Privacy Policy

Clayworks Spaces Technologies Pvt. Ltd.

GSTIN: 29AAHCC1619D1ZW

Registered office: Bengaluru, Karnataka, India

Phone / WhatsApp: +91 89298 43791 / +91 90369 65031

Website: www.clayworks.space

For the purposes of India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and any other applicable data protection law, Clayworks is the Data Fiduciary in respect of personal data collected through the Site.

This Policy applies to personal data we collect through:

• The Site itself (browsing, forms, chat/contact widgets, promo landing pages such as /promo/[slug]);
• Enquiries for coworking, day passes, managed offices, virtual offices, meeting rooms, event spaces, built-to-suit offices, and ClayPass;
• The Careers section (job applications and resume submissions);
• Marketing communications you receive from us (email, WhatsApp, SMS, calls);
• Cookies and similar tracking technologies deployed on the Site.

This Policy does not apply to (a) third-party websites we link to, (b) our internal HR systems for existing employees, or (c) our separate booking platform where a distinct privacy policy may apply. Where you interact with us through a third-party platform (e.g., Google, Meta, LinkedIn), that platform's own privacy policy also governs your data.

We collect only what we reasonably need to run our business and serve you well. Depending on how you interact with us, this may include:

3.1 Information You Provide Directly

3.2 Information Collected Automatically

3.3 Information From Third Parties

We may receive limited information about you from:

• Advertising and analytics partners (e.g., Google Ads, Meta/Facebook, LinkedIn), when you interact with our ads or click through to the Site;
• Business partners and channel referral arrangements (e.g., real estate broker or referral partners), where you have been referred to us and have consented to that referral;
• Publicly available sources (e.g., a LinkedIn profile you share with us during a job application).

We currently do not run tracking pixels on the Site, but we may deploy Google Tag Manager, Google Analytics, and/or the Meta Pixel in the future. When we do, this Policy will be updated and, where legally required, we will request your consent through a cookie banner before any non-essential tracking is activated.

We process your personal data for the following purposes, and on the following legal bases:

We do not use your personal data for any purpose incompatible with the purposes above without notifying you and, where required, obtaining fresh consent.

We do not sell your personal data. We share it only as follows:

• Service providers (“Data Processors”): vendors who process data on our behalf and under our instructions, including:
  • HubSpot (CRM and marketing automation)
  • Resend (transactional email delivery)
  • MongoDB Atlas (database hosting)
  • DigitalOcean (application and file storage hosting, including DigitalOcean Spaces for uploaded documents/images)
  • Strapi-based content management (internal use only; does not process visitor personal data beyond what is needed to run the Site)
  • Payment gateway and invoicing providers (where a paid booking is made)
• Clayworks group entities and affiliated business units (e.g., Workelastic, Maati), where relevant to fulfilling a cross-referred enquiry, and only with your knowledge;
• Professional advisors (auditors, lawyers, accountants) as needed for legitimate business or compliance purposes;
• Government or regulatory authorities, where required by law, court order, or to protect our legal rights;
• A successor entity, in the event of a merger, acquisition, or sale of business assets — subject to that entity being bound by materially equivalent privacy commitments.

Every third-party processor we use is contractually required to protect your data and to use it only for the purposes we specify.

We use cookies and similar technologies to make the Site work and to understand how it's used.

You can control cookies through your browser settings at any time. Disabling certain cookies may affect Site functionality. Where legally required, we will present a cookie consent banner before activating non-essential cookies.

We keep personal data only for as long as necessary for the purposes described in this Policy, including to satisfy legal, accounting, or reporting requirements. As a general guide:

• Enquiry/CRM data: retained for the duration of the business relationship and for a reasonable period thereafter (typically up to 3 years from last contact), unless you request earlier deletion.
• Booking and invoicing data: retained as required under applicable Indian tax and company law (generally up to 8 years).
• Job application data: retained for up to 12 months from the date of application, unless you are hired (in which case HR retention rules apply) or you ask us to delete it sooner.
• Marketing consent records: retained until you withdraw consent, plus a reasonable period to evidence compliance.

When data is no longer needed, we delete or anonymise it in accordance with our internal data retention practices.

We take reasonable technical and organisational measures to protect your personal data, including encrypted hosting infrastructure, access controls, credential rotation practices, and restricted administrative access to systems handling personal data. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach likely to affect you, we will notify you and the relevant authorities as required under applicable law.

Subject to applicable law (including the DPDP Act, 2023), you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Erase your personal data, subject to our legal retention obligations;
• Withdraw consent at any time for processing based on consent (e.g., marketing communications), without affecting the lawfulness of processing before withdrawal;
• Nominate another individual to exercise your rights on your behalf in the event of death or incapacity (as permitted under the DPDP Act);
• Grievance redressal — raise a complaint about how we have handled your data.

To exercise any of these rights, contact our Grievance Officer using the details in Section 13. We will respond within the timeframe required by applicable law. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India or the relevant supervisory authority.

Opting out of marketing: every marketing email includes an unsubscribe link. You may also opt out by messaging us on WhatsApp/phone or emailing our Grievance Officer.

If you apply for a role at Clayworks through our Careers page, we collect the information you submit (resume, cover letter, and related details) solely to evaluate your candidacy, communicate with you about the role, and, if applicable, to fulfil our internal hiring, onboarding, and record-keeping obligations. We do not use applicant data for marketing purposes. Applicant data is stored securely and retained per Section 7 above.

The Site is intended for business use by adults (18 years and above) evaluating or using our workspace solutions. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

Some of our service providers (including cloud hosting and database infrastructure) may process or store data outside India, including in Singapore. Where we transfer personal data internationally, we take reasonable steps to ensure it is protected consistently with this Policy and applicable law, including through contractual safeguards with our processors.

In accordance with the DPDP Act, 2023 and applicable Indian law, you may contact our Grievance Officer for any questions, requests, or complaints regarding this Policy or our handling of your personal data:

We aim to acknowledge grievances promptly and resolve them within the timelines prescribed by applicable law.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. We will post the revised Policy on this page with an updated “Last Updated” date. For material changes, we will provide additional notice (e.g., a banner on the Site or an email) where required by law.

This Policy is governed by the laws of India. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka, India.