Privacy Policy

Effective date: 20 August 2026 · Last updated: 8 October 2026

House of Arts (“we”, “our”, “us”) is a sole proprietorship operated by Aditya Kumar from #915, TDI City, Sector 117, Mohali, Punjab 160055, India. We sell original artwork, signed prints and photography, offer commissions, art rental and advisory, and run a platform where approved artists and curators publish their own profiles, artwork, events and programmes.

This policy explains what personal data we collect, why we collect it, who sees it, how long we keep it and what you can ask us to do with it. It covers hoagallery.in, your account and dashboard, our Help Center, and our email and WhatsApp correspondence.

1. The law that applies

We are based in India and comply with:

• the Digital Personal Data Protection Act, 2023 (DPDP Act) and rules made under it;
• the Information Technology Act, 2000 and the SPDI Rules, 2011;
• the Consumer Protection (E-Commerce) Rules, 2020.

If you are in the European Economic Area or the United Kingdom, we also comply with the GDPR and UK GDPR in respect of your data. If you are a resident of California, the rights in section 13(c) apply.

Under the DPDP Act we are a Data Fiduciary and you are a Data Principal.

2. Your role on the platform

One login can hold more than one role, and what we collect depends on which you use. Adding a role never removes another: an artist can still shop as a customer.

3. What we collect

a. Information you give us

b. Information we record as you use the site

• Activity log. Actions taken on your account — an application sent, a listing published, a profile edited — with the time and the IP address they came from. This is how we investigate disputes and misuse, and you can see your own log in your dashboard.
• Notifications. A record of what we have told you and whether it has been read.
• Spam protection. A short-lived, one-way hash of your IP address used to limit how often a form can be sent. It is not readable as an address and expires within the hour.
• Article feedback. Whether a Help Center article was marked helpful. We record that a vote happened, not who voted.
• Analytics. IP address, approximate location, browser and device type, pages viewed, time on page, referring site and cookie identifiers, through Google Analytics and Google Tag Manager.

c. What we never collect or store

We do not store card numbers, UPI PINs, bank account numbers or CVVs. Card payments, where offered, are handled entirely by the payment gateway. For UPI payments we see only the sender name and the transaction reference shown by the banking system.

4. What is published publicly

Some of what artists and curators give us is meant to be seen. If you are approved as an artist or a curator, the following appears on your public profile and can be found by search engines:

• your name or firm name, logo or founder photograph, and biography;
• your city, website and social media links;
• the artwork, events and programmes you publish, including venues and dates.

A private event is not listed anywhere, is excluded from search engines, and opens only for someone holding its invitation link.

5. Why we use it, and our legal basis

We do not sell your personal data, and we do not use it for automated decision-making or profiling. Applications and listings are reviewed by a person.

6. Event and programme enquiries

When you press “I’m interested” on an event and fill in the form, you give your name, email, phone number, location and message.

• Those details go to the artist or curator hosting that event, so they can contact you. They are not shown to other members or to the public.
• House of Arts staff can see how many enquiries an event received, and the details only where needed to resolve a complaint or a misuse report.
• The host can export their own enquiry list for their records.

Event fees are collected by the host directly. House of Arts takes no event fee and is not a party to that payment, so we do not hold the payment details for it.

7. Consent, and how to withdraw it

Where we rely on consent, you gave it when you created an account, placed an order, subscribed, sent an enquiry or applied as an artist or curator. You may withdraw consent at any time, with the same ease with which it was given, by emailing order@hoagallery.in or messaging +91 85660 15214.

Withdrawing consent does not affect processing already carried out, and we may still need to keep records required by tax law or to complete an order, payout or dispute already under way.

8. Who we share it with

We share the minimum necessary with:

• The host of an event you enquired about — as described in section 6;
• Payment processors — Razorpay, or your UPI provider;
• Couriers and logistics partners — your name, address and phone number only;
• The artist shipping your order — your name, delivery address and phone number, so the work can reach you;
• Hosting and website services — our web host and the plugin providers that run the shop, accounts and Help Center;
• Google — Analytics, Tag Manager and Site Kit;
• Email and messaging — our newsletter provider and WhatsApp;
• Professional advisers — our accountant, for invoicing and tax filing;
• Authorities — where required by law, a court order, or to establish or defend a legal claim.

We do not sell, rent or trade your personal data to anyone, for any purpose.

9. International transfers

Some of our service providers store data outside India, including in the United States and the EEA. Where we transfer personal data from the EEA or UK, we rely on Standard Contractual Clauses or an adequacy decision. Transfers out of India are made only to countries not restricted by the Central Government under section 16 of the DPDP Act.

10. Cookies and analytics

• Strictly necessary cookies — cart, checkout, login and security. These cannot be switched off.
• Preference cookies — small choices your browser remembers, such as a tab you had open in your dashboard. They stay in your browser and we cannot read them back.
• Analytics cookies — Google Analytics, to understand how the site is used.

If you visit from the EEA or UK you will be asked for consent before any non-essential cookie is set. You can clear or block cookies in your browser at any time; the cart and checkout will not work if you block essential cookies.

We do not run advertising or retargeting cookies.

11. How long we keep it

After these periods, data is deleted or irreversibly anonymised.

12. Security

We hold your data on secured servers with TLS encryption in transit, access restricted on a need-to-know basis, and regular software updates and backups. Passwords are stored only as encrypted hashes, never as text. Changing your login email or password requires your current password, and repeated wrong attempts are temporarily locked out.

Files you attach to a support ticket are stored outside the public media library under unguessable names and are served only to you and to our staff.

Payment data never touches our servers.

No system is completely secure. If a personal data breach occurs we will notify the Data Protection Board of India and the people affected as required under the DPDP Act, and the relevant supervisory authority within 72 hours where the GDPR applies.

13. Your rights

a. If you are in India (DPDP Act, 2023)

• Access — a summary of the data we hold about you and who we have shared it with;
• Correction, completion and updating of inaccurate data;
• Erasure of data no longer needed for the purpose it was collected;
• Grievance redressal — see section 15;
• Nomination — nominate someone to exercise your rights in the event of death or incapacity.

We respond within 30 days. Much of this you can do yourself at any time in your dashboard, under Account.

b. If you are in the EEA or UK (GDPR)

Access · rectification · erasure · restriction of processing · data portability · objection to processing based on legitimate interests · withdrawal of consent. We respond within one month. You may also complain to your national supervisory authority, or to the Information Commissioner’s Office in the UK.

c. If you are in California (CCPA/CPRA)

Right to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information, so no opt-out is required. We will not discriminate against you for exercising these rights.

To exercise any right, email order@hoagallery.in with the subject line Data Request. We may ask for proof of identity before acting.

14. Closing your account

Both are in the Account tab of your dashboard and ask for your password first. If your login is also an artist account, write to order@hoagallery.in and we will handle the deletion for you. Closing an account does not cancel a sale in progress or a payout you are owed; those are settled first.

15. Grievance Officer

In accordance with the DPDP Act, the IT Act, and the Consumer Protection (E-Commerce) Rules, 2020:

We acknowledge complaints within 48 hours and resolve them within one month. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

16. Children

Our services are intended for adults. Under the DPDP Act, a child in India is anyone under 18 years of age.

You must be 18 or over to hold an account, to sell as an artist, or to curate and host events. We do not knowingly collect personal data from children without verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural advertising or targeted marketing directed at children.

Where a workshop or programme is open to children, the host is responsible for obtaining parental consent and for any details collected at the event itself.

If you believe a child has provided us with personal data, contact us and we will delete it promptly.

17. Marketing

We send newsletters only to people who have opted in. Every email carries an unsubscribe link, and WhatsApp messages stop on request. Service messages — an order update, an application decision, a renewal reminder, a reply to your ticket — are not marketing and are sent for as long as you hold an account.

We do not share your details with other marketers.

18. Third-party links

Our site links to third-party websites, social platforms and the websites of artists, curators and their sponsors. We are not responsible for their privacy practices. Please read their policies separately.

19. Changes

We may update this policy. Material changes will be notified by email to customers, members and subscribers, and the revised date will appear at the top of this page.

20. Contact