage, review or withdraw your consent through a registered Consent Manager.

6. Purposes of processing

We process Personal Data only for the following specified purposes and for purposes reasonably incidental thereto:

(a) responding to enquiries and requests, and communicating with you;

(b) preparing proposals, entering into and performing contracts, and managing client and vendor relationships;

(c) invoicing, collection of payments, accounting, tax compliance and audit;

(d) evaluating applications for employment, internship or engagement, conducting interviews and background verification where permitted, and making offers;

(e) sending newsletters, event invitations and marketing communications where you have consented;

(f) operating, maintaining, securing and improving the Website and analysing its usage;

(g) measuring and improving the effectiveness of the Company's own advertising;

(h) preventing, detecting and investigating fraud, security incidents, misuse or unlawful activity;

(i) establishing, exercising or defending legal claims; and

(j) complying with Applicable Law, regulatory requirements and lawful requests of governmental authorities.

We shall not process Personal Data for any purpose incompatible with the purposes stated above without providing fresh notice and, where required, obtaining fresh consent.

7. Accuracy and minimisation

7.1 We collect only such Personal Data as is necessary for the specified purpose.

7.2 Where Personal Data is likely to be used to make a decision affecting you or disclosed to another Data Fiduciary, we shall make reasonable efforts to ensure its completeness, accuracy and consistency. You are responsible for ensuring that the Personal Data you provide is accurate, complete and not misleading, and for informing us of changes. You shall not furnish false particulars, suppress material information or impersonate another person.

8. Disclosure of Personal Data

8.1 We do not sell, rent or trade Personal Data. We may disclose Personal Data, strictly on a need-to-know basis and subject to appropriate contractual safeguards, to:

(a) Data Processors and service providers engaged by us for website hosting, cloud storage, email, customer relationship management, analytics, communication, accounting, payroll, recruitment, IT support and security, who are contractually bound to process Personal Data only on our instructions and to implement reasonable security safeguards;

(b) Advertising and analytics partners, including Google and Meta, in connection with the measurement and optimisation of our own marketing, as described in the Cookie Policy;

(c) Professional advisers, including legal counsel, chartered accountants, auditors and insurers, who are bound by duties of confidentiality;

(d) Group entities, affiliates or successors, in connection with any merger, amalgamation, restructuring, acquisition, joint venture or transfer of all or part of our business, subject to the recipient being bound by obligations no less protective than this Policy; and

(e) Governmental, statutory, regulatory, judicial or law enforcement authorities, where required under Applicable Law, or pursuant to a court order, summons or other legal process, or where necessary to protect the rights, property or safety of the Company, its personnel or others.

8.2 Any Data Processor engaged by the Company shall be engaged only under a valid contract and shall be required to process Personal Data in accordance with Applicable Law.

9. Cross-border transfer

9.1 Personal Data may be stored or processed on servers located outside India by our service providers. Any such transfer shall be made only to countries or territories not restricted by the Central Government under Section 16 of the DPDP Act and in accordance with any conditions prescribed under Applicable Law.

9.2 We take reasonable steps, including contractual safeguards, to ensure that Personal Data transferred outside India continues to be protected in a manner consistent with this Policy.

10. Retention

10.1 We retain Personal Data only for as long as necessary to fulfil the specified purpose for which it was collected, or for such longer period as is required or permitted under Applicable Law, including for tax, accounting, audit, litigation and regulatory purposes.

10.2 Without prejudice to Section 10.1, we generally apply the following retention periods:

10.3 Where the specified purpose is no longer being served, or where you withdraw consent, and retention is not required under Applicable Law, we shall erase the Personal Data and cause our Data Processors to erase it. Where required under Applicable Law, we shall notify you before such erasure. Personal Data may be retained in anonymised form that no longer identifies you.

11. Security safeguards

11.1 We implement reasonable security safeguards, including appropriate technical and organisational measures, to protect Personal Data in our possession or under our control against Personal Data Breach. These measures include, as appropriate, encryption of data in transit, access controls based on role and need-to-know, password and multi-factor authentication policies, logging and monitoring of access, regular back-ups, secure disposal practices, confidentiality undertakings from personnel and contractual obligations on Data Processors.

11.2 Notwithstanding the foregoing, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect Personal Data, we cannot guarantee absolute security, and any transmission of Personal Data is at your own risk, subject to our obligations under Applicable Law.

12. Personal Data Breach

In the event of a Personal Data Breach, the Company shall take prompt remedial action and shall intimate the Board and each affected Data Principal in the form and manner and within the time prescribed under Applicable Law, including a description of the breach, its likely consequences, the measures taken to mitigate risk and the safety measures that the Data Principal may take.

13. Rights of Data Principals

13.1 Subject to Applicable Law, you have the following rights in relation to Personal Data processed by the Company as Data Fiduciary on the basis of consent or voluntary provision:

(a) Right to access information — to obtain a summary of the Personal Data being processed and the processing activities undertaken, the identities of other Data Fiduciaries and Data Processors with whom it has been shared together with a description of the data shared, and any other information prescribed;

(b) Right to correction, completion and updating — to have inaccurate or misleading Personal Data corrected, incomplete Personal Data completed and Personal Data updated;

(c) Right to erasure — to have Personal Data erased, unless retention is necessary for the specified purpose or for compliance with Applicable Law;

(d) Right of grievance redressal — to have readily available means of grievance redressal in respect of any act or omission of the Company regarding its obligations;

(e) Right to nominate — to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights in accordance with Applicable Law; and

(f) Right to withdraw consent — as set out in Section 5.3.

13.2 Requests may be made by writing to the Grievance Officer at the details set out in Section 15. We may require you to provide information reasonably necessary to verify your identity before acting on a request. We shall respond within the period prescribed under Applicable Law.

13.3 Duties of Data Principals. In exercising your rights, you shall comply with Applicable Law and shall not (a) impersonate another person; (b) suppress material information while providing Personal Data; (c) register a false or frivolous grievance or complaint; or (d) furnish any information other than information that is verifiably authentic when exercising the right to correction or erasure.

14. Children and persons with disability

14.1 The Website and our services are not directed at individuals below the age of eighteen (18) years. We do not knowingly process Personal Data of children without verifiable consent of a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

14.2 If we become aware that we have collected Personal Data of a child without verifiable parental consent, we shall delete such data promptly. If you believe that a child has provided Personal Data to us, please contact the Grievance Officer.

14.3 Where Personal Data relates to a person with a disability who has a lawful guardian, we shall process such data only with the verifiable consent of such guardian, in accordance with Applicable Law.

15. Grievance Officer and contact details

15.1 In accordance with Applicable Law, the Company has designated the following person to address any questions, requests or grievances regarding the processing of Personal Data:

• Name: Sahil Patil
• Designation: COO
• Email: contact@nebulabrandlabs.com
• Postal address: Lasyaa Brand Studios LLP, 1605, D-Wing, Hubtown Greenwoods, Pokhran Road, Thane West, Thane, Maharashtra 400602, India
• Telephone: +91 81696 68724
• Working hours: Monday to Friday, 9:00 a.m. to 6:00 p.m. IST, excluding public holidays

15.2 We shall acknowledge grievances within forty-eight (48) hours and endeavour to resolve them within the period prescribed under Applicable Law.

15.3 You must first exhaust the grievance redressal mechanism provided by the Company before approaching the Board. If you are not satisfied with our resolution, you may file a complaint with the Data Protection Board of India in the manner prescribed under the DPDP Act.

16. Third-party websites and services

The Website may contain links to, or integrations with, third-party websites, platforms and services, including social media platforms and client websites. We are not responsible for the privacy practices, content or security of such third parties. Your use of such websites and services is governed by their respective terms and privacy policies.

17. Limitation of liability

To the maximum extent permitted by Applicable Law, the Company shall not be liable for any loss or damage arising from (a) any unauthorised access to Personal Data resulting from causes beyond the Company's reasonable control, including acts of third parties, force majeure events or failure of telecommunication networks; (b) your failure to safeguard your own credentials or devices; or (c) the acts or omissions of third-party websites or platforms. Nothing in this Section limits any liability that cannot be excluded under Applicable Law.

18. Amendments

We may amend this Policy from time to time to reflect changes in Applicable Law, our processing activities or technology. The revised Policy shall be effective from the date of its publication on the Website, as indicated by the "Last updated" date. Where changes materially affect the processing of Personal Data based on your consent, we shall provide notice and, where required, seek fresh consent. Your continued use of the Website after the effective date constitutes acknowledgement of the revised Policy, to the extent permitted by law.

19. Governing law and jurisdiction

This Policy shall be governed by and construed in accordance with the laws of India. Subject to the statutory jurisdiction of the Board and the dispute resolution provisions of our Terms & Conditions, the courts at Mumbai, Maharashtra shall have exclusive jurisdiction over any matter arising out of or in connection with this Policy.

20. Language and interpretation

This Policy is drafted in English. In the event of any translation, the English version shall prevail. Headings are for convenience only and shall not affect interpretation. Words importing the singular include the plural and vice versa, and "including" shall be read as "including without limitation".