Privacy Policy

This Privacy Policy describes the manner in which GetMyQuotation Technologies Private Limited ("GMQ", "Company", "We", "Us", "Our") — which operates the consumer brand and online marketplace FindMeFurniture.com — collects, stores, processes, uses, discloses, transfers, and protects personal data of its users, vendors, service providers, and visitors.

The Platform is presently accessible under more than one domain name, including findmefurniture.com and getmyquotation.com, together with our mobile applications, dashboards, tools, and all associated digital services (collectively referred to as the "Platform"). All such domains are operated by the same legal entity and this Policy applies identically across all of them. FindMeFurniture.com is a brand name only; the data fiduciary in respect of personal data processed through the Platform is and remains GetMyQuotation Technologies Private Limited.

This Policy is framed in compliance with the provisions of the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023, along with other applicable laws in force in India.

By accessing or using the Platform, the user acknowledges that they have read, understood, and agreed to the terms of this Privacy Policy and consent to the lawful processing of their personal data in accordance herewith.

The Company may collect personal data that is voluntarily provided by users while registering on the Platform, submitting enquiries, requesting quotations, communicating with vendors, or otherwise availing services.

For Users/Customers, such personal data may include:

• Name and contact number

• Email address

• Residential or business location

• Service requirements and project details

• Any other information shared to enable the provision of services

• Non-binding text feedback submitted on individual work phases following quotation acceptance

• Messages, correspondence, and file attachments (such as photographs, drawings, and documents) exchanged with Vendors through Lead and Order message threads on the Platform

• Consultation booking details, including name, email address, telephone number, and the date and time of a scheduled or cancelled session

• Order and billing details, including order line items, quantities, agreed pricing, and information recorded on invoices generated through the Platform

For Vendors/Suppliers/Service Providers (GMQ Partners), business-related information may include:

• Trade name and business address

• GST details and registration number

• Experience credentials and portfolio documents

• Certifications and links to third-party business profiles (IndiaMart, JustDial, Google)

• Profile images and skill categories

• Work progress documentation including photographs and videos uploaded per work phase

• Pre-dispatch and post-installation photographs and video recordings uploaded in respect of delivery and installation

• Messages, correspondence, and file attachments exchanged with Customers through Lead and Order message threads on the Platform

• Order, invoicing, and tax-related details, including GST particulars recorded on invoices generated through the Platform

Technical, Device, and Campaign Data:

• Device notification tokens where the user installs a Platform mobile application and grants permission to receive push notifications. Such a token identifies a device for the purpose of delivering notifications and is stored in association with the user account until permission is withdrawn or the application is uninstalled.

• Campaign attribution parameters (commonly referred to as UTM parameters, such as source, medium, campaign, content, and term) captured when a user reaches the Platform or books a Consultation via a marketing link, used to understand which channels bring users to the Platform.

• Audit and edit records capturing changes made to leads, requirement analyses, and orders, including the identity of the user who made the change and the time at which it was made. Such records are immutable and are retained for transparency, dispute resolution, and fraud prevention.

Identity Verification (KYC) Data:

Where required for compliance, authentication, fraud prevention, or vendor verification, identity verification or KYC-related data (such as Aadhar Card) may be collected and processed strictly in accordance with applicable law.

The personal data collected by the Company is processed for lawful purposes, including:

• Facilitating quotation requests by sharing project requirements, location, and uploaded images with multiple registered Vendors concurrently for competitive quoting, and enabling communication between users and Vendors

• Verifying vendor credentials and authenticity

• Improving platform functionality and personalizing user experience

• Responding to queries and resolving disputes

• Preventing fraud and enforcing contractual obligations

• Complying with statutory and regulatory requirements

• Sending service-related communications via email, SMS, or WhatsApp

• Enabling structured, phase-wise work progress tracking and documentation between parties to an accepted quotation

• Creating and maintaining Order records, amendment audit logs, and invoices so that Customers and Vendors have a common, tamper-evident record of what was agreed and what was billed

• Operating Lead and Order message threads, including storage and delivery of attachments, and reviewing their contents where necessary for dispute resolution, quality assurance, or fraud prevention

• Scheduling, confirming, rescheduling, and cancelling Consultations, including through an integrated third-party scheduling service

• Delivering push notifications to a device on which a Platform application is installed and notification permission has been granted, for lead alerts, quotation and order updates, message notifications, and service communications

• Measuring marketing effectiveness using campaign attribution parameters, in aggregate and at the level of an individual enquiry, to understand which channels bring users to the Platform

• Processing uploaded images (project reference photographs and Vendor-submitted product photographs) using AI-based image cleanup, enhancement, and generation tools to create polished, presentation-ready versions, which may be publicly displayed on the marketplace/explore pages, quotation views, and related sections of the Platform, while separately retaining the original image as submitted for administrative and record-keeping purposes

Such processing is undertaken only for purposes that are necessary, lawful, and proportionate, and in accordance with the consent provided by the data principal or as otherwise permitted under the Digital Personal Data Protection Act, 2023.

The Platform may use cookies, pixels, and similar tracking technologies to collect information relating to user preferences, browsing behaviour, device identifiers, and interaction patterns for purposes of:

• Analytics and performance measurement

• Security and fraud detection

• User experience optimization

Authentication cookies: the Platform sets cookies that keep a signed-in user authenticated between requests, together with cookies used for cross-site request forgery protection. These are strictly necessary for the operation of signed-in areas of the Platform and cannot be disabled without losing the ability to sign in.

Cookies across our domains: because the Platform is reachable under more than one domain name, a cookie set while you are using findmefurniture.com is scoped to that domain, and a cookie set while you are using getmyquotation.com is scoped to that one. Browsers do not permit a cookie to be shared between two separate domains. As a result, signing in on one domain does not sign you in on the other, and preferences stored in cookies are not carried across. Both domains are operated by the Company and handle your personal data in accordance with this Policy.

Users may control or disable cookies through their browser settings; however, doing so may limit the availability or functionality of certain features of the Platform.

The Platform uses the Meta Pixel and Meta Conversions API for advertising performance measurement. This involves transmitting certain event data — including IP address, browser user-agent, and Meta Pixel identifiers (fbp/fbc) — as well as hashed (SHA-256) representations of user data such as phone number, email address, and name, to Meta Platforms Ireland Limited. Such data is processed in accordance with Meta's data policies and may involve cross-border transfer. Users may opt out of interest-based advertising through Meta's ad preferences settings.

The use of such technologies is consistent with lawful business practices and applicable data protection laws.

The Company may share personal data with its affiliates, service providers, technology partners, cloud service providers, vendors, or other third parties strictly on a need-to-know basis for the purpose of:

• Providing services and facilitating quotations

• Maintaining the Platform and conducting analytics

• Complying with legal obligations

Such third parties are bound by contractual obligations to ensure confidentiality, implement reasonable security safeguards, and process personal data only for authorised purposes.

Third-Party Service Providers Used:

• WATI (WhatsApp Business API) — for WhatsApp communications

• ZeptoMail by Zoho — for transactional email

• 2Factor — for OTP-based phone verification via SMS

• Amazon Web Services (AWS S3) — for storage of uploaded media, documents, and portfolio files

• Meta Platforms — for advertising analytics via Meta Pixel and Conversions API (see Section 4)

• Calendly — for scheduling, rescheduling, and cancellation of Consultations. Where a Consultation is booked, the name, email address, and telephone number provided are processed by Calendly under its own terms and privacy policy, and the resulting booking details are transmitted to the Company so that the booking can be recorded and serviced.

• Device platform notification services (such as the notification services operated by Google and Apple for Android and iOS respectively) — for delivery of push notifications to devices on which a Platform application is installed and notification permission has been granted

Personal data may also be disclosed to governmental authorities, courts, or law enforcement agencies where required under applicable law or pursuant to a valid legal process.

Cross-Border Data Transfer:

Primary customer data is stored on servers located in India. However, users acknowledge that specific features utilizing Artificial Intelligence (AI) and Machine Learning (ML) models — including AI-based image cleanup and enhancement of uploaded photographs — may require processing of data on servers hosted in secure foreign jurisdictions. Such transfers are conducted with appropriate safeguards to ensure an adequate level of data protection.

The Company retains personal data only for such period as is necessary to fulfil the purposes for which it was collected:

• User enquiry and lead-related data: Up to twelve (12) months from the date of last interaction

• Vendor account, verification, and transaction-related data: Duration of the vendor's association with the Platform and for up to eight (8) years thereafter as required under applicable tax, commercial, and regulatory laws

• Communication records: Up to three (3) years for grievance handling, audit, and dispute resolution purposes

• Work records and associated phase media: Duration of the vendor's association with the Platform and for up to three (3) years thereafter

• AI requirement analysis conversations: Up to twelve (12) months from the date of the associated lead's last interaction

• Lead and Order message threads and their attachments: Up to three (3) years from the date of the last message in the thread, for grievance handling, audit, and dispute resolution purposes

• Order records, invoices, and associated billing data: Up to eight (8) years as required under applicable tax, commercial, and regulatory laws

• Audit and edit records: For the life of the associated lead or order and for up to three (3) years thereafter. Such records are immutable and are not deleted on request where retention is necessary for dispute resolution, fraud prevention, or legal compliance.

• Consultation booking records: Up to twelve (12) months from the date of the scheduled session

• Device notification tokens: Until notification permission is withdrawn, the application is uninstalled, the token is invalidated by the device platform provider, or the account is deleted, whichever occurs first

Upon expiry of the applicable retention period or upon withdrawal of consent, personal data shall be securely deleted or irreversibly anonymised, unless retention is mandated by law.

The Company implements reasonable security practices and procedures, including technical, administrative, and physical safeguards, as mandated under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, to protect personal data against unauthorised access, disclosure, alteration, or destruction.

Data Breach Notification:

In the event of any personal data breach that is likely to cause harm to data principals, the Company shall, in accordance with applicable law, notify the Data Protection Board of India and affected users within the prescribed timelines, providing details of:

• The nature of the breach

• Remedial measures undertaken

• Steps recommended to mitigate potential harm

In accordance with the Digital Personal Data Protection Act, 2023, users have the following rights:

• Right to Access: Request information about their personal data being processed

• Right to Correction: Seek correction or updating of inaccurate or incomplete data

• Right to Erasure: Request deletion of personal data that is no longer necessary for the stated purpose

• Right to Withdraw Consent: Withdraw consent for data processing at any time

• Right to Grievance Redressal: Raise grievances relating to data processing

Important Notice:

Users acknowledge and agree that withdrawal of consent for processing of personal data essential to the provision of core services under this Privacy Policy and Terms of Service shall result in termination of the user account and discontinuation of services, as the Company is unable to provide such services without the requisite consent.

The Platform may contain links to third-party websites or services that are not owned or controlled by the Company.

The Company shall not be responsible for the privacy practices, content, or data security measures of such third-party platforms, and users are advised to review the respective privacy policies of those platforms before sharing any personal information.

The Platform is not intended for use by individuals below the age of eighteen (18) years.

The Company does not knowingly collect personal data from minors, and any such data, if inadvertently collected, shall be deleted upon discovery in accordance with applicable law.

In compliance with the Information Technology Act, 2000 and rules framed thereunder, the Company has designated a Grievance Officer to address concerns relating to personal data processing.

Grievance Officer Details:

• Name: Anshul Singh

• Email: support@getmyquotation.com

• Address: 703, 7th Floor, Palm Court, Mehrauli-Gurgaon Road, Sector 16, Gurugram, Haryana, 122007

Response Timeline:

• Any grievance raised by a user shall be acknowledged within twenty-four (24) hours

• Resolution shall be provided within fifteen (15) days from the date of receipt

This Privacy Policy shall be governed by and construed in accordance with the laws of India.

The courts at New Delhi, India shall have exclusive jurisdiction over any disputes arising out of or in connection with this Privacy Policy, subject to statutory remedies available under applicable law.

The Company reserves the right to modify or update this Privacy Policy at any time to reflect changes in legal requirements, regulatory directions, or business practices.

Continued use of the Platform following such modifications shall constitute acceptance of the revised Privacy Policy.

This Policy applies to all personal data currently held or processed by the Platform, including data collected prior to this Policy's effective date. Users who have active accounts, active leads, pending quotations, or ongoing work engagements on the Platform are deemed to be in continued use of the Platform for the purposes of this clause, and such continued use constitutes acceptance of this Policy. Users who do not wish to be bound by the updated Policy must request account deletion and withdrawal of all active leads and quotations.

FindMeFurniture.com is operated by GetMyQuotation Technologies Private Limited, which is the data fiduciary for the purposes of this Policy.

Email: privacy@getmyquotation.com

Support: support@getmyquotation.com

Phone: +91 7838447218