Privacy Policy

This Privacy Policy applies to all Users of the Cermora platform — including Customers who browse and book Event Services, Vendors who list their services, and visitors who access the website without registering. It governs the collection and processing of personal data through:

• The Cermora website (www.cermora.com)
• Twilio SMS service

This Policy is published in compliance with:

• Section 43A of the Information Technology Act, 2000
• The IT (SPDI) Rules, 2011
• The Consumer Protection (E-Commerce) Rules, 2020
• Applicable provisions of the DPDPA, 2023 as notified

2.1 Data Provided by You

2.2 Data Collected Automatically

• Location data: Approximate or precise location (with your consent) for venue proximity search.
• Log data: IP address, timestamps, referring URLs, error logs.
• Cookies & tracking: session and persistent cookies.

2.3 Data from Third Parties

• Social login: Name, email, profile picture from Google, Facebook, or Apple.
• Payment gateway: Transaction status, reference numbers, fraud risk scores.
• Insurance partners: Application status, policy reference numbers (IRDAI-licensed).
• EMI partners: Loan application status and reference numbers (NBFC/Bank).

4.1 With Vendors

When a booking is made, we share name, contact number, and event details with the relevant Vendor to enable service delivery. Vendors are contractually restricted from using Customer data for independent marketing.

4.2 With Customers (Vendor Data)

Vendor business name, photos, service descriptions, pricing, and ratings are publicly displayed. Personal contact details (personal mobile, home address) are never publicly shown.

4.3 With Service Providers and Partners

4.4 Legal and Regulatory Disclosure

We may disclose personal data to law enforcement, government authorities, tax authorities (GSTN, Income Tax Dept), or courts when required by law. We will make reasonable efforts to notify you unless legally prohibited.

4.5 Business Transfers

In the event of a merger, acquisition, or sale, personal data may be transferred to the acquiring entity. You will be notified before such transfer.

Under Rule 3 of the SPDI Rules, 2011, the following data categories are subject to heightened protection:

We retain personal data only as long as necessary to fulfil the purposes outlined in this Policy, or as required by law:

Subject to applicable law, you have the following rights:

8.1 Types of Cookies Used

8.2 Managing Cookies

• A cookie consent banner is displayed on your first visit.
• Change preferences anytime via Cookie Settings in the website footer.
• Disabling analytics / marketing cookies will not break core platform features.

ADDSUS Solutions LLP implements reasonable security practices under Rule 8 of the SPDI Rules, 2011.

9.1 Technical Measures

• SSL/TLS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• PCI-DSS compliant payment gateway (no full card storage)
• Multi-factor authentication for Vendor & admin access
• Regular penetration testing and security audits
• Intrusion detection and real-time monitoring

9.2 Organisational Measures

• Need-to-know access restrictions
• Confidentiality obligations for employees & contractors
• Data processing agreements with all third-party processors
• Documented incident response procedures

9.3 Data Breach Response

We will assess risk and notify affected individuals and the Data Protection Board of India under DPDPA, 2023 timelines.

• The Cermora Platform is not intended for individuals under 18.
• We do not knowingly collect personal data from minors. If discovered, such data will be promptly deleted.
• Parents / guardians may contact abc@cermora.com with concerns.

• The Platform contains links to third-party websites (insurance, NBFC, social media) for convenience only.
• Cermora is not responsible for the privacy practices of third-party sites — read their policies before sharing data.
• Integrations like Google Maps, Instagram feeds, and payment gateways are governed by their own privacy policies.

• Cermora primarily stores and processes data within India.
• Where processed outside India (e.g., cloud services), we ensure appropriate safeguards as required by law.
• We do not transfer SPDI to foreign entities except for payment processing or cloud infrastructure, with contractual protections.
• We will update practices as DPDPA cross-border rules are notified.

• We may update this Policy to reflect changes in practice, technology, or law.
• Material changes will be notified via email and/or a Platform notice at least 15 days before they take effect.
• The current version is always available at www.cermora.com/privacy.
• Continued use after the effective date constitutes acceptance.

For questions, concerns, requests, or complaints regarding this Privacy Policy: