Privacy Policy | AesthetiX Spaces

1. What we collect

Identity & contact: name, phone, WhatsApp, email, billing and site address.
Project data: floor plans, measurements, photographs and videos of your site, design preferences, selections, approvals, payment milestones.
Financial: invoices, payment references and GST details where applicable (we never store card or banking credentials).
Digital: portal activity, device and usage data, cookies (see Cookie Policy), and communication records including WhatsApp Business messages.

2. Why we process it (lawful purposes)

To prepare quotations, execute your project, provide warranty and after-sales service (contractual necessity);
To comply with tax, accounting and legal obligations (legal obligation);
To send project updates and service messages (legitimate use);
To send marketing, offers and case studies (only with your consent, revocable any time);
To improve our services and platforms using aggregated, de-identified analytics.

We share personal data only with: our workforce and vetted subcontractors on a need-to-know basis; suppliers for delivery; payment and communication providers (e.g., payment gateways, WhatsApp Business API providers); professional advisers; and authorities where legally required. We never sell your personal data.

4. Your rights (DPDP Act 2023)

Access a summary of your personal data and how it is processed;
Correct, complete or update your data;
Erase data no longer necessary for the purpose collected (subject to legal retention);
Withdraw consent as easily as it was given;
Grievance redressal, and the right to nominate a person to exercise your rights;
Verified requests are actioned within 7 working days; write to privacy@aesthetixspaces.com.

5. Retention

Project and financial records are retained for 8 years to meet warranty, tax and statutory obligations; marketing data until consent withdrawal; portal accounts until closure plus statutory periods. Data is then deleted or irreversibly anonymised.

6. Children

Our services are directed to adults. We do not knowingly process children's personal data except incidental site imagery, which is never used in marketing without explicit guardian consent.

7. Breach notification

Affected users and the Data Protection Board / relevant authorities are notified within 72 hours of confirming a reportable breach.

This document is part of the AesthetiX Legal Hub (v2.0, effective 17 July 2026) and is incorporated by reference into every estimate, quotation, invoice and Work Agreement. Questions: privacy@aesthetixspaces.com.