DPDP Compliance

India's Digital Personal Data Protection Act, 2023 (DPDP Act) is a landmark privacy law that gives Indian individuals — called Data Principals — rights over their personal data, and places obligations on organisations that process that data — called Data Fiduciaries and Data Processors.

Veloqit Bloom is a B2B SaaS product for Indian salon owners. This page explains:

• How we act as a Data Fiduciary for salon owner data.
• How we act as a Data Processor for salon customer data on the salon's behalf.
• The 5 core DPDP obligations and how we meet each one.
• The practical steps for customers and salon owners to exercise their data rights.

The DPDP Act places five principal categories of obligations on Data Fiduciaries. Here is how Bloom fulfils each:

If you are a salon customer (i.e., you visited or booked at a salon that uses Veloqit Bloom), your personal data is held by your salon. Veloqit processes it only as a Data Processor on the salon's behalf.

To exercise your data rights:

As a salon owner (our direct Data Principal), you have the following data control options within Veloqit Bloom:

Data Export

• Go to Settings > Data Export to download all your data in CSV format (customers, appointments, invoices, staff).
• Individual invoices can be downloaded as PDFs from the Billing section.
• Export is available at any time during an active subscription and for 30 days after cancellation.

Data Correction

• You can correct your business name, address, GSTIN, contact details, and payment information from Settings > Business Profile at any time.
• Staff and customer records can be edited directly from within the app.

Account & Data Deletion

For Salon Owners

When you create a Veloqit Bloom account, you provide explicit consent to our Privacy Policy and Terms. You can withdraw consent at any time by deleting your account (see above). Withdrawal does not affect prior processing.

For Salon Customers (WhatsApp Opt-Out)

Salon customers who receive WhatsApp messages via Bloom can opt out at any time:

• Reply STOP to any Bloom WhatsApp message.
• Your number is added to the opt-out list within 24 hours.
• You will receive a confirmation message and no further automated messages from that salon's Bloom number.
• To re-subscribe, reply START or ask the salon to re-enable messaging for your number.

Consent Records

We maintain timestamped records of all consent actions (sign-up consent, WhatsApp opt-in/opt-out) for audit purposes. These records are retained for the duration of the account plus 3 years.

Veloqit Bloom is a B2B professional service designed exclusively for adult salon operators and their adult customers. We do not knowingly collect, use, or process personal data of individuals under 18 years of age.

The DPDP Act 2023 imposes additional obligations on Data Fiduciaries who knowingly process children's data (Section 9). Veloqit's service:

• Does not allow registration by individuals under 18.
• Does not display targeted advertising.
• Does not enable profiling of children.
• Does not include social features designed to attract minors.

If we discover that personal data of a minor has been processed without parental consent, we will delete it promptly and notify the relevant salon owner. Salon owners are responsible for ensuring compliance when entering customer data involving minors.

The DPDP Act 2023 empowers the Central Government to restrict cross-border transfer of personal data to certain countries. We are committed to complying with all such restrictions as and when they are notified.

Currently, data processed by some of our sub-processors (Supabase, Anthropic, Vercel, Resend, Sentry) may be stored or processed in the United States. We ensure:

• Contractual safeguards with all sub-processors (DPAs/SCCs).
• Processing limited to the minimum data necessary for each function.
• Sub-processors are SOC 2 Type II certified or equivalent where available.

Razorpay processes all payment data within India in compliance with RBI Payment Aggregator guidelines.

We have appointed a Grievance Officer as required by Section 13 of the DPDP Act 2023 and Rule 5 of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

If your complaint is not resolved by our Grievance Officer within 30 days, you have the right to escalate to the Data Protection Board of India — the statutory authority established under Section 18 of the DPDP Act 2023.

The Data Protection Board of India (DPBI) has the power to:

• Investigate complaints from Data Principals.
• Issue directions to Data Fiduciaries and Data Processors.
• Impose financial penalties for non-compliance.

We are committed to co-operating fully with the Data Protection Board of India in any investigation or proceeding.