Privacy Policy
House of Arts (“we”, “our”, “us”) is a sole proprietorship operated by Aditya Kumar from #915, TDI City, Sector 117, Mohali, Punjab 160055, India. We sell original artwork, signed prints and photography, and provide commission, rental and consultation services through hoagallery.in.
This policy explains what personal data we collect, why, how long we keep it, and what rights you have. It applies to this website, our WhatsApp and email correspondence, and any transaction you enter into with us.
1. The law that applies
We are based in India and comply with:
- The Digital Personal Data Protection Act, 2023 (DPDP Act) and rules made under it
- The Information Technology Act, 2000 and the SPDI Rules, 2011
- The Consumer Protection (E-Commerce) Rules, 2020
Where you are in the European Economic Area or the United Kingdom, we also comply with the GDPR and UK GDPR in respect of your data. Where you are a resident of California, the CCPA/CPRA rights in section 10(c) apply.
Under the DPDP Act we are a Data Fiduciary; you are a Data Principal.
2. What we collect
a. Information you give us
| Data | When |
|---|---|
| Name, email, phone number | Orders, enquiries, commissions, newsletter |
| Shipping and billing address | Orders and rentals |
| Company name and GSTIN | Business and corporate orders |
| Reference photographs, briefs, room measurements | Commissions and site visits |
| Correspondence, including WhatsApp messages | Any enquiry |
| Payment reference or UPI transaction ID | Order confirmation |
b. Information collected automatically
IP address, approximate location, browser and device type, pages viewed, time on page, referring site, and cookie identifiers — through Google Analytics and Google Tag Manager.
c. What we never collect or store
We do not store your card numbers, UPI PIN, bank account numbers or CVV. Card payments, if offered, are handled entirely by the payment gateway. For UPI payments made directly to the artist, we see only the sender name and transaction reference shown by the banking system.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) | Basis (DPDP Act) |
|---|---|---|
| Fulfilling orders, rentals, commissions | Performance of a contract | Consent / legitimate use |
| Delivery and installation | Performance of a contract | Consent |
| Responding to enquiries | Legitimate interests | Consent |
| Invoicing, GST, tax records | Legal obligation | Legal obligation |
| Newsletter and promotional messages | Consent | Consent |
| Website analytics and improvement | Legitimate interests / consent for cookies | Consent |
| Preventing fraud and resolving disputes | Legitimate interests | Legitimate use |
We do not sell your personal data, and we do not use it for automated decision-making or profiling.
4. Consent, and how to withdraw it
Where we rely on consent, you gave it when you placed an order, subscribed, or sent us an enquiry. You may withdraw consent at any time, with the same ease with which it was given, by emailing order@hoagallery.in or messaging +91 85660 15214.
Withdrawing consent does not affect processing already carried out, and we may still need to keep records required by tax law.
5. Who we share it with
We share the minimum necessary with:
- Payment processors — Razorpay, or your UPI provider
- Couriers and logistics partners — for delivery, who receive your name, address and phone number only
- Hosting and website services — our web host, and WordPress/FluentCart plugin providers
- Google — Analytics and Tag Manager
- Email and messaging — our newsletter provider and WhatsApp
- Professional advisers — our accountant, for invoicing and tax filing
- Authorities — where required by law, a court order, or to establish or defend a legal claim
We do not sell, rent or trade your personal data to anyone, for any purpose.
6. International transfers
Some of our service providers store data outside India, including in the United States and the EEA. Where we transfer personal data from the EEA or UK, we rely on Standard Contractual Clauses or an adequacy decision. Transfers out of India are made only to countries not restricted by the Central Government under section 16 of the DPDP Act.
7. Cookies and analytics
- Strictly necessary cookies — cart, checkout, login, security. These cannot be switched off.
- Analytics cookies — Google Analytics, to understand how the site is used.
If you visit from the EEA or UK you will be asked for consent before any non-essential cookie is set. You can clear or block cookies through your browser at any time; the cart and checkout may not work if you block essential cookies.
We do not run advertising or retargeting cookies.
8. How long we keep it
| Record | Retention |
|---|---|
| Orders, invoices, GST records | 8 years (tax law) |
| Rental agreements | Term of agreement + 3 years |
| Commission briefs and reference images | 3 years after delivery, unless you ask sooner |
| Enquiries that do not become orders | 12 months |
| Newsletter subscribers | Until you unsubscribe |
| Website analytics | 14 months |
After these periods, data is deleted or irreversibly anonymised.
9. Security
We hold your data on secured servers with TLS encryption in transit, restricted access on a need-to-know basis, and regular software updates and backups. Payment data never touches our servers.
No system is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as required under the DPDP Act, and the relevant supervisory authority within 72 hours where the GDPR applies.
10. Your rights
a. If you are in India (DPDP Act, 2023)
- Access — a summary of the data we hold about you and who we have shared it with
- Correction, completion and updating of inaccurate data
- Erasure of data no longer needed for the purpose it was collected
- Grievance redressal — see section 11
- Nomination — nominate someone to exercise your rights in the event of death or incapacity
We will respond within 30 days.
b. If you are in the EEA or UK (GDPR)
Access · rectification · erasure · restriction of processing · data portability · objection to processing based on legitimate interests · withdrawal of consent. We respond within one month. You may also complain to your national supervisory authority, or to the Information Commissioner’s Office in the UK.
c. If you are in California (CCPA/CPRA)
Right to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information, so no opt-out is required. We will not discriminate against you for exercising these rights.
To exercise any right, email order@hoagallery.in with the subject line Data Request. We may ask for proof of identity before acting.
11. Grievance Officer
In accordance with the DPDP Act, the IT Act, and the Consumer Protection (E-Commerce) Rules, 2020:
Grievance Officer: Aditya Kumar
Email: order@hoagallery.in
Phone: +91 85660 15214
Address: #915, TDI City, Sector 117, Mohali, Punjab 160055
Hours: Monday to Saturday, 10am – 6pm IST
We acknowledge complaints within 48 hours and resolve them within one month.
If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
12. Children
Our services are intended for adults. Under the DPDP Act, a child in India is anyone under 18 years of age.
We do not knowingly collect personal data from children without verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural advertising or targeted marketing directed at children.
If you believe a child has provided us with personal data, contact us and we will delete it promptly.
13. Marketing
We send newsletters only to people who have opted in. Every email carries an unsubscribe link, and WhatsApp messages stop on request. We do not share your details with other marketers.
14. Third-party links
Our site links to third-party websites and social platforms. We are not responsible for their privacy practices. Please read their policies separately.
15. Changes
We may update this policy. Material changes will be notified by email to customers and subscribers, and the revised date will appear at the top of this page.
16. Contact
House of Arts — Aditya Kumar
Email: order@hoagallery.in
Phone: +91 85660 15214
Address: #915, TDI City, Sector 117, Mohali, Punjab 160055, India