Public legal documents
These notices work together. A form-specific notice may add detail but does not replace the Privacy Notice.
- Privacy Notice — project leads, accounts, OTP, appointments, uploads and communications.
- Cookie & Device Storage Notice — exact browser storage and optional technology controls.
- Website Terms of Use — site access, acceptable use and non-contractual enquiries.
- Privacy Rights & Grievance Redressal — how to exercise rights or raise a complaint.
- Submit a privacy request — encrypted intake, reference number and accountable follow-up.
- Engineering, Project & Content Disclaimer — limits of the assessment, renders, references and preliminary guidance.
India compliance matrix
| Page or disclosure | Status | Legal basis | What Cubora must do |
|---|---|---|---|
| Corporate website disclosure | Mandatory now | Companies Act, 2013 s.12 and Companies (Incorporation) Rules, 2014 r.26 | Legal name, registered office, CIN, telephone, email and a named queries/grievance contact on the landing page. |
| Privacy Notice | Mandatory / DPDP-ready | IT Act, 2000 s.43A; SPDI Rules, 2011 r.4; DPDP Act ss.5–8 and DPDP Rules r.3 when commenced | What data is collected, purposes, recipients, safeguards, retention, rights and how to withdraw consent. |
| Collection notice and contact consent | Mandatory / DPDP-ready | DPDP Act ss.5–6 and DPDP Rules r.3 when commenced | A clear just-in-time notice at the assessment, account and upload points; contact consent must be specific and recorded. |
| Privacy rights & grievance mechanism | Mandatory / DPDP-ready | SPDI Rules r.5(9); DPDP Act ss.11–14 and DPDP Rules r.14 when commenced | A visible channel for access, correction, erasure, withdrawal and grievances, with identity verification and response tracking. |
| Cookie & device storage notice | Required where storage processes personal data | IT Act/SPDI privacy principles; DPDP consent and notice framework when commenced | An accurate inventory of essential cookies, session storage, cache storage and any optional tracker. |
| Website Terms of Use | Strongly recommended | Indian Contract Act, 1872; IT Act, 2000; Consumer Protection Act, 2019 | Defines permitted use, intellectual property, external links, non-contractual enquiries and legal limitations. |
| Engineering & project disclaimer | Required for accurate consumer communication | Consumer Protection Act, 2019; CCPA Misleading Advertisement Guidelines, 2022 | Clearly separates indicative screening, renders and public references from engineering approval, a quote or a completed Cubora project. |
| SMS and communication consent | Conditional | TRAI TCCCPR, 2018 and DLT requirements | Service/OTP messages use registered headers and templates; promotional messages require a separate compliant consent record. |
| E-commerce disclosures, cancellation, refund, payment and delivery policies | Conditional—not currently triggered | Consumer Protection (E-Commerce) Rules, 2020 | Required if Cubora begins accepting online orders, contracts or payments. The current portal only captures project enquiries. |
| Children's privacy and verifiable parental consent | Conditional | DPDP Act s.9 and applicable DPDP Rules when commenced | Required if a service is directed to or knowingly processes data of people under 18. Cubora's project portal is intended for adults. |
What applies to the current portal
The current Cubora portal accepts project briefs, contact requests, OTP-based customer access and appointment preferences. It does not presently take an online payment, conclude a construction contract or operate a marketplace. On that basis, the Consumer Protection (E-Commerce) Rules are treated as a future-trigger obligation—not as a label applied to the current enquiry portal.
DPDP implementation timing. The DPDP Act and Rules are being brought into force in phases. Cubora is implementing the future-state notice, consent, rights and grievance design before those operational provisions commence; current IT Act/SPDI and consumer-law duties continue to apply.
Policies required behind the website
Public pages alone are not compliance. Cubora also needs approved internal controls for:
- a personal-data inventory, purpose register and processor/vendor register;
- retention and secure deletion for leads, OTP records, accounts, appointment data, uploads, logs and backups;
- access control, incident response, CERT-In reporting and security-log retention;
- data-principal request verification, response logs and consent withdrawal;
- vendor contracts for hosting, email, SMS, WhatsApp and any future analytics provider;
- DLT-approved SMS headers/templates and separate records for any promotional consent; and
- a content-evidence review so renders, public references and completed Cubora projects are never confused.
Official legal sources
- Digital Personal Data Protection Act, 2023 — India Code
- Digital Personal Data Protection Rules, 2025 — MeitY
- Information Technology Act, 2000 — India Code
- Companies (Incorporation) Third Amendment Rules, 2016 — India Code
- Consumer protection rules and CCPA guidelines — Department of Consumer Affairs
- Commercial communications guidance — TRAI