1. Introduction
Beyond Quantum Technologies Private Limited is a company incorporated under the Companies Act, 2013, bearing Corporate Identity Number (CIN) [INSERT CIN], with its registered office at [INSERT REGISTERED OFFICE ADDRESS], India (the “Company,” “Beyond Quantum,” “we,” “us,” or “our”).
Digi Parking is a project of the Company. It is a technology platform for QR-code-based parking access management. Digi Parking is a brand and product name — it is not a separate legal entity, is not separately incorporated, and cannot sue or be sued in its own name. Every reference to “Digi Parking” in this document means Beyond Quantum Technologies Private Limited, and every right, limitation, exclusion, and indemnity expressed in favour of Digi Parking operates in favour of the Company.
The Company may operate projects, brands, and products in addition to Digi Parking. This document governs only what its scope section says it governs.
This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website at digiparking.net (the “Website”). It is published in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), the Digital Personal Data Protection Act, 2023 (“DPDPA”) and the Digital Personal Data Protection Rules, 2025 made under it, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“Intermediary Guidelines”).
For the purposes of the DPDPA, the Company is the Data Fiduciary in respect of the personal data described in this Policy. You are the Data Principal.
This Policy covers only the Website. Our mobile applications collect different data for different purposes and are governed by their own separate privacy policies, provided at the point of installation and account creation. Cookies are dealt with in our separate Website Cookie Policy, which should be read alongside this Policy.
2. Definitions
- Personal Data: any data about an individual who is identifiable by or in relation to such data.
- Processing: any operation performed on personal data, including collection, recording, organisation, storage, retrieval, use, sharing, erasure, or destruction.
- Data Principal: the individual to whom the personal data relates — in the context of this Website, you.
- Data Fiduciary: the person who determines the purpose and means of processing personal data — here, the Company.
- Data Processor: a person who processes personal data on behalf of a Data Fiduciary.
- Personal Data Breach: any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data, that compromises its confidentiality, integrity, or availability.
3. Personal Data We Collect
3.1 Data you give us directly
We collect this data only when you choose to give it to us by filling in a form or writing to us.
| Context | Data collected | Mandatory? |
|---|---|---|
| Business or partnership enquiry | Name, email address, phone number, company name, city, message content | Name and email; rest optional |
| Operator partnership application | Name, email, phone, business name, number and location of parking facilities, message content | All fields |
| Careers / job application | Name, email, phone, resume or CV, cover letter, links to professional profiles | Name, email, and resume |
| Newsletter or marketing subscription | Email address; optionally name and city | Email address |
| Support or grievance submission | Name, email, phone, description of the issue, any attachments you send | Name and email |
| Demo or callback request | Name, phone, email, preferred time | Name and phone |
3.2 Data collected automatically
When you visit the Website, certain technical data is collected automatically by our servers and our analytics providers, whether or not you submit any form.
- IP address, truncated for analytics purposes where technically feasible
- Browser type, version, and language settings
- Operating system and device category
- Referring URL and exit pages
- Pages viewed, time spent per page, and click paths
- Date and time of access
- Approximate geographic location derived from IP address, at city level
3.3 Data we do not collect through the Website
- Payment card numbers, UPI identifiers, bank account details, or any payment credentials
- Aadhaar numbers, PAN, or other government identifiers
- Biometric data of any kind
- Vehicle registration numbers or parking session data
- Precise GPS location
Some of these categories are collected by our mobile applications under their own privacy policies.
4. Purposes and Lawful Basis
Under Section 4 of the DPDPA, personal data may be processed only for a lawful purpose for which you have given consent, or for a legitimate use specified in Section 7. The table below sets out each purpose and the basis on which we process.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal is as easy as giving consent: write to the Grievance Officer at the address in Section 11, or use the unsubscribe link in any marketing email. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not require us to erase data we are legally required to retain.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to your enquiry or callback request | Contact details and message content | Consent (Section 6, DPDPA) |
| Assessing an operator partnership application | Contact and business details | Consent; steps taken at your request prior to entering a contract |
| Assessing a job application | Application data | Consent; Section 7(i), DPDPA — purposes of employment |
| Sending marketing communications | Email address and name | Consent, withdrawable at any time |
| Operating and securing the Website | Technical and automatically collected data | Section 7(a), DPDPA — data voluntarily provided for the specified purpose; necessary to deliver the service you requested |
| Measuring and improving Website performance | Analytics data | Consent for non-essential analytics cookies |
| Detecting and preventing fraud, abuse, and attack | Technical data, submission patterns | Section 17(1)(c), DPDPA — detection and investigation of an offence or contravention |
| Complying with statutory record-keeping | Any data as required | Statutory obligation under the Income-tax Act, 1961, the CGST Act, 2017, and the Companies Act, 2013 |
| Establishing, exercising, or defending legal claims | Any relevant data | Section 17(1)(a), DPDPA — enforcing a legal right or claim |
5. Notice Under Section 5 of the DPDPA
Section 5 of the DPDPA requires that, on or before seeking your consent, we give you an itemised notice describing the personal data sought, the purpose of processing, how you may exercise your rights under Sections 6(4) and 13, and how you may complain to the Data Protection Board of India.
That notice is presented separately at the point where consent is sought — at each form on the Website — and is offered in English and in the languages specified in the Eighth Schedule to the Constitution of India that we support. This Policy supplements that notice; it does not replace it.
If the Central Government notifies the Company as a Significant Data Fiduciary under Section 10 of the DPDPA, we will appoint a Data Protection Officer based in India who will be the point of contact for the grievance redressal mechanism, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits, as that Section requires. We will publish the Data Protection Officer’s contact details in this Policy at that point.
7. Data Retention
We retain personal data only for as long as necessary for the purpose it was collected, or for such longer period as required by law. Section 8(7) of the DPDPA requires erasure once the purpose is no longer served and retention is no longer necessary for legal compliance.
At the end of a retention period, personal data is deleted or irreversibly anonymised. Anonymised data, which cannot be linked back to any individual, falls outside the scope of the DPDPA and may be retained indefinitely for statistical purposes.
Backup copies are overwritten on a rolling cycle. Where personal data has been deleted from live systems but persists in a backup, that data is isolated from active processing and is deleted when the backup cycle completes.
| Category of data | Retention period | Reason |
|---|---|---|
| Enquiry and contact form submissions | 24 months from last contact | Handling follow-up queries; maintaining a record of dealings |
| Operator partnership applications (unsuccessful) | 12 months from decision | Reconsideration if circumstances change; evidence of a fair process |
| Job applications (unsuccessful) | 12 months from decision | Consideration for future roles; defence of any claim |
| Marketing subscription records | Until withdrawal, plus 24 months | Evidencing the consent on which marketing was sent |
| Grievance and complaint records | 36 months from closure | Regulatory record-keeping and defence of claims |
| Website server and security logs | 180 days | Security monitoring and incident investigation |
| Security incident records | 36 months from closure | Demonstrating compliance with Section 8(5), DPDPA |
| Analytics data (pseudonymised) | 26 months | Year-on-year trend analysis |
| Cookie consent records | Up to 36 months from the consent event | Demonstrating the lawful basis on which cookies were set |
| Records required under tax or company law | 8 years | Section 128, Companies Act, 2013; Section 149, Income-tax Act, 1961; Section 36, CGST Act, 2017 |
8. Security Safeguards
Section 8(5) of the DPDPA requires a Data Fiduciary to protect personal data in its possession or under its control by taking reasonable security safeguards to prevent personal data breach. The measures we implement in relation to the Website include:
- Encryption in transit: traffic is encrypted using Transport Layer Security at version 1.2 or higher.
- Encryption at rest: databases and file storage holding personal data are encrypted using AES-256 or an equivalent standard.
- Access control: access to personal data is restricted to personnel whose role requires it, enforced through role-based access control and multi-factor authentication, and reviewed periodically.
- Network protection: firewalls, a web application firewall, rate limiting, and automated bot mitigation.
- Logging and monitoring: access to systems holding personal data is logged, and logs are monitored for anomalous activity.
- Segregation and least privilege: environments are segregated and permissions are granted on a least-privilege basis.
- Backup and recovery: encrypted backups are taken on a defined cycle and recovery is tested.
- Vendor due diligence: processors are assessed before engagement and are bound by written contracts imposing security and confidentiality obligations.
- Personnel measures: staff are bound by confidentiality obligations and receive data protection training.
- Incident response: we maintain a documented breach response procedure covering detection, containment, assessment, notification, and remediation.
This section describes our security posture at the date of this document. Security is not static: we review and update these measures as threats and technology change, and we may replace a named technology or protocol with one offering equivalent or better protection.
The description of a specific technology here is a statement of current practice, provided so that you can understand how we protect your data. It is not a warranty, a service level, or a contractual guarantee that any named technology will be in use at any given moment. Our obligation is the obligation the law imposes: to take reasonable security safeguards under Section 8(5) of the DPDPA.
No system connected to a network is perfectly secure, and no organisation can promise that it will never suffer a breach. A determined attacker with sufficient resources — including one exploiting a previously unknown vulnerability in software we did not write, or compromising a supplier we depend on — may defeat safeguards that are objectively reasonable.
What we commit to is what the law requires and what is within our control: taking reasonable security safeguards under Section 8(5) of the DPDPA, maintaining them, testing them, and responding properly when something goes wrong. We do not promise that a breach will never occur, and any statement in this document should be read in that light.
9. Personal Data Breach
Notification
In the event of a personal data breach we will, in accordance with Rule 7 of the Digital Personal Data Protection Rules, 2025:
- intimate each affected Data Principal without delay, describing the nature, extent, and timing of the breach, its likely consequences, the mitigation measures we have taken, the safety measures you should take, and the contact details of a person able to answer your questions; and
- intimate the Data Protection Board of India without delay with the particulars then known, and furnish the Board with a detailed report within 72 hours of becoming aware of the breach — covering the circumstances leading to it, the remedial and mitigation measures implemented, and our findings as to the person who caused it — or within such longer period as the Board may allow on written request.
We will not condition notification on completing our investigation. Where facts are still emerging, we will notify on the basis of what is known and supplement as more becomes clear.
What we are responsible for, and what we are not
Where a breach occurs despite reasonable safeguards, our liability is limited to the extent permitted by applicable law and by the limitation of liability provisions in the Terms of Use applicable to your use of the service. Nothing in this document excludes or limits any liability that cannot lawfully be excluded, including under the DPDPA and the Consumer Protection Act, 2019.
Your part in keeping your data secure
Security is shared. You must:
- keep your account credentials, one-time passwords, and device passcodes confidential, and not share them with anyone
- use a device passcode or biometric lock, and keep your device operating system and our application updated
- not install our application from any source other than an official app store
- notify us immediately if you suspect your account or device has been compromised
- not attempt to access any account other than your own, and not probe, scan, or test our systems
Where a compromise of your data results from your failure to meet these obligations — for example where you have shared your credentials, or where your device was compromised by software you installed — that is not a breach of our systems, and our responsibility is correspondingly limited. We will still help you secure your account.
Breaches at a third party
Where a personal data breach occurs at a processor we have engaged, we remain accountable to you under Section 8(1) of the DPDPA and will handle notification as though the breach had occurred in our own systems. Where a breach occurs at a party that is an independent Data Fiduciary in its own right — for example a payment aggregator that collected payment credentials directly from you, or a parking operator in respect of its own records — that party is accountable for it, and we will assist you in identifying and contacting them.
Reporting a vulnerability
If you discover a security vulnerability, report it to security@digiparking.net rather than disclosing it publicly or exploiting it. We will acknowledge a good-faith report within 72 hours and will not pursue legal action against a researcher who reports a vulnerability in good faith, does not access or exfiltrate personal data beyond the minimum needed to demonstrate the issue, does not degrade our service, and gives us a reasonable opportunity to remediate before disclosing.
10. Your Rights as a Data Principal
Chapter III of the DPDPA confers the following rights on you in relation to your personal data:
- Right to access information (Section 11): obtain a summary of the personal data we hold about you, the processing activities we carry out in relation to it, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared, together with a description of the data shared.
- Right to correction and erasure (Section 12): have inaccurate or misleading data corrected, incomplete data completed, outdated data updated, and data no longer necessary for its purpose erased — unless retention is required by law.
- Right to grievance redressal (Section 13): complain to our Grievance Officer about any act or omission in relation to your rights or our obligations.
- Right to nominate (Section 14): nominate another individual to exercise your rights in the event of your death or incapacity.
- Right to withdraw consent (Section 6(4)): withdraw consent for any processing carried out on the basis of consent. Withdrawal must be as easy as giving consent was.
To exercise any of these rights, send a request to the Grievance Officer using the contact details in Section 11. To protect your data we will verify your identity before acting on a request — we may ask you to confirm details you have previously given us, or to respond from the email address associated with the data. We will acknowledge your request within 24 hours and respond substantively within the period prescribed by the Digital Personal Data Protection Rules, 2025, and in any event within 15 days.
We do not charge a fee for exercising your rights. Where a request repeats an earlier one without any change in circumstances, we may refer you to our earlier response rather than repeating the exercise.
Your duties as a Data Principal
Section 15 of the DPDPA places duties on you. You must not impersonate another person when providing personal data, must not suppress material information when providing data for a legal purpose, must not register a false or frivolous grievance, and must furnish only authentic information when exercising your right to correction or erasure. Section 33 read with the Schedule to the DPDPA provides for financial penalties for breach of these duties.
11. Grievance Officer
In accordance with Rule 3(2) of the Intermediary Guidelines and Section 13 of the DPDPA, we have appointed a Grievance Officer to receive and address complaints relating to this Policy and to our processing of personal data.
Name: [INSERT NAME OF GRIEVANCE OFFICER]
Designation: Grievance Officer, Beyond Quantum Technologies Private Limited
Hours: Monday to Friday, 10:00 to 18:00 IST, excluding public holidays
In accordance with Rule 3(2)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Grievance Officer will acknowledge every complaint within 24 hours of receipt and will dispose of it within 15 days. Complaints concerning your rights as a Data Principal under the DPDPA will be resolved within the period prescribed by the Digital Personal Data Protection Rules, 2025.
If you are not satisfied with the outcome, or if we fail to respond within the prescribed period, you may complain to the Data Protection Board of India in the manner prescribed under the DPDPA.
12. Children’s Personal Data
The Website is not directed at children. Section 9 of the DPDPA prohibits processing of a child’s personal data that is likely to cause any detrimental effect on the wellbeing of the child, and prohibits tracking, behavioural monitoring, and targeted advertising directed at children. We do not engage in any of those activities.
We do not knowingly collect personal data from any person under the age of 18 through the Website. If we become aware that we have collected a child’s personal data without verifiable parental consent, we will delete it promptly. If you are a parent or guardian and believe your child has provided personal data to us, contact the Grievance Officer and we will act on it.
13. Automated Decision-Making
We do not use personal data collected through the Website to make any decision producing a legal effect concerning you, or significantly affecting you, solely on the basis of automated processing, including profiling. Automated tooling is used only to filter spam and abusive submissions and to mitigate automated attack traffic; where such tooling blocks a legitimate submission, you may contact the Grievance Officer and a person will review it.
14. Third-Party Websites
The Website may contain links to websites operated by third parties, including social media platforms, app stores, and partner websites. This Policy does not apply to them. We do not control them, are not responsible for their content or privacy practices, and a link is not an endorsement. Read the privacy policy of any third-party website before providing personal data to it.
15. Cross-Border Transfer of Personal Data
Personal data is stored and processed primarily on servers located in India.
Some processors may process personal data outside India. Section 16 of the DPDPA permits transfer of personal data outside India except to a territory notified as restricted by the Central Government. Where we transfer personal data outside India, we do so only to territories not so notified, and only under contractual arrangements requiring the recipient to apply protections equivalent to those in this document. We do not transfer personal data to any territory notified as restricted.
16. Changes to This Policy
We may amend this Policy to reflect changes in law, in our practices, or in the service. The current version is always available on the Website and shows the date it was last updated.
Where a change is material — for example where we begin processing personal data for a substantially new purpose — we will give prior notice, and where the DPDPA requires fresh consent for the new purpose we will obtain that consent before the change takes effect in relation to you. Your continued use after a non-material change takes effect constitutes acceptance of the amended Policy.
17. Governing Law
This Policy is governed by and construed in accordance with the laws of the Republic of India. Subject to the dispute resolution provisions of the Website Terms of Use, the courts at [INSERT CITY], India, have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.
END OF WEBSITE PRIVACY POLICY
Beyond Quantum Technologies Private Limited
Digi Parking | CIN [INSERT CIN]