Privacy Policy

1. INTRODUCTION AND SCOPE
Studio Black Canvas (“the Company,” “we,” “us,” or “our”) operates as a Data Fiduciary under Indian law and a Data Controller under international law. This Privacy Policy governs the collection, processing, storage, and transfer of “Personal Data” and “Sensitive Personal Data” of users (“Data Principals” or “Data Subjects”) who visit our website or purchase our customized lighting products.

By using our services, you acknowledge that you have read and understood this policy. If you do not agree, please refrain from using the Site.

2. THE DATA WE COLLECT
We collect data through direct interaction (orders), automated technologies (cookies), and occasionally third parties.

A. Information Provided by You
Identity Data: Full name, username, and title.

Contact Data: Billing address, shipping address, email address, and telephone numbers.

Customization Assets: High-resolution photographs, vectors, text, or design files uploaded for lamp customization.

Financial Data: Payment card details and bank account information (processed via encrypted third-party gateways; we do not store raw PCI-DSS data).

B. Automated Data Collection
Technical Data: Internet Protocol (IP) address, login data, browser type/version, time zone setting, operating system, and platform.

Usage Data: Information about how you use our website, products, and services (e.g., clickstream to, through, and from our site).

C. Sensitive Personal Data
For certain customizations (e.g., memorial lamps), you may upload images that reveal religious beliefs, health status, or ethnic origin. By uploading such content, you provide explicit consent for us to process this data solely for manufacturing purposes.

3. LEGAL BASIS FOR PROCESSING
Under global laws, we only process data when we have a “Lawful Basis”:

Performance of Contract: To manufacture and deliver the lamp you ordered.

Consent: For marketing communications or processing sensitive imagery.

Legitimate Interests: For fraud prevention, network security, and website optimization.

Legal Obligation: For tax reporting and compliance with government warrants.

4. DATA LOCALIZATION AND CROSS-BORDER TRANSFERS
For Indian Users: In compliance with the DPDPA, your personal data is stored on secure servers located within India.

International Transfers: If we transfer data outside your country of residence (e.g., to a global cloud provider like AWS or Google Cloud), we ensure “Adequacy Decisions” or “Standard Contractual Clauses” (SCCs) are in place to provide an equivalent level of protection.

5. DISCLOSURE TO THIRD PARTIES
We do not sell, trade, or rent your personal data. We disclose data only to:

Logistic Partners: To fulfill delivery (e.g., BlueDart, Delhivery, FedEx).

Payment Gateways: To process transactions (e.g., Razorpay, Stripe).

Professional Advisors: Auditors, lawyers, and insurers.

Law Enforcement: When required by the Information Technology Act, 2000, or the DPDPA.

6. DATA RETENTION & THE “RIGHT TO BE FORGOTTEN”
Transaction Records: Retained for 8 years to comply with statutory tax and audit requirements in India.

Customization Media: Uploaded photos/designs are purged from our production servers 120 days after successful delivery, unless you opt to save them in a personal account gallery.

Marketing Data: Retained until you withdraw consent.

7. GLOBAL USER RIGHTS
A. India (DPDPA Rights)
Right to Correction/Erasure: Request update or deletion of data.

Right of Grievance Redressal: Access to our Grievance Officer.

Right to Nominate: Designate a person to manage your data in case of death/incapacity.

B. European Union (GDPR Rights)
Right to Portability: Request a copy of your data in a structured CSV format.

Right to Object: Object to automated decision-making or profiling.

C. California, USA (CCPA/CPRA Rights)
Right to Know: Request a report on what categories of data we collect.

Opt-Out: Studio Black Canvas does not sell data; however, you may opt-out of “sharing” for cross-contextual advertising.

8. COOKIES AND TRACKING TECHNOLOGIES
We use “strictly necessary” cookies for the shopping cart and “analytical” cookies for site performance. You may manage your preferences via our Cookie Consent Banner. We honor Global Privacy Control (GPC) signals.

9. SECURITY MEASURES
We employ a multi-layered security approach:

Encryption: All data in transit is encrypted via SSL/TLS 1.3.

Access Control: Access to customization files is restricted to authorized production staff on a “need-to-know” basis.

Anonymization: Technical data is anonymized where possible for analytical purposes.

10. PROTECTION OF MINORS
Our website is not intended for children under 18. Per India’s DPDPA, we do not track the behavior of children or process their data without verifiable parental consent.

11. GRIEVANCE REDRESSAL & CONTACT
In compliance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules and the DPDPA, we have appointed a Grievance Officer.

Attn: Grievance Officer, Studio Black Canvas
Email: contact@blackcanvas.com
Physical Address: BlackCanvas Studio, 925, Clover Hills Plaza, NIBM Undri Road, Mohammed Wadi, Pune, Maharashtra 411048
Timeline: We will acknowledge your grievance within 24 hours and resolve it within 15 to 30 days.

12. AMENDMENTS
We may update this policy periodically to reflect changes in law or our manufacturing processes. Material changes will be notified via a prominent banner on our homepage or via email.