1. Data Controller & Studio Operation
This digital platform is owned and operated by the atelier of Sethu Eyyal ("Artist", "we", "us", or "our").
Legal Entity Name: [TO BE CONFIRMED: Registered Legal Entity / Proprietorship Name]
Studio Address: [TO BE CONFIRMED: Registered Studio Physical Address, Palakkad / Kochi, Kerala, India]
Official Contact Email: studio@sethueyyal.com / privacy@sethueyyal.com
Data Protection & Grievance Contact: [TO BE CONFIRMED: Designated Grievance Officer Name & Email]
2. Information We Collect
We adhere strictly to data minimisation and collect only information necessary to deliver fine artworks and services:
• Collector Account Data: Full name, email address, contact phone number, and securely hashed passwords (stored with high-cost salt encryption).
• Order & Shipping Information: Recipient name, domestic postal shipping address, transit contact phone number, order item snapshots, and delivery notes.
• Bespoke Commission Data: Project subject, medium preference, approximate dimensions, budget range, idea description, and customer-uploaded reference photographs.
• Communication & Enquiries: Messages, international shipping enquiries, and studio appointment requests submitted via contact forms.
• Technical & Security Logs: IP addresses, authentication timestamps, and session IDs strictly collected for anti-abuse, rate limiting, and fraud prevention.
3. Payment Information & PCI-DSS Compliance
The Sethu Eyyal platform DOES NOT collect, process, or store credit card numbers, debit card numbers, expiration dates, or CVV security codes.
All payment processing is executed through Razorpay, a PCI-DSS Level 1 certified payment gateway.
Our servers receive and verify only cryptographic HMAC-SHA256 signature hashes, transaction identifiers, and payment state confirmations.
4. Purpose of Information Processing
Your personal information is collected and processed exclusively for legitimate operational purposes:
• Processing, authenticating, and fulfilling fine artwork orders and shipments.
• Generating serialized, tamper-evident digital Certificates of Authenticity (COA).
• Evaluating, discussing, and executing custom commission artwork briefs.
• Responding to collector enquiries and coordinating international shipping quotes.
• Protecting the platform against automated scraping, credential stuffing, and brute-force attacks.
• Fulfilling legal, statutory accounting, and tax retention obligations under Indian law.
We do not engage in ad-tech tracking, data brokering, or selling customer lists to third parties.
5. Confidentiality of Commission Reference Photographs
Photographs, architectural sketches, and family portrait references uploaded by collectors for bespoke commissions are treated with the highest standard of confidentiality.
• Purpose Limitation: Reference photos are accessed solely by the artist to evaluate and execute the commissioned canvas.
• Non-Promotional Guarantee: We WILL NOT publish, exhibit, distribute, or share private reference photographs on social media, websites, or marketing portfolios without separate, explicit, affirmative written consent.
• Separate Consent: Promotional usage permission is strictly optional and never bundled with the privacy consent required to execute a commission.
6. Authorized Third-Party Service Providers
We share information only with trusted processors necessary to provide our services:
• Payment Processing: Razorpay (Razorpay Software Private Limited) for secure transactional settlements.
• Cloud Storage: Cloudinary / Secure Cloud Storage for hosting media and encrypted reference assets.
• Domestic Courier Logistics: BlueDart Express / authorized fine art transit partners for physical order delivery.
• Transactional Email: Authorized SMTP mail relays solely for sending order receipts, COA notices, and inquiry replies.
7. Data Retention & Anonymisation
• Order & Invoice Records: Retained in accordance with Indian statutory tax and accounting retention requirements [TO BE CONFIRMED: e.g. 7 years as per Companies/Income Tax Acts].
• Certificate of Authenticity (COA) Records: Retained permanently to safeguard collector provenance and artwork authenticity integrity.
• Commission Reference Materials: Retained during active artwork production and archived or purged upon completion, unless the collector requests earlier deletion.
• Contact Inquiries: Retained for up to [TO BE CONFIRMED: e.g. 180 days] following resolution of the inquiry.
8. Collector Privacy Rights & Account Deletion
Under applicable data protection laws (including the Digital Personal Data Protection Act, 2023), collectors have the right to:
• Access & Portability: Request a summary of personal information held in your collector profile.
• Rectification: Update or correct inaccurate account or delivery details via your Account Portal.
• Account Deletion / Anonymisation: Request deletion of your account profile. Where legal retention prevents total deletion of order financial history, your personal identifier details are anonymised.
To exercise these rights, submit a request through your Account Settings or email privacy@sethueyyal.com.