Privacy Policy
This Privacy Policy ("Policy") explains how ZillionCosmos Private Limited ("ZillionCosmos", "Company", "we", "us" or "our") collects, uses, stores, shares and otherwise processes your personal data when you visit zillioncosmos.in and its sub-pages (the "Website"), respond to our advertisements on Facebook, Instagram, WhatsApp, Google or any other platform, submit an enquiry or lead form, or communicate with us by phone, SMS, WhatsApp, email or in person (together, the "Services").
This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), the Information Technology Act, 2000 and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (to the extent applicable), and other applicable laws of India (together, "Applicable Law").
By submitting your personal data to us, you confirm that you have read and understood this Policy. Where we rely on your consent, we will ask for it clearly and separately, and you may withdraw it at any time as described in Section 7.
1. Who we are
ZillionCosmos Private Limited is a company incorporated under the Companies Act, 2013, providing real estate digital marketing, buyer acquisition and sales support services to real estate developers in Maharashtra, India.
Registered office: [REGISTERED OFFICE ADDRESS]
CIN: [CIN]
Email: [privacy@zillioncosmos.in]
WhatsApp / Phone: +91 77570 74945
Website: zillioncosmos.in
For the personal data described in this Policy, ZillionCosmos acts as a Data Fiduciary, meaning we decide the purpose and means of processing. Where we pass your enquiry to a real estate developer, that developer independently decides how it processes your data and acts as a separate Data Fiduciary (see Section 9).
2. Definitions
In this Policy, the following terms have the meanings given to them under the DPDP Act: "personal data" (any data about an individual who is identifiable by or in relation to such data); "Data Principal" (the individual to whom the personal data relates, referred to as "you"); "Data Fiduciary"; "Data Processor"; "processing"; "consent"; "Consent Manager"; "personal data breach"; and "Board" (the Data Protection Board of India). "Developer" means a real estate developer or promoter whose project we market.
3. Scope
This Policy applies to digital personal data, and to personal data collected in non-digital form that is later digitised, which we process in connection with the Services. It does not apply to data that has been anonymised so that it no longer identifies you, to data you have made publicly available yourself, or to the privacy practices of third parties (including Meta, Google and Developers), which are governed by their own policies.
4. Personal data we collect
| Category | Examples |
|---|---|
| Identity and contact data | Full name, mobile number, WhatsApp number, email address (if provided), city or locality. |
| Enquiry and preference data | Project or property of interest, configuration (e.g. 1/2/3 BHK, shop), budget range, intended funding (home loan or own funds), purchase timeline, preferred site-visit date and time, and other answers you give in our forms. |
| Communication data | Content of WhatsApp chats, SMS, emails and call notes; call recordings (only where we tell you at the start of the call that it is being recorded). |
| Site-visit and transaction data | Site-visit attendance, unit shortlisted, booking status and the stage of your enquiry, as shared with or by the Developer. We do not collect your bank, card, PAN, Aadhaar or other KYC documents. Those are collected directly by the Developer or your lender. |
| Platform data | Information Meta, Google or a similar platform passes to us when you submit a lead form on that platform (such as your name and phone number as stored in your profile, and the ad or form you responded to), and the platform's verification of your phone number where enabled. |
| Technical and usage data | IP address, device and browser type, pages viewed, referring URL, time spent, approximate location derived from IP, and cookie or pixel identifiers (see Section 17). |
We do not intentionally collect information about your health, religion, caste, sexual orientation, political opinions, biometric data or financial account credentials. Please do not share these with us.
5. How we collect personal data
- Directly from you: when you fill in a form on our Website, landing pages or social media lead forms, message us on WhatsApp, call us, or speak to our team at a site visit or event.
- Through advertising platforms: when you submit an instant form or click-to-WhatsApp ad on Facebook or Instagram (Meta Platforms, Inc. / Meta Platforms Ireland Ltd.), or a lead form on Google or another platform. The platform shares the details you submit with us.
- Automatically: through cookies, pixels (such as the Meta Pixel and Google tags) and analytics tools when you use the Website.
- From Developers: updates on the status of your enquiry, site visit or booking, so we can coordinate follow-up and calculate our service fees.
6. Purposes and lawful basis of processing
We process your personal data only for lawful purposes, on the basis of your consent under Section 6 of the DPDP Act or for certain legitimate uses under Section 7 of the DPDP Act, as set out below.
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry; sharing pricing, cost sheets, floor plans, brochures and project information you asked for | Consent, given when you submit the form or message us; and voluntary provision under Section 7(a) |
| Calling, messaging or emailing you to schedule and confirm site visits, and following up on your enquiry | Consent |
| Passing your enquiry to the Developer of the project you enquired about, and its authorised sales team | Consent |
| Recording enquiry source and status in our CRM and shared lead registers to attribute bookings and settle our fees with Developers | Consent; and voluntary provision under Section 7(a) |
| Sending you information about other projects that may suit your stated requirements | Separate consent, which you may refuse without affecting your enquiry |
| Measuring and improving advertising, including building custom and lookalike audiences on advertising platforms from hashed contact data | Consent |
| Website operation, security, fraud and spam prevention | Consent (non-essential cookies); legitimate use where strictly necessary |
| Complying with law, court orders, RERA or other regulatory requirements, and establishing, exercising or defending legal claims | Legitimate use under Section 7 of the DPDP Act |
We process only the personal data necessary for the purpose. We do not sell your personal data, and we do not use it for automated decisions that produce legal or similarly significant effects on you.
7. Consent and withdrawal
- Your consent is free, specific, informed, unconditional and unambiguous, and is given by a clear affirmative action such as submitting a form, ticking a box or sending us a message.
- You may withdraw consent at any time, as easily as you gave it, by replying "STOP" on WhatsApp, telling our caller, writing to [privacy@zillioncosmos.in], or messaging +91 77570 74945. Where available, you may also give, manage or withdraw consent through a Consent Manager registered with the Board.
- Once you withdraw consent, we will stop processing your personal data for that purpose within a reasonable time and will ask our Data Processors and the relevant Developer to do the same, unless retention is required or permitted by law.
- Withdrawal does not affect processing carried out before withdrawal. If you withdraw consent, we may no longer be able to assist with your enquiry.
8. Marketing calls and messages
By submitting an enquiry, you ask us to contact you about it by phone, SMS, WhatsApp and email, even if your number is registered on the National Do Not Call / DND registry. This request covers only the project you enquired about and similar projects matching your stated requirements, and you may revoke it at any time as described in Section 7. We comply with the Telecom Commercial Communications Customer Preference Regulations, 2018 issued by TRAI, and with WhatsApp's Business and Commerce Policies. We will not contact you between 9:00 pm and 9:00 am except at your request.
9. Sharing and disclosure
We share personal data only as described below and only to the extent necessary:
- Developers: the Developer (and its authorised sales staff and channel partners) of the project you enquired about, so they can show you the property, answer your questions and process any booking. The Developer processes your data as an independent Data Fiduciary under its own privacy policy and is responsible for its own compliance.
- Data Processors: service providers that process data on our behalf under a written contract and our instructions, such as CRM and lead-management tools, cloud hosting, WhatsApp Business solution providers, telephony and SMS providers, email providers, and analytics providers.
- Advertising platforms: Meta, Google and similar platforms, for ad delivery and measurement, including hashed (encrypted) contact data used to build custom audiences or to exclude existing enquirers.
- Professional advisers: lawyers, auditors and accountants, under a duty of confidentiality.
- Legal and regulatory disclosures: government authorities, courts, MahaRERA, the Board, law enforcement or other bodies where required by law, or to protect the rights, property or safety of ZillionCosmos, our clients or others.
- Business transfers: a successor entity in a merger, acquisition, restructuring or sale of assets, subject to this Policy.
10. Transfers outside India
Some of our Data Processors and advertising platforms store or process data on servers outside India. Such transfers are made in accordance with Section 16 of the DPDP Act and will not be made to any country or territory restricted by the Central Government by notification. We require recipients to protect the data with safeguards no less protective than those in this Policy.
11. Retention and erasure
- We retain personal data only for as long as necessary for the purposes in Section 6, or as required by law.
- Enquiry and lead records are generally retained for 24 months from your last interaction with us, so that bookings can be correctly attributed and fees settled with Developers, after which they are erased or anonymised.
- Records needed for tax, accounting, contractual or legal purposes (for example, booking attribution and invoices) are retained for the period required by the relevant law, which may be up to 8 years.
- Traffic data and logs of processing are retained for at least one year, as required by the DPDP Rules, for security and breach investigation.
- Where we erase data because you have not engaged with us for the prescribed period, we will notify you at least 48 hours before erasure where the DPDP Rules require it, so you can tell us if you wish us to keep it.
12. Security
We implement reasonable security safeguards, as required under Section 8(5) of the DPDP Act and the DPDP Rules, to protect personal data against unauthorised access, use, disclosure, alteration and destruction. These include encryption in transit, role-based access control, multi-factor authentication on business accounts, access logging and monitoring, confidentiality obligations on staff and processors, and backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
13. Personal data breach
If a personal data breach occurs, we will, in accordance with the DPDP Act and the DPDP Rules:
- inform affected Data Principals without delay, in plain language, of the nature, extent, timing and likely impact of the breach, the mitigation steps taken, the safety measures they can take, and how to contact us; and
- intimate the Board without delay, and furnish a detailed report within 72 hours of becoming aware of the breach (or such longer period as the Board may allow).
14. Your rights
Subject to Applicable Law, you have the right to:
- Access information (Section 11): a summary of the personal data we process about you and the processing activities, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared, together with a description of the data shared.
- Correction, completion, updating and erasure (Section 12): to have inaccurate or incomplete data corrected, completed or updated, and to have data erased once it is no longer needed for its purpose, unless retention is required by law.
- Grievance redressal (Section 13): to have your grievance addressed by our Grievance Officer (Section 20).
- Nominate (Section 14): to nominate another individual to exercise your rights in the event of your death or incapacity.
- Withdraw consent at any time (Section 7).
To exercise these rights, write to [privacy@zillioncosmos.in] or message +91 77570 74945 with your name, the mobile number you used, and your request. We may need to verify your identity before acting. We will respond within the time required by law, and in any case within 30 days.
15. Your duties
Under Section 15 of the DPDP Act, you must comply with Applicable Law when exercising your rights. You must not impersonate another person, suppress material information, file false or frivolous grievances or complaints, and you must provide only verifiably authentic information. Please submit enquiries only for yourself, or with the consent of the person whose details you provide.
16. Children
Our Services are intended only for individuals aged 18 years or older. We do not knowingly process personal data of children (individuals under 18) or persons with disabilities who have a lawful guardian. If we learn that we have collected such data without verifiable consent of the parent or lawful guardian as required by Section 9 of the DPDP Act, we will delete it promptly. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
17. Cookies and tracking technologies
The Website uses:
- Strictly necessary cookies, which the Website needs to function and keep secure;
- Analytics cookies (such as Google Analytics), to understand how visitors use the Website; and
- Advertising pixels and tags (such as the Meta Pixel and Conversions API, and Google Ads tags), to measure ad performance and show relevant ads.
Non-essential cookies are used only with your consent. You can refuse or delete cookies through your browser settings, and manage ad preferences in your Facebook, Instagram and Google account settings. Refusing cookies may affect parts of the Website.
18. Third-party platforms and links
When you interact with our ads or pages on Facebook, Instagram, WhatsApp, Google, YouTube or similar platforms, those platforms also collect data under their own privacy policies, such as the Meta Privacy Policy and the Google Privacy Policy. The Website may link to Developer websites, MahaRERA and other third-party sites. We are not responsible for their content or privacy practices.
19. Real estate disclaimer
Project information, images, prices and offers shown in our advertisements and on the Website are provided by or on behalf of the respective Developer for informational purposes only and do not constitute an offer, invitation to offer or contract. Images may be artistic impressions. Prices are indicative, generally exclude stamp duty, registration, GST and other charges, and are subject to change. Please verify all details, including the MahaRERA registration, at maharera.maharashtra.gov.in and with the Developer before making any decision.
20. Grievance Officer
In accordance with Section 8(9) of the DPDP Act and Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, our Grievance Officer, who can also answer your questions about processing of your personal data, is:
Name: [GRIEVANCE OFFICER NAME]
Designation: [DESIGNATION]
Email: [privacy@zillioncosmos.in]
WhatsApp / Phone: +91 77570 74945
Address: [REGISTERED OFFICE ADDRESS]
Working hours: Monday to Saturday, 10:00 am to 6:00 pm IST
We will acknowledge your grievance within 48 hours and resolve it within 30 days of receipt. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India in the manner prescribed under the DPDP Act, after exhausting the grievance redressal process with us.
21. Changes to this Policy
We may update this Policy from time to time to reflect changes in law or in our practices. The updated Policy will be posted on this page with a revised "Last updated" date. Where changes are material, we will notify you by reasonable means and, where required by law, ask for fresh consent.
22. Governing law and jurisdiction
This Policy is governed by the laws of India. Subject to the jurisdiction of the Data Protection Board of India under the DPDP Act, the courts at [Mumbai / Thane], Maharashtra shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.