Privacy Policy

CosmoOps (OPC) Private Limited ("CosmoOps", "we", "us") is a company incorporated in India. We operate CosmoOps Club ("the Platform"), a service that helps service clubs and chapters manage members, meetings, projects, finances, dues, donations and statutory registrations.

Two roles matter under the DPDP Act, and they are different people:

• CosmoOps is the Data Fiduciary for the data of the people who create and sign in to a Club account: their name, email address, phone number, role and sign-in activity.
• Each club is the Data Fiduciary for the data it records about its own members, donors, guests and officers (the roster, attendance, dues, donations and so on). It decides why and how that data is used. CosmoOps acts as the club's Data Processor and handles that data only on the club's documented instructions.

If you are a club member and want to know what your club holds about you, ask the club first. Its officers can answer from the Platform, and our Grievance Officer (Section 10) can help if you cannot reach them.

Depending on how your club uses the Platform, the data below may be processed.

• Account data — name, email address, phone number, the Connect account identifier and the role you hold in a club.
• Member roster — name, salutation, member number, email, phone, photograph, gender, date of birth, wedding anniversary, blood group, spouse name, postal address, membership status and category, joining date, who proposed the member, and internal notes and tags.
• Business and directory profile — company name, designation, industry, GSTIN, website, LinkedIn URL, and what a member offers or is looking for, so members can refer business to one another. This is shown to other members only as far as you have consented (Section 5).
• Attendance, projects and referrals — meetings attended, make-ups, guests, volunteer hours, projects you took part in, and referrals given or received, including the value of business that closed.
• Dues and finances — dues demands and payments, and receipts and payments recorded against a member or donor.
• Donor records — donor name, contact details, PAN or another identifier that Form 10BD permits, and giving history, so a club can issue 80G receipts.
• Club registrations — PAN, 12A, 80G, FCRA and CSR-1 details of the club itself.
• Usage and device data — log files, IP address, browser and device type, pages visited and sign-in events, used for security and to keep the service running.

We do not ask clubs for Aadhaar numbers, and the Platform does not need them. Donor identifiers are limited to what Form 10BD itself accepts.

We process personal data only for the purposes below, and for no other purpose without a fresh notice to you.

• Creating and securing accounts, and signing you in through CosmoOps Connect.
• Running the club tools a club has asked us to run: the roster, meetings and attendance, projects, finances, dues, donations and 80G receipts, and registration and filing calendars.
• Showing a member's directory profile to other members, within the choices the member has made.
• Sending service messages, such as invitations, sign-in links and notices about changes to this policy.
• Security, fraud prevention and abuse detection.
• Improving the Platform using aggregated and anonymised information.
• Meeting legal obligations under Indian law.

The DPDP Act permits processing on consent and on a limited list of "legitimate uses". We rely on:

• Consent — free, specific, informed and unambiguous, given by a clear affirmative action, for optional uses such as showing your details in the member directory. We ask for each choice separately and never make consent to an optional use a condition of using the Platform.
• Voluntarily provided data — where you give us data for a stated purpose and have not indicated that you object to its use for that purpose.
• Legal obligation — where we or a club must keep or disclose data under an Indian law, court order or regulatory direction, for example income-tax and Form 10BD requirements.

Every consent can be withdrawn as easily as it was given (Section 5).

A club's member directory shows only what a member has agreed to show. Nothing is shared by default. Separate switches control whether others can see your email, phone, address, business details and date of birth.

Each time consent is given or withdrawn, the Platform records when it happened and how, in an append-only privacy log that nobody can edit or delete. This is how a club and CosmoOps can show that consent was taken. Withdrawing consent stops the use going forward. It does not affect processing already done on the basis of your earlier consent.

You may change your choices at any time from your own profile in the Platform, or by asking your club or our Grievance Officer to do it for you.

We do not sell personal data. We share it only as described here.

• Your club — a club's officers can see the records the club holds, according to the permission each officer has been given. Members see the directory choices other members have made public.
• CosmoOps Connect — our sign-in, workspace and subscription service, which holds account identity and role information.
• Google LLC — Google Cloud and Firebase (including Firestore for the database and Cloud Storage), which hosts the Platform's data. A Data Processing Agreement is in place.
• Resend Inc. — delivery of transactional email such as invitations and sign-in links.
• Authorities — where required by law or a valid legal process, including to the Data Protection Board of India.

Each processor acts as a Data Processor on our documented instructions. We may disclose data to law enforcement or regulatory authorities when required by law or a valid legal process.

Some of our processors, including Google LLC and Resend Inc., are located outside India. The DPDP Act allows transfer of personal data outside India except to countries the Government of India restricts by notification. Where personal data is transferred outside India, we make sure appropriate safeguards are in place, including contractual clauses consistent with applicable data protection law, and we do not transfer data to any restricted country.

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires. What is erased and what is kept when a workspace is deleted is set out in our Data Deletion & Retention page.

• Account and organisation data — retained for the duration of the subscription plus 7 years, as required by Indian accounting and tax law.
• Club records — for as long as the club keeps an active subscription. When a club closes its workspace, we delete or return its data after a closing period, unless the law requires us to keep it.
• Donation, receipt and finance records — for the periods set by income-tax, Form 10BD and other applicable law, which can be longer than membership. Erasure requests cannot override these.
• Privacy log — kept as long as needed to demonstrate compliance with the DPDP Act, because it is itself the proof that a request was honoured.
• Session and log data — retained for 90 days, then deleted.

When a member leaves a club, the club decides how long to keep the member's record. Once the purpose has ended and no law requires the data to be kept, it is erased.

Under the DPDP Act you have the right to:

• Access — get a summary of the personal data processed about you, the processing carried out, and who it has been shared with.
• Correction and completion — have inaccurate or incomplete data corrected, and out-of-date data updated.
• Erasure — have your data erased once it is no longer needed for the purpose it was collected for, unless the law requires it to be kept.
• Withdraw consent — at any time, as easily as you gave it.
• Grievance redressal — have a complaint answered by our Grievance Officer within the time given in Section 10.
• Nominate — name another person to exercise your rights if you die or become unable to.

You also have duties under the Act: to give accurate information, not to impersonate another person, and not to file false or frivolous complaints.

To use any of these rights, write to grievance@cosmoops.com from the email address on your account. We will confirm who you are before acting, so that nobody else can read or erase your data. Each access, correction, export and erasure is recorded in the privacy log.

If you have a concern about how your data is handled, contact our Grievance Officer first:

Data Protection and Grievance Officer, CosmoOps (OPC) Private Limited
Email: grievance@cosmoops.com

We acknowledge a complaint within 48 hours and aim to resolve it within 30 days. The full process is on our Grievance Redressal page. If you are not satisfied with our answer, you may complain to the Data Protection Board of India, once it is operational, under Section 20 of the DPDP Act, 2023. The Board expects you to have used our grievance process first.

We protect personal data with reasonable security safeguards, including encryption in transit and at rest, role-based access so that officers see only what their role allows, an append-only privacy log, and regular review of access. No system is completely secure.

If a personal data breach occurs, we will notify the Data Protection Board of India and each affected person in the form and within the time the DPDP Act and its Rules require. Where a breach affects a club's records, we will tell the club without undue delay so that it can meet its own duties.

The Platform is for adults. A person under 18 is a child under the DPDP Act, and we do not knowingly process a child's personal data. A club that records a minor, for example in a youth or student chapter, must first obtain verifiable consent from the child's parent or lawful guardian, and must not track or monitor the child or target advertising at them. If you believe we hold a child's data without that consent, tell the Grievance Officer and we will act on it.

We use only cookies that are strictly necessary to keep you signed in and to protect your session. We do not currently use analytics or advertising cookies. A cookie banner records the choices you make, and you can change them at any time from Manage cookie preferences in the footer. The list of what is stored is in our Cookie Policy.

We may update this policy as the Platform or the law changes. We will publish the new version here with a new date, and for material changes we will tell account holders by email or an in-app notice at least 15 days before they take effect. Where a change needs fresh consent, we will ask for it.

CosmoOps (OPC) Private Limited
General: support@cosmoops.com
Grievance Officer: grievance@cosmoops.com (see Grievance Redressal)