Privacy & Data Policy

1. IntroductionIllustrex may process personal information in connection with creative production, customer relationship management, website enquiries, business communication, WhatsApp messaging, RCS messaging, service delivery, billing, support, account administration, and related business activities.We seek to follow principles of transparency, purpose limitation, reasonable security, responsible retention, and lawful processing.The precise information collected depends on how you interact with Illustrex. For example, a website visitor may provide only contact information, while a business customer using a messaging service may provide phone numbers, message content, campaign information, and communication preferences.

2. Information We CollectA. User InformationDepending on the service, we may collect:Name;Business or organisation name;Email address;Mobile or telephone number;Billing information;Business address;Account credentials;Communication preferences;Enquiry details;Information supplied through forms;Information contained in customer support communications; andOther information voluntarily provided to us.We do not intend to collect information that is unnecessary for the relevant service.B. Device and Technical InformationWhen you visit our website or use our digital services, technical information may be automatically collected, such as:IP address;Browser type;Operating system;Device type;Approximate technical location information;Website pages visited;Referring webpage;Access time;Diagnostic information;Log information; andSecurity-related information.Such information may be used for website operation, security, troubleshooting, analytics, and service improvement.C. CookiesOur website may use cookies and similar technologies to remember preferences, understand website usage, maintain sessions, improve functionality, and support security.You may be able to control cookies through browser settings, subject to the effect that disabling certain cookies may affect website functionality.D. Message DataIf you communicate with Illustrex through WhatsApp, RCS, SMS, email, website forms, or other supported channels, we may process information necessary to facilitate the interaction.This may include:Telephone number;Message content;Message metadata;Date and time of communication;Delivery or status information;User preferences;Opt-in and opt-out records;Campaign information;Template information;Customer support history; andInformation necessary to investigate abuse, fraud, or policy violations.Customers using Illustrex communication services are responsible for ensuring that they have a lawful basis and appropriate permission to provide recipient information to us.

3. Purpose of Data CollectionIllustrex may collect and process information for purposes including:Providing requested services;Responding to enquiries;Managing customer accounts;Processing transactions and invoices;Delivering communications;Managing WhatsApp and RCS services;Maintaining opt-in and opt-out records;Preventing spam, fraud, misuse, and security incidents;Providing customer support;Improving products and services;Maintaining technical systems;Meeting contractual obligations;Complying with legal obligations;Establishing, exercising, or defending legal claims; andMaintaining business and security records.The DPDP framework places importance on lawful processing, notice, consent where applicable, and specified purposes.

4. Consent for WhatsApp & RCS Data ProcessingWhere consent is required, Illustrex or the relevant customer will seek consent before processing personal data for the applicable purpose.For WhatsApp messaging, appropriate opt-in should identify the business and indicate that the individual wishes to receive communications through WhatsApp. WhatsApp’s current business messaging policy also requires businesses to respect requests to stop, block, or opt out of communications.For RCS for Business, Google requires appropriate notice and consent before soliciting end users, with consent being informed, specific, affirmative, and capable of being withdrawn. Google also requires businesses to maintain auditable consent and withdrawal records and promptly honour opt-out requests.Where Illustrex acts as a service provider for a business customer, the customer may remain responsible for obtaining the necessary consent from its End Users, while Illustrex will process information according to the applicable service arrangement.Individuals may withdraw consent where applicable. Withdrawal does not necessarily affect the lawfulness of processing undertaken before withdrawal.

5. Legal Basis for ProcessingDepending on the circumstances and applicable law, Illustrex may process personal data based on:Consent;Performance of a contract or steps requested before entering a contract;Compliance with applicable legal obligations;Certain legitimate or legally recognised uses;Prevention and investigation of fraud, security incidents, or misuse;Establishment, exercise, or defence of legal claims; andOther lawful grounds available under applicable law.The DPDP Act provides for processing for a lawful purpose based on consent or certain legitimate uses, subject to its applicability and commencement.Where consent is relied upon, the DPDP Act describes consent as free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and provides for withdrawal of consent.



6. How We Use Collected DataIllustrex may use personal information to:Deliver creative and communication services;Manage accounts;Process payments;Communicate with customers;Send service notifications;Respond to support requests;Configure and operate messaging channels;Maintain consent and suppression records;Analyse service performance;Improve website and service functionality;Detect suspicious activity;Protect systems and users;Meet legal requirements; andMaintain necessary business records.We do not intend to use personal data for purposes incompatible with the purpose for which it was collected without an appropriate lawful basis or notice where required.

7. Data Retention & DeletionIllustrex retains personal data only for as long as reasonably necessary for the purpose for which it was collected, contractual requirements, legitimate business requirements, security, accounting, dispute resolution, or legal obligations.When information is no longer required, Illustrex may delete, anonymise, aggregate, or securely dispose of it, subject to applicable retention requirements.Certain records may need to be retained after account closure, including invoices, transaction records, consent or opt-out records, security logs, legal correspondence, and records required to establish or defend legal claims.Where a valid deletion request is made, Illustrex will assess the request and delete or anonymise information where legally appropriate and technically feasible.

8. Data Sharing with Third PartiesIllustrex may share or make information available to carefully selected third parties where necessary to operate the service.These may include:Meta / WhatsAppWhere WhatsApp Business services are used, relevant information may be processed through Meta’s WhatsApp Business Platform or related Meta infrastructure.Customers should understand that WhatsApp/Meta operates under its own terms, policies, technical systems, and privacy practices. Illustrex cannot control the independent processing performed by Meta.Google / RCSWhere RCS for Business services are used, relevant information may be processed through Google, Jibe, or associated RCS infrastructure.Google’s RCS terms and policies establish requirements relating to service use, data handling, business identity, consent, security, and acceptable use.Telecom OperatorsRCS, SMS, or other telecommunications services may involve mobile network operators and communication infrastructure providers.Other Service ProvidersWe may also use:Cloud hosting providers;Website hosting providers;Payment processors;Email service providers;Customer support tools;Security providers;Analytics providers;Software and API providers;Professional advisers; andLegal, accounting, or regulatory service providers.Third parties are expected to process information according to the applicable contractual, technical, legal, or service requirements.

9. Security Measures & EncryptionIllustrex takes reasonable technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, misuse, alteration, disclosure, or destruction.Depending on the service, safeguards may include:Access controls;Authentication;Role-based permissions;Secure transmission mechanisms;Encryption where supported;Logging and monitoring;Backup controls;Security reviews;Credential protection;Restricted administrative access; andIncident-response procedures.No internet or electronic transmission system can be guaranteed to be completely secure. Therefore, while Illustrex takes reasonable measures, absolute security cannot be promised.The DPDP Act places obligations on Data Fiduciaries concerning reasonable security safeguards and personal-data breach handling.

10. Cookies & Tracking TechnologiesCookies may be used for:Essential website functionality;Session management;Security;Remembering preferences;Performance measurement;Analytics; andImproving website functionality.Where third-party analytics or advertising technologies are used, those providers may process information according to their respective privacy policies.Users can manage certain cookie settings through their browser. Some essential functions may not operate properly if cookies are disabled.

11. Data Transfer & Storage (India-Based)Illustrex’s business address is in Mumbai, Maharashtra, India, and we aim to maintain business and operational records in India where commercially and technically feasible.However, some technology providers, cloud platforms, communication platforms, APIs, or other third-party infrastructure used to provide services may process or store information outside India.Where such processing occurs, Illustrex will seek to use appropriate contractual, technical, organisational, or other safeguards required by applicable law.The DPDP Act contains provisions concerning processing outside India and government-imposed restrictions on transfers to certain territories; therefore, cross-border processing will be handled subject to applicable legal requirements as they become effective

12. User Rights — Access, Correction & DeletionSubject to applicable law, individuals may have rights relating to their personal data, including:Requesting information about personal data processed by Illustrex;Requesting correction or updating of inaccurate information;Requesting deletion or erasure where applicable;Withdrawing consent where consent is the applicable basis;Raising a privacy-related grievance; andExercising other rights available under applicable law.The DPDP Act provides rights relating to access, correction and erasure, as well as grievance redressal.Requests should be submitted using the contact details at the end of this Privacy Policy.To protect privacy and prevent unauthorised disclosure, Illustrex may need to verify the identity of the person making a request.The DPDP Rules, 2025 contemplate that a Data Fiduciary should prominently publish the means by which Data Principals may exercise their rights and establish an appropriate grievance mechanism, subject to the applicable commencement and requirements.

13. Policy for ChildrenIllustrex’s services are generally intended for businesses, professionals, organisations, and adult users.We do not knowingly seek to collect children’s personal data for unrelated commercial purposes.Where services involve communications directed toward children or information relating to children, additional legal and platform requirements may apply. Customers must not use Illustrex communication services to unlawfully target children or collect children’s information without the permissions and safeguards required by applicable law.The DPDP Act contains specific provisions concerning processing of children’s personal data, including additional obligations.

14. Updates to Privacy PolicyIllustrex may update this Privacy Policy from time to time because of:Changes in law;Regulatory developments;New services;Changes in technology;Changes in communication platforms;Security improvements; orChanges to our data-processing practices.The latest version will be identified by the “Last Updated” date shown at the beginning of this Privacy Policy.Where applicable law requires specific notice or consent for a material change, Illustrex will take the required steps.

15. Governing Law (India)This Privacy Policy shall be governed by the laws of India.Privacy-related processing will be undertaken subject to applicable Indian laws and regulations, including applicable provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as and when those provisions apply or come into force.Subject to applicable law, courts having jurisdiction over Mumbai, Maharashtra, may have jurisdiction regarding disputes arising from this Privacy Policy.

16. Contact InformationIf you have questions regarding this Privacy Policy, wish to exercise an applicable privacy right, want to withdraw consent, or wish to submit a privacy-related grievance, please contact:Illustrex Creative Production Private Limited
Address: Innov8, Parinee Crescenzo, 1702, 17th Floor, Bandra Kurla Complex, Bandra (East), Mumbai – 400051, Maharashtra, India
Email: malanshinde62@gmail.com
Mobile: 9158780202When contacting us, please clearly state the nature of your request and provide sufficient information for us to understand and respond to it.Illustrex will review privacy requests and respond in accordance with applicable law and the nature of the request.Final StatementIllustrex Creative Production Private Limited is committed to handling personal information responsibly and transparently. Our objective is to provide useful creative and communication services while respecting individual privacy, consent, security, and applicable legal requirements.By using our website or services, you acknowledge that you have had an opportunity to review this Privacy Policy. Where consent is legally required, consent will be obtained through an appropriate mechanism rather than being inferred solely from the existence of this Privacy Policy.