Platform Privacy Policy

Introduction and Scope

CE Serviced Offices Private Limited (“CorporatEdge”, “Company”, “we”, “us”, “our”) is a Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and is committed to processing personal data lawfully, fairly, and transparently. This Policy explains how we collect, use, store, share, and protect the personal data of individuals who create an account on, sign in to, or use the CorporatEdge mobile application and the CorporatEdge member web platform (together, the “Platform”) — including members, their nominated guests and attendees, and authorised users of client organisations (“Data Principals”, “you”). This Policy supplements our website privacy policy; where a matter is addressed by both, the provisions of this Policy govern in relation to your use of the Platform. This Policy does not apply to current or prospective employees of the Company, whose personal data is governed by a separate Employee Data Privacy Policy.

Personal Data We Collect

We collect the following categories of personal data:

• (a) Data you provide to create and manage your account and plan: your name, email address, phone number, business/organisation name, business address, plan tier, profile photograph (if you choose to add one), and preferences you set (including dietary preferences or restrictions you choose to record for refreshment orders, communication preferences, and interface preferences).
• (b) Data generated when you use the Platform: meeting-room and day-pass bookings, the centre, date, time, duration and attendees of a booking, meeting titles or agendas you enter, guests you invite, refreshment (food and beverage) orders, concierge or service requests, ratings and feedback you submit, invoices and transaction history, and records of notifications and communications sent to you.
• (c) Authentication data: credentials used to sign you in. Authentication is provided through Google Firebase Authentication and, where you choose them, third-party sign-in with Google or Apple, phone one-time passwords (OTP), and email. Where you use device biometrics (such as Face ID) to sign in, the biometric data is processed by your device and is not transmitted to or stored by us.
• (d) Payment and financial data: to take payment for chargeable services (such as guest bookings, day passes, overages, or refreshments) we use the payment gateway Razorpay. Card and bank details are collected and processed by Razorpay under its own terms; we receive transaction identifiers, payment status, and the information required to raise a valid tax invoice (including applicable GST details). We do not store full card numbers.
• (e) Calendar data (only if you connect a calendar): if you connect your Google or Microsoft (Outlook) calendar, we access the calendar information necessary to create, read, update, or attach room bookings to your events, and we store the authorization tokens for that connection. You may disconnect a connected calendar at any time.
• (f) Location data: the city and centre you select as your preferred location, and — only where you grant the relevant permission on your device — approximate location used to show you nearby centres. We do not track your continuous or background location.
• (g) Device and technical data: device and push-notification tokens (to deliver push notifications), device type and operating-system version, app version, IP address, and diagnostic and usage information used to operate, secure, and improve the Platform.
• (h) Background-verification data: where a service requires identity or background verification, the information you provide for that purpose and the result of the verification, processed through our verification service providers.

Where our data-collection needs change materially, we will notify you before collecting any additional categories of personal data.

How We Collect Your Data

We collect personal data (i) directly from you, when you create an account, complete your profile, make a booking or payment, or contact us; (ii) automatically, when you use the Platform (device, usage, and diagnostic data); and (iii) from third parties you authorise, such as your connected calendar provider or a sign-in provider (Google, Apple, or Microsoft).

Lawful Basis and Consent

We process your personal data only on the basis of your free, specific, informed, and unambiguous consent, or another lawful basis recognised under the DPDP Act — including where processing is necessary to provide a service you have requested (such as completing a booking or a payment) or for a legitimate use for which you have voluntarily provided your data. You may withdraw consent at any time by adjusting the relevant setting in the Platform (where available) or by writing to our Grievance Officer at the address in the Grievance Redressal section. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, and we will cease further processing and, where applicable, delete the corresponding data within a reasonable time, subject to any legal retention obligations.

Purposes of Use

We use personal data to: create and administer your account and plan; provide and manage bookings, day passes, refreshments, and concierge and other services you request; process payments and issue invoices and receipts; connect and synchronise your calendar where you enable it; send you service, transactional, and (where you have opted in) marketing communications by push notification, email, SMS, or WhatsApp; provide customer support and handle grievances; personalise and improve the Platform; ensure security, prevent fraud and misuse, and maintain audit and accounting records; and comply with applicable legal, tax, and regulatory obligations. Data collected for one purpose is used only for that purpose or a compatible purpose disclosed at the time of collection.

Device Permissions

The Platform may request the following permissions on your device; each is used only for the stated purpose, may be declined, and can be changed at any time in your device settings: Notifications (to send you booking, payment, and service updates); Calendar (only if you connect a calendar, to create and manage room bookings on your events); Location (only if enabled, to show nearby centres); and Camera / Photos (only if you choose to add a profile photograph or scan a code). Declining a permission may limit the related feature but does not otherwise prevent you from using the Platform.

Cookies, SDKs, and Similar Technologies

The member web platform uses strictly necessary cookies and local storage to keep you signed in and to remember your preferences. The mobile application uses software development kits (SDKs) from our service providers — including Google Firebase (authentication and push notifications) and, where enabled, product-analytics and error-monitoring tools — that process device and diagnostic data to operate, secure, and improve the Platform. This technical data is used to run and improve the service and is not used to identify you beyond what is necessary for those purposes.

Disclosure and Sharing of Personal Data

We do not sell personal data. We share personal data with the following categories of third parties, strictly on a need-to-know basis and only to enable them to perform services on our behalf, each bound by a written confidentiality and data-protection agreement consistent with this Policy:

• Authentication, cloud hosting, and storage providers — including Google Firebase and our cloud hosting and storage providers — to run and secure the Platform.
• Payment service providers — Razorpay — to process your payments and refunds.
• Communication providers — our email provider and our SMS and WhatsApp Business messaging providers — to deliver transactional and (where you opt in) marketing messages.
• Calendar providers — Google and Microsoft — only where you connect your calendar, to create and manage bookings on your events.
• Our and our group’s enterprise resource planning (ERP) systems — to record customers, bookings, invoices, and enquiries for service delivery, billing, and support.
• Identity and background-verification providers — where a service requires verification.
• Professional advisors, auditors, and regulators — where legally required.

Cross-Border Data Transfers

Some of our service providers (for example, Google Firebase) may store or process personal data on servers located outside India. Where personal data is transferred outside India, such transfer will be made only to jurisdictions permitted under the DPDP Act and applicable government notifications, and with appropriate safeguards in place.

Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required to comply with applicable legal, accounting, tax, or regulatory obligations, whichever is later. As a guide: account and profile data are retained while your account is active; booking, payment, and invoice records are retained for the period required by applicable tax and accounting law; and operational data such as notifications and diagnostic logs are retained for shorter periods. On expiry of the applicable retention period, or on deletion of your account, personal data will be securely deleted or anonymised, except where retention is mandated by law.

Data Security and Breach Notification

We implement reasonable technical and organisational safeguards — including access controls, encryption in transit, and audit logging — to protect personal data against unauthorised access, alteration, disclosure, or destruction. In the event of a personal data breach, we will notify the Data Protection Board of India and the affected Data Principals in the manner and within the timelines prescribed under the DPDP Act and its Rules. While we take reasonable security measures, no method of transmission or storage is entirely secure.

Children’s Data

The Platform is intended for use by individuals who are 18 years of age or older, in a professional capacity. We do not knowingly collect personal data of children. Where processing of a child’s personal data is required, we will obtain verifiable consent of a parent or lawful guardian in accordance with the DPDP Act. If you believe a child has provided us personal data, please contact our Grievance Officer so we may delete it.

Your Rights as a Data Principal

Subject to the DPDP Act, you have the right to: access a summary of the personal data we hold about you and the processing undertaken; request correction, completion, or updating of your personal data; request erasure of your personal data where retention is no longer necessary; withdraw consent at any time; and nominate another individual to exercise these rights on your behalf in the event of death or incapacity. Many of these actions can be taken directly in the Platform — you may edit your profile and preferences in your account settings, and you may delete your account from within the Platform, which initiates deletion of your personal data subject to the retention obligations described above. You may also submit a request in writing to our Grievance Officer. We may require you to verify your identity before actioning a request, for security purposes.

Google User Data and Limited Use

If you choose to connect your Google Calendar, the Platform requests your permission to access specific Google user data through Google’s OAuth consent screen. We request only the scopes needed to deliver the feature: “See, edit, share, and permanently delete all the calendars you can access using Google Calendar” (https://www.googleapis.com/auth/calendar.events), used solely to create, update, read back, and delete the calendar events that correspond to your CorporatEdge reservations; and your email address and basic profile identifier (https://www.googleapis.com/auth/userinfo.email and openid), used solely to identify which Google account you connected. We store the resulting authorization tokens, encrypted at rest, only for as long as the connection is active. Connecting a calendar is optional, and you may disconnect at any time in the Platform — which deletes the stored tokens — or revoke access directly at https://myaccount.google.com/permissions.

Retention and deletion of Google user data. We keep your Google authorization tokens only while your calendar connection is active. We also keep a synchronisation log of the calendar events we created or updated on your behalf, which we use to diagnose failed syncs; those entries are retained for a maximum of 12 months from the date of the sync and are then permanently deleted. You can delete your Google user data at any time in three ways: disconnect the calendar in the Platform, which immediately revokes our access with Google and erases the stored tokens; delete your CorporatEdge account, which revokes the grant with Google and permanently deletes the connection record and its tokens, with any remaining synchronisation log entries deleted within 30 days; or revoke access directly from your Google Account permissions page at https://myaccount.google.com/permissions. Calendar events already created in your own Google Calendar belong to you and are not removed when you disconnect — you can delete those in Google Calendar. If you cannot use the in-Platform options, write to our Grievance Officer (details in the Grievance Redressal section) and we will action the deletion.

How we protect Google user data. Google user data is held under the same controls we apply to all personal data on the Platform. In transit, all traffic between your device, the Platform, and Google's APIs is encrypted using TLS 1.2 or higher. At rest, it is stored in an encrypted PostgreSQL database hosted in the Amazon Web Services Asia Pacific (Mumbai) region in India; that database is not publicly accessible and can be reached only from our application servers inside a private network. Access is role-based and limited to the personnel who need it to operate the service, and the credentials used to reach Google's APIs are held in a managed secrets store rather than in application code or configuration files. Connecting and disconnecting a calendar is written to an audit log, so every change to a calendar connection is attributable. Consistent with the Limited Use commitments above, we do not read Google user data except where you have given affirmative consent, where it is necessary for security or to comply with law, or where the data has been aggregated and de-identified.

CorporatEdge’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically: we use Google user data only to provide and improve the user-facing calendar features described above; we do not transfer Google user data except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with your prior notice and consent; we do not use Google user data for serving advertisements; we do not use Google user data to develop, improve, or train generalised or non-personalised artificial-intelligence or machine-learning models; and we do not allow humans to read Google user data unless we have your affirmative consent for specific messages, it is necessary for security purposes (such as investigating abuse) or to comply with applicable law, or the data has been aggregated and de-identified.

Third-Party Services and Links

The Platform integrates with, and may link to, third-party services (such as Google, Apple, Microsoft, and Razorpay). Your use of those services is governed by their own privacy policies, and we are not responsible for their practices. We encourage you to review them.

Grievance Redressal

For any concerns, complaints, or grievances relating to your personal data, please contact our Grievance Officer: Ms. Shazia Fatima — shazia@thecorporatedge.com. We will acknowledge your grievance promptly and endeavour to resolve it within thirty (30) days of receipt, in line with the timelines prescribed under the DPDP Act and its Rules.

Changes to this Policy

We may update this Policy from time to time to reflect changes in law or our practices. Material changes affecting how your personal data is processed will be notified to you through the Platform or by direct communication, as appropriate, before such changes take effect. Continued use of the Platform after such notice constitutes acceptance of the updated Policy.

Governing Law

This Policy shall be governed by the laws of India, including the Digital Personal Data Protection Act, 2023 and rules made thereunder.