Privacy Policy

1. PRIVACY POLICY

Last Updated: 15th July 2026

This Privacy Policy is issued by QBR India Pvt Ltd ("Corumm", "Company", "we", "our", "us") in compliance with applicable Indian laws, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (DPDP Act). Your trust is paramount to us, and this policy details how we handle your personal information.

1. Scope

This Policy applies to all users accessing Corumm’s mobile applications, website, physical studios, and services.

2. Categories of Personal Data

2.1 Personal Identification Data

Name, phone number, email address, age, gender, location.

2.2 Financial Data

Payment instrument details processed via secure third-party gateways. Corumm does not store full card details.

2.3 Sensitive Personal Data

• Mental wellbeing inputs
• Emotional state reflections
• Session participation and behavioural patterns

This category of data is processed strictly with your explicit consent, primarily to tailor your wellbeing journey and ensure a safe, supportive environment within our studio.

2.4 Technical Data

IP address, device type, browser type, session logs.

2.5 Location Data

Approximate location (if enabled).

3. Lawful Basis of Processing

We process data based on:

• Explicit consent (primary basis)
• Contractual necessity
• Legal obligations

4. Purpose Limitation

Your data is used strictly for:

• Service delivery and personalisation
• Safety and experience enhancement
• Communication and support
• Payment processing

We do not process data for profiling or automated decision-making that has legal consequences.

5. Consent Framework

By using Corumm, you:

• Provide free, informed, specific, and unambiguous consent
• May withdraw consent at any time

Withdrawal may impact your ability to use certain services.

6. Data Sharing

We share data only with:

• Payment processors
• Technology vendors
• Facilitators (e.g., guest speakers for thematic talks, external workshop leaders, strictly on a need-to-know basis for service delivery)
• Government authorities (if legally required)

There is no sale or commercial exploitation of your personal data.

7. Cross-Border Transfers

If data is transferred outside India, it will be done in compliance with applicable law and with adequate safeguards.

8. Data Retention

Data is retained only as long as necessary for service delivery and legal compliance.

9. Data Security Measures

• Encryption (in transit and at rest where applicable)
• Role-based access control
• Periodic audits

10. User Rights

Under applicable law, you may:

• Access your data
• Correct inaccuracies
• Request erasure
• Withdraw consent
• File grievance

11. Grievance Officer

As per IT Act requirements:

12. Children’s Data

No intentional collection from minors without parental consent.

13. Updates

This Policy may change periodically. We will update it on our website/Mobile Application as and when required.