Privacy Policy & Data Protection Disclosure

1.1 Legislative Foundation: Faceons Internet Private Limited is committed to protecting the privacy and personal data of its users in strict accordance with applicable statutory mandates of the Republic of India, including but not limited to:

• Digital Personal Data Protection Act, 2023 (DPDPA) and rules promulgated thereunder;
• Information Technology Act, 2000 (Sections 43A, 72A, and Section 79 Intermediary Safe Harbor);
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• Consumer Protection (E-Commerce) Rules, 2020.

1.2 Designation as Data Fiduciary: Under the DPDPA, Faceons Internet Private Limited acts as a Data Fiduciary regarding the Personal Data collected directly to facilitate account management, booking processing, and platform maintenance on Jollyfer.com. Independent Third-Party Service Partners listed on the platform who receive Customer data solely for executing booked services act as independent processors or joint fiduciaries within their own operational scope.

The Company collects only such Personal Data as is strictly necessary, proportionate, and required for specified, lawful purposes associated with platform operations. The categories of Personal Data collected include:

In accordance with Section 4 of the DPDPA, Personal Data shall only be processed for specified, lawful purposes for which the Data Principal has given explicit consent, or for "Certain Legitimate Uses" as provided under Section 7 of the DPDPA.

4.1 Provision of Consent: Consent requested from the Data Principal is itemized, specific, informed, unconditional, and unambiguous. Registration on Jollyfer.com or clicking "I Agree", "Book Now", or "Sign Up" constitutes legally valid affirmative action under DPDPA Section 6.

4.2 Right to Withdraw Consent: Pursuant to Section 6(4) of the DPDPA, the Data Principal possesses the absolute right to withdraw consent for processing Personal Data at any time. Withdrawal may be executed through account setting toggles or by issuing a written request to privacy@jollyfer.com.

Jollyfer is an e-commerce marketplace platform. To enable service fulfillment, Personal Data must be shared with third parties under valid data processing contracts adhering to Section 8 of the DPDPA:

• Independent Third-Party Service Partners: When a Customer books a service (e.g., personal stylist, beautician, photographer, tailor, massage therapist), necessary contact and location details are shared with the assigned Service Partner strictly to enable service execution.
• Payment Aggregators & Gateways: Financial transactions are processed via RBI-authorized payment processors. Jollyfer does not directly store complete credit/debit card numbers or UPI PINs.
• Cloud Infrastructure & Telephony Providers: Data is hosted on secure cloud infrastructure located within the territory of India or permissible jurisdictions, and masked communication APIs are utilized for customer-provider calling.
• Statutory Authorities: Disclosures made to law enforcement, legal courts, or regulatory bodies upon receipt of lawful orders under Indian law.

6.1 Minors (< 18 Years): In strict compliance with Section 9 of the DPDPA, Jollyfer does not knowingly collect, process, or track the personal data of individuals under eighteen (18) years of age without verifiable consent from a lawful parent or legal guardian.

6.2 Prohibition of Targeted Ads & Tracking: Jollyfer shall not undertake tracking, behavioral monitoring, or targeted advertising directed toward minors on its platform.

6.3 Parental Rights: A parent or guardian who discovers that a minor under their care has submitted personal data without consent may request immediate erasure by contacting the Data Protection Officer.

Every Data Principal interacting with Jollyfer.com is guaranteed the following statutory rights under Sections 11 through 14 of the Digital Personal Data Protection Act, 2023:

Pursuant to Section 15 of the DPDPA, every Data Principal using Jollyfer.com is bound by statutory duties. Failure to comply constitutes a violation of Indian law:

9.1 Reasonable Security Practices: In compliance with Section 8(5) of the DPDPA and Section 43A of the IT Act, 2000, the Company implements technical, physical, and administrative safeguards, including AES-256 bit data encryption at rest and in transit, multi-factor access authentication, intrusion detection systems, and periodic vulnerability assessments.

9.2 Data Retention Policy: Personal Data is retained only for as long as necessary to fulfill the specified purpose of collection, or as required under applicable statutory retention mandates (e.g., tax regulations, IT Act log preservation rules). Upon expiration of the retention threshold or valid erasure requests, data is securely anonymized or permanently deleted.

This Privacy Policy operates in conjunction with Section 79 of the Information Technology Act, 2000. Faceons Internet Private Limited explicitly disclaims all liability regarding third-party service provider interactions:

11.1 Breach Management: The Company maintains an active Incident Response Strategy to detect, contain, and remediate cybersecurity threats or unauthorized data access events.

11.2 Mandatory Statutory Reporting: In the event of a confirmed Personal Data Breach as defined under Section 8(5) of the DPDPA, the Company shall, in the prescribed form and manner, intimate the statutory Data Protection Board of India (DPBI) and affected Data Principals with details regarding the nature of the breach, potential impact, and remedial measures deployed.

12.1 Consent Manager Integration: Data Principals may manage, review, or withdraw consent through registered Consent Managers licensed by the Data Protection Board of India as and when operationalized under DPDPA framework rules.

12.2 Governing Law & Exclusive Jurisdiction: This Privacy Policy, its interpretation, and any data privacy disputes arising hereunder shall be governed exclusively by the laws of the Republic of India. Subject to initial statutory escalation to the Grievance Officer, any unresolved legal disputes shall be referred to binding arbitration under the Arbitration and Conciliation Act, 1996 in Bhubaneswar, Odisha. Subject to arbitration, the competent courts at Bhubaneswar, Odisha shall hold sole and exclusive territorial jurisdiction.

In accordance with Rule 3(2) of the IT (Intermediary Guidelines) Rules, 2021 and Section 13 of the DPDPA, 2023, the details of the designated Data Protection Officer (DPO) / Grievance Officer for Faceons Internet Private Limited are published below: