1. Introduction & Overview
Welcome to OUT OF THE BOX ("we", "our", or "us"). We are committed to safeguarding the privacy and personal data of our members, mobile app users, visitors, and partners. This Privacy Policy explains how we collect, use, process, disclose, and protect your personal information when you use our mobile application (outofthebox, package: com.outofthebox) and our official web portal (https://outoftheboxcoworking.in), as well as when you access our physical coworking spaces, conference facilities, and private office suites.
By downloading, installing, or accessing the outofthebox mobile application or booking services through our platform, you acknowledge that you have read and understood this Privacy Policy and agree to the collection and handling of your information as outlined herein.
2. Information We Collect
We collect several types of information from and about users of our mobile application and coworking spaces, including:
- Personal Identification Information: Full name, professional title, company or organization name, business email address, contact phone number, and physical billing address.
- Government Identity & Access Credentials: For premises safety, security compliance, and building entry protocols, we may collect government-issued photo identification details (such as Aadhaar, PAN, Passport, or Driving License) during member onboarding or guest registration.
- Account & Authentication Data: Encrypted passwords, security authentication tokens, session identifiers, and user role credentials (Client, Admin, Staff).
- Space Usage & Reservation Data: Booking histories, hot-desk assignments, private cabin allocations, conference room reservations, scheduled meeting durations, check-in and check-out timestamps, and overstay access logs.
- Billing & Payment Information: Transaction amounts, invoices, GST numbers, payment methods (Credit/Debit Card, UPI, Net Banking), and gateway transaction IDs. Note: All payment transactions are processed securely through certified, PCI-DSS compliant third-party payment gateways. We do not store your complete card numbers, CVV, or banking PINs on our servers.
- Device & Technical Diagnostics: Device model, operating system version (Android), unique device identifiers, IP address, network carrier, application version, crash analytics, and push notification tokens.
3. Mobile Application Permissions (Android)
The outofthebox mobile application requests only the minimum permissions necessary to deliver essential services smoothly and reliably:
- Internet Access (
android.permission.INTERNET): Required to communicate with our secure cloud servers, sync live desk availability, process real-time bookings, and update account balances.
- Network State (
android.permission.ACCESS_NETWORK_STATE): Used to monitor network connectivity and alert you if your device goes offline during a transaction.
- Photo Library & Camera (via Android Photo Picker): Requested only when you intentionally choose to upload a member profile avatar or submit identity verification documents. We do not access your photo gallery or camera without your direct interaction.
4. How We Use Your Information
We utilize the collected information strictly for legitimate business and operational purposes, including:
- Providing, maintaining, and enhancing the outofthebox mobile app and coworking management ecosystem.
- Processing seat bookings, meeting room rentals, flexi-passes, and corporate office subscriptions.
- Managing physical facility access, biometric entry gates, guest registrations, and tracking authorized premises occupancy.
- Generating and issuing accurate monthly tax invoices, GST statements, and payment receipts.
- Sending critical operational alerts, including booking confirmations, room slot reminders, door pass codes, security updates, and administrative announcements.
- Resolving customer support requests, service tickets, and technical troubleshooting inquiries.
- Preventing fraudulent bookings, unauthorized space entry, security breaches, and enforcing our Community Guidelines.
- Complying with statutory regulatory requirements under the Information Technology Act, 2000, the Digital Personal Data Protection (DPDP) Act, and applicable Indian laws.
5. Information Sharing and Disclosure
We do not sell, rent, lease, or trade your personal data to any third parties for marketing or advertising purposes. We only share information under the following limited and controlled circumstances:
- Authorized Service Providers: Trusted third-party contractors who assist us in operating our platform, such as cloud hosting providers, payment processing networks, SMS/WhatsApp notification gateways, and biometric access hardware integrations. These providers are bound by strict contractual confidentiality agreements.
- Enterprise Clients / Employers: If your membership is part of a corporate account or corporate sponsorship, your employer's designated team administrator may view reservation logs, occupancy metrics, and attendance records associated with your profile.
- Legal & Regulatory Authorities: When required by applicable law, court order, search warrant, government investigation, or to protect the safety, rights, and property of OUT OF THE BOX, our community members, or the general public.
- Business Transfers: In connection with any merger, sale of company assets, restructuring, or acquisition, personal information may be transferred as an operational business asset under equivalent confidentiality standards.
6. Data Security & Storage
We implement enterprise-grade technical and organizational security protocols to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
- All network communication between the mobile app, web portal, and servers is encrypted using modern Transport Layer Security (TLS 1.3 / HTTPS 256-bit encryption).
- User passwords and authentication tokens are encrypted using state-of-the-art cryptographic hashing algorithms (Bcrypt/Argon2).
- Server databases are protected with restricted network firewalls, strict role-based access management, and periodic security audits.
7. Data Retention & Account Deletion Policy
We retain your personal information for as long as your account remains active or as required to fulfill the purposes set out in this policy. When you choose to close your account:
- Right to Erasure / Account Deletion: You have the right to request the deletion of your account and associated personal data at any time. You can initiate this request directly from the Profile Settings tab within the outofthebox mobile application or by emailing our data support team at support@outoftheboxcoworking.in.
- Upon receipt of a verified deletion request, your personal profile, credentials, and access keys will be permanently deleted or irreversibly anonymized within 30 days, except where financial, tax, or legal retention rules require otherwise (e.g., GST invoices retained for statutory audit periods).
8. Your Privacy Rights
Depending on your jurisdiction, you have the following rights regarding your personal information:
- Access & Portability: The right to request a copy of the personal data we hold about you.
- Rectification: The right to update or correct inaccurate or incomplete contact and profile details.
- Consent Withdrawal: The right to withdraw consent for optional communications or push notifications at any time via device settings or app preferences.
9. Children’s Privacy
Our mobile app and coworking facilities are intended strictly for working professionals, businesses, and individuals aged 18 and older. We do not knowingly collect or solicit personal information from minors under the age of 18. If we discover that personal data from a minor has been collected without parental consent, we will promptly delete it from our systems.
10. Third-Party Links & Services
Our platform may contain links to external third-party websites (such as partner cafes, payment gateways, or event platforms). We are not responsible for the privacy practices, terms, or content of external third parties. We encourage you to review the privacy policies of any third-party websites you visit.
11. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our operational procedures, legal mandates, or mobile app features. Any material updates will be posted on this page with an updated "Last Modified" date. Continued use of our mobile app or services following the posting of updates constitutes your acceptance of the revised terms.
12. Contact & Grievance Officer
If you have any questions, feedback, or grievance requests concerning this Privacy Policy or our data handling practices, please contact our designated Grievance & Compliance Team:
