Privacy Policy
Last updated: November 2, 2026
PRIVACY POLICY
Blosical
Operated by Blosical Private Limited
Effective Date: November 2, 2026
Last Updated: November 2, 2026
Version: 1.0
1. INTRODUCTION, SCOPE AND STATUS OF THIS POLICY
1.1 Blosical Private Limited, a company incorporated under the Companies Act, 2013, having its registered office at 8- 106 /WeWork Blue One Square, Sector 18, Phase-IV, Gurugram, Haryana 122016, and bearing Corporate Identity Number U74200HR2022PTC103715 (the "Company", "we", "us" or "our"), operates the Blosical platform. This Privacy Policy explains how we collect, use, disclose, transfer, store, retain and protect Personal Data in connection with the Platform, and describes the rights available to you in respect of that Personal Data.
1.2 The "Platform" means the website at https://blosical.com and all subdomains including any fan or storefront subdomain, the Blosical mobile applications for iOS and Android, all application programming interfaces, and all features and services made available through them.
1.3 This Policy applies to every person who accesses or uses the Platform, including Artists holding a Creator Account, Fans and other purchasers, Business Users accessing the Business Portal, and visitors who browse the Platform without registering.
1.4 This Policy is issued in accordance with the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Information Technology Act, 2000 and the rules made under it including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. It constitutes an electronic record within the meaning of Section 2(1)(t) of the Information Technology Act, 2000 and does not require a physical or digital signature.
1.5 This Policy forms an integral part of the Terms of Service available at https://blosical.com/terms, and capitalised expressions not defined in this Policy bear the meanings assigned to them in the Terms of Service. In the event of an inconsistency between this Policy and the Terms of Service in relation to the processing of Personal Data, this Policy prevails.
1.6 Annexure I contains supplementary information for data subjects in the European Economic Area, the United Kingdom and Switzerland. Annexure II contains supplementary information for residents of the State of California. Those Annexures apply in addition to, and where inconsistent in respect of the persons to whom they apply prevail over, the main body of this Policy.
2. OUR ROLE AND CONTACT PARTICULARS
2.1 In respect of Personal Data which we determine the purpose and mean of processing, we act as a Data Fiduciary under the DPDP Act and, where Annexure I applies, as a controller. This includes Personal Data collected for account registration, authentication, billing, security, support, communications and compliance.
2.2 In respect of Personal Data which an Artist or a Business User processes through the Platform for its own purposes, including the contact and delivery details of a Fan collected for the fulfilment of an Order, or the contact details of a collaborator, we act as a Data Processor on behalf of that Artist or Business User, and that Artist or Business User acts as an independent Data Fiduciary. Clause 14 sets out the consequences of that allocation.
2.3 General privacy enquiries may be addressed to contact@blosical.com. The particulars of the Grievance Officer and of the person designated to respond to questions about the processing of Personal Data are set out in Clause 18.
3. DEFINITIONS
"Data Fiduciary" means a person who alone or in conjunction with others determines the purpose and means of processing of Personal Data, and bears the meaning assigned to it under Section 2(i) of the DPDP Act.
"Data Principal" means the individual to whom the Personal Data relates, and bears the meaning assigned to it under Section 2(j) of the DPDP Act.
"Data Processor" means a person who processes Personal Data on behalf of a Data Fiduciary.
"Personal Data" means any data about an individual who is identifiable by or in relation to such data, and bears the meaning assigned to it under Section 2(t) of the DPDP Act.
"Processing" means a wholly or partly automated operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment, combination, indexing, sharing, disclosure by transmission, dissemination, restriction, erasure or destruction.
"Sensitive Personal Data or Information" bears the meaning assigned to it under Rule 3 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and includes passwords and financial information such as bank account, card and payment instrument details.
4. PERSONAL DATA WE COLLECT
4.1 Account and identity data- When you register an Account, we collect your email address, username, password in hashed form, and, at your option, your full name. Where you hold a Creator Account, we may additionally collect your stage name, legal name, country of residence, date of birth or age confirmation, telephone number and profile photograph.
4.2 Verification, payout and tax data: Where you receive proceeds through the Platform, you or the Payment Processor may collect, and we may receive identity documents, Permanent Account Number, Goods and Services Tax registration number, tax residency particulars, bank account or payment instrument particulars in masked form, and the outcome of any know your customer or sanctions screening check. We do not collect or store complete card numbers, card verification values or banking credentials, all of which are collected directly by the Payment Processor.
4.3 Professional and catalogue data: Where you hold a Creator Account, we collect the content of your profile and electronic press kit, including your biography, discography, credits, placement history, audience figures and links to external services, together with your Catalogue and its Metadata, including titles, contributor and role credits, songwriter and publisher shares, ownership shares, ISRC, ISWC and UPC identifiers, release dates and technical particulars. Metadata which identifies a natural person, including a contributor credit or a share allocation, constitutes Personal Data of that person.
4.4 Transaction and commerce data: Where you place or fulfil an Order, we collect the particulars of the Order, the items purchased, the amount paid, the currency, the billing address, the delivery address, the recipient name, the contact telephone number and email address, the shipment tracking reference, and the particulars of any cancellation, return, refund, chargeback or dispute.
4.5 Agreement and collaboration data: We collect the particulars recorded in Split Sheets and Collaboration Agreements, including the names, roles, contributions and percentage shares of the parties, the date and manner of execution, and the audit trail associated with electronic execution. We collect the content of messages, project records and audio files, stems and other material exchanged through the collaboration features.
4.6 Business Portal data: Where you access the Business Portal we collect your business name, your role, your business contact details, the particulars of your organisation, and a record of the Works you view, shortlist, request or licence.
4.7 Technical and usage data: We automatically collect the internet protocol address from which you access the Platform, approximate location derived from that address, device identifiers, device model, operating system and version, browser type and version, application version, language and time zone settings, referring and exit pages, the pages and features accessed, the time and duration of access, crash and diagnostic reports, and cookie and similar identifiers.
4.8 Data from connected third-party services: Where you elect to connect a third-party service to your Account, such as a distributor, a digital service provider, a copyright society or an analytics provider, we collect from that service, within the scope of the authorisation you grant and only to the extent accessible to you as a logged-in user of that service, your Catalogue, Metadata, statements, royalty and earnings data, audience data and account identifiers. We do not access any such service otherwise than as an authorised user acting within the scope of your consent.
4.9 Data from public and licensed sources: We may collect Metadata and catalogue particulars from publicly accessible registries, databases and application programming interfaces, including mechanical licensing and copyright society databases, in order to prefill or supplement a Catalogue and to generate the estimated figures described in Clause 4.10. Where such data identifies you, it constitutes your Personal Data and this Policy applies to it.
4.10 Derived and estimated data: We generate estimated, projected and indicative figures, including estimated streaming and publishing revenue, estimated revenue exposure, catalogue and audience analytics and engagement metrics. Such figures are modelled estimates derived from incomplete data, are not statements of account, and must not be relied upon for any commercial, accounting, tax, lending or investment purpose.
4.11 Communications and support data: We collect the content of your correspondence with us, including support tickets, grievance submissions, complaints, takedown notices and counter statements, together with the associated metadata.
4.12 Consequences of not providing data: Where Personal Data is required for the performance of a contract with you or for compliance with Applicable Law, and you do not provide it, we may be unable to create or maintain your Account, process a payment or payout, fulfil an Order, publish a Work or make a feature available to you.
5. PURPOSES OF PROCESSING AND LAWFUL BASIS
5.1 We process Personal Data in the following ways: to create, authenticate, administer and secure your Account; to provide the Platform and its features, including the profile, electronic press kit, Catalogue, Storefront, collaboration and Business Portal surfaces; to process Subscription payments, Orders, payouts, refunds, chargebacks and reversals; to generate, store and give effect to Split Sheets, Collaboration Agreements, invoices, statements and dashboards; to verify entitlement in a Work and to conduct the administrative rights checks described in the Terms of Service; to transmit Metadata and Catalogue data to a third-party service which you have authorized; to arrange shipping and to enable delivery and tracking of an Order; to compute and display analytics, estimates and reports; to communicate with you in relation to your Account, a transaction, a security incident or a change to our terms; to provide customer support and to receive and dispose of grievances; to prevent, detect and investigate fraud, infringement, abuse, security incidents and breaches of our terms; to maintain records for accounting, tax, audit and statutory purposes; to establish, exercise or defend a legal claim, and to comply with Applicable Law and the order or direction of a court, tribunal or statutory authority; to conduct research, product analytics and improvement, using aggregated or de-identified data wherever practicable; and, where you have consented, to send marketing communications and to feature you in promotional material.
5.2 Under the DPDP Act, we process Personal Data based on your consent, given by an affirmative action in response to a notice issued under Section 5, and, where applicable, based on certain legitimate uses recognised under Section 7 of that Act, including where you have voluntarily provided Personal Data for a specified purpose and have not indicated that you do not consent to its use, and where processing is necessary for compliance with a judgment, decree, order or law in force in India.
5.3 We do not use Personal Data for a purpose which is incompatible with the purpose for which it was collected, unless we have first issued a further notice and obtained your consent to that purpose.
5.4 We do not sell Personal Data. We do not share Personal Data with any third party for that third party's own independent advertising purposes.
5.5 We do not use your unreleased Works, stems, audio files or Catalogue to train, fine-tune or evaluate any machine learning or artificial intelligence model, and we do not permit any third party to do so, without your prior express consent.
6. NOTICE, CONSENT AND WITHDRAWAL OF CONSENT
6.1 Where we process Personal Data on the basis of your consent, we will, in accordance with Section 5 of the DPDP Act, give you a notice before or at the time of seeking consent which identifies the Personal Data sought, the purpose of processing, the manner in which you may exercise your rights, and the manner in which you may make a complaint to the Data Protection Board of India. That notice is made available in English and, on request, in any language specified in the Eighth Schedule to the Constitution of India.
6.2 Your consent is limited to the Personal Data necessary for the specified purpose. Consent given by you is free, specific, informed, unconditional and unambiguous, and is signified by a clear affirmative action.
6.3 You may withdraw your consent at any time, with the same ease with which it was given, through the settings available in your Account or by written notice to Nairesto@blosical.com. On withdrawal, we will cease processing for the purpose concerned within a reasonable period, and will cause any Data Processor engaged by us to do the same, unless retention or continued processing is required or permitted under Applicable Law.
6.4 Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and does not relieve you of the consequences of withdrawal, which may include the suspension or closure of your Account or the unavailability of a feature.
6.5 Where you provide to us the Personal Data of any other person, including a collaborator, a session musician, a band member, a delivery recipient or an employee, you represent and warrant that you have obtained that person's consent, or hold another lawful basis, for the disclosure of that Personal Data to us and for its processing in accordance with this Policy.
7. DISCLOSURE OF PERSONAL DATA AND CATEGORIES OF RECIPIENT
7.1 We disclose Personal Data only in the circumstances described in this Clause 7 and in the Schedule below, and only to the extent necessary for the purpose concerned.
7.2 Disclosure to other Users. Your public profile, stage name, biography, Catalogue listings, electronic press kit and Storefront are visible to other Users and, where you have made your profile public, to the general public. Where you place an Order, your name, delivery address and contact details are disclosed to the Artist for the purpose of fulfilment. Where you participate in a collaboration, your name, role, contribution, share and the content of your messages are disclosed to the other participants. Where you make a Work available through the Business Portal, your Catalogue and contact particulars are disclosed to Business Users.
7.3 Disclosure to service providers. We engage service providers to perform functions on our behalf. Each such provider is engaged under a written contract which restricts its processing to our documented instructions, requires it to implement reasonable security safeguards, and prohibits it from using the Personal Data for its own purposes. The categories of recipient are set out in the Schedule below.
7.4 Disclosure on legal grounds. We may disclose Personal Data where required by Applicable Law, by an order or direction of a court, tribunal, regulator, law enforcement agency or statutory authority, or where necessary to establish, exercise or defend a legal claim, to enforce our terms, to prevent or investigate fraud or a security incident, or to protect the rights, property or safety of any person.
7.5 Disclosure on a corporate transaction. We may disclose Personal Data to a prospective or actual acquirer, investor, merged entity, successor or assignee, and to their professional advisers, in connection with a merger, amalgamation, demerger, scheme of arrangement, reorganisation, redomiciliation, corporate conversion, financing, sale of business or sale of assets, subject to appropriate confidentiality undertakings. Any successor will be bound by this Policy in respect of Personal Data transferred to it, unless and until you are given notice of and, where required, consent to a different policy.
7.6 The following Schedule sets out the categories of recipient to whom Personal Data is disclosed, the purpose of the disclosure, the categories of Personal Data concerned and the basis of any transfer outside India. The identity of specific vendors within each category is available on request to the Grievance Officer.
Schedule of Recipient Categories
Category of recipient
Purpose of disclosure
Categories of Personal Data
Location and transfer basis
Payment processor and payment aggregator
Processing of Subscription payments, Orders, payouts, refunds, chargebacks and reversals; know your customer and sanctions screening
Name, email address, billing address, transaction particulars, payout and tax particulars, identity documents, device and fraud signals
India and United States. Contractual safeguards. Transfer necessary for performance of a contract with you
Shipping, logistics and courier providers
Generation of shipping quotes and labels, despatch, delivery and tracking of Orders
Recipient name, delivery address, contact telephone number and email address, order and parcel particulars
India and other territories depending on destination. Contractual safeguards
Distributors, digital service providers, copyright societies, performing rights organisations and mechanical licensing bodies
Transmission of Catalogue and Metadata at your direction; retrieval of statements, royalty and audience data under your authorisation
Name, stage name, contributor credits, ownership and share particulars, account identifiers, earnings and statement data
India, United States, United Kingdom and European Union. Your consent and contractual safeguards
Cloud hosting, storage, content delivery and database providers
Hosting, storage, backup, disaster recovery and delivery of the Platform and of User Content
All categories of Personal Data processed on the Platform, in each case as stored data
India and other territories in which the provider operates. Contractual safeguards and encryption
Product analytics, crash reporting and performance monitoring providers
Measurement of usage, diagnosis of defects, security monitoring and improvement of the Platform
Device and technical data, internet protocol address, usage events, crash reports, pseudonymous identifiers
Predominantly United States. Contractual safeguards. Aggregated or de-identified wherever practicable
Communications, email and notification providers
Delivery of transactional, service, security and, where consented, marketing communications
Name, email address, telephone number, communication preferences and delivery status
Predominantly United States. Contractual safeguards
Customer support, ticketing and grievance management providers
Receipt, triage and disposal of support requests and grievances
Name, email address, Account identifier and the content of your correspondence
India and United States. Contractual safeguards
Identity, fraud prevention and content moderation providers
Verification of identity and entitlement, prevention and detection of fraud, abuse and infringement
Identity and verification data, device and fraud signals, reported content and associated metadata
India and United States. Contractual safeguards
Professional advisers, auditors and insurers
Legal, tax, accounting, audit and insurance purposes
Such Personal Data as is necessary for the advice or service concerned
India, and other territories where the adviser is situated. Professional confidentiality and contractual safeguards
Courts, tribunals, regulators, law enforcement and statutory authorities
Compliance with Applicable Law and with an order or lawful direction
Such Personal Data as is required to be disclosed
India, and other territories where a competent authority has jurisdiction. Legal obligation
Acquirers, investors, successors and their advisers
Evaluation and completion of a corporate transaction as described in Clause 7.5
Such Personal Data as is necessary, disclosed in aggregated or restricted form wherever practicable
As applicable to the transaction. Confidentiality undertakings
8. TRANSFER OF PERSONAL DATA OUTSIDE INDIA
8.1 The Platform is operated from India. Personal Data is stored primarily in India and may be transferred to, stored in and processed in other territories where our service providers operate, as described in the Schedule to Clause 7.
8.2 Any transfer outside India is effected in accordance with Section 16 of the DPDP Act and any notification issued under it restricting transfer to a specified territory, and, in relation to Sensitive Personal Data or Information, in accordance with Rule 7 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which permits transfer only where the same level of data protection is ensured and where the transfer is necessary for the performance of a lawful contract or has been consented to by you.
8.3 We do not transfer Personal Data to any territory to which transfer has been restricted by the Central Government by notification. Where such a notification is issued in respect of a territory to which we transfer, we will relocate the processing or terminate the arrangement within the time permitted.
8.4 Where Annexure I applies, transfers out of the European Economic Area or the United Kingdom are affected on the basis of the Standard Contractual Clauses adopted by the European Commission, and the United Kingdom International Data Transfer Addendum, as applicable, together with such supplementary measures as are appropriate. A copy of the relevant transfer mechanism is available on request to the Grievance Officer.
9. COOKIES AND SIMILAR TECHNOLOGIES
9.1 We use cookies, local storage, software development kits and similar technologies. Strictly necessary cookies enable authentication, session management, security and load balancing, and cannot be disabled without rendering the Platform inoperable. Functional cookies remember your preferences. Analytics cookies measure usage and performance. We do not presently use advertising or cross-site tracking cookies.
9.2 On first access to the website you are presented with a cookie notice enabling you to accept, decline or manage non-essential categories. You may change your preference at any time through that notice, and may in addition block or delete cookies through your browser settings, which may affect the functioning of the Platform.
9.3 We do not respond to browser do-not-track signals, there being at present no accepted standard for such signals. The treatment of an opt-out preference signal for the purposes of California law is addressed in Annexure II.
10. RETENTION AND ERASURE
10.1 We retain Personal Data only for so long as is necessary for the purpose for which it was collected, or for such longer period as is required or permitted by Applicable Law.
10.2 Indicatively: Account and profile data is retained for the life of the Account and for a period of ninety days after closure, to permit reactivation and to address disputes; transaction, invoice, tax and payout records are retained for eight years from the end of the relevant financial year, in accordance with Section 128 of the Companies Act, 2013 and applicable tax legislation; Split Sheets, Collaboration Agreements and their execution audit trails are retained for the term of the underlying rights and thereafter for the period of limitation applicable to a claim upon them; communication and support records are retained for three years; security, access and audit logs are retained for one hundred and eighty days in accordance with the directions issued by the Indian Computer Emergency Response Team, or for such longer period as a security investigation requires; and marketing consent records are retained for the period during which consent subsists and for two years thereafter as evidence of consent.
10.3 On closure of your Account, or on withdrawal of consent, we will erase your Personal Data and cause our Data Processors to do the same, save to the extent that retention is necessary for compliance with Applicable Law, for the maintenance of transaction, tax and audit records, for giving effect to a Split Sheet, Collaboration Agreement, Order or license already entered into, for the establishment, exercise or defence of a legal claim, or for the preservation of backup or archival copies until they are overwritten in the ordinary cycle.
10.4 Content which you have disclosed to another User, including a message sent to a collaborator, a file shared in a project or a share particular recorded in an executed Split Sheet, may remain accessible to that User notwithstanding the closure of your Account.
10.5 We may retain aggregated or de-identified data, from which you cannot reasonably be identified, without limit of time, and will not attempt to re-identify such data.
11. SECURITY SAFEGUARDS
11.1 We implement reasonable security safeguards to prevent a personal data breach, in accordance with Section 8(5) of the DPDP Act and Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. These include encryption of data in transit using transport layer security and encryption of data at rest, hashing and salting of passwords, role-based access control and the principle of least privilege, multi-factor authentication for administrative access, network segregation and firewalls, logging and monitoring, periodic vulnerability assessment and penetration testing, secure development practices, vendor due diligence, and internal policies on confidentiality and incident response.
11.2 No system is capable of being made entirely secure. While we take the measures described above, we do not warrant that the Platform or any transmission to it is free of vulnerability, and any transmission is undertaken at your own risk. You are responsible for safeguarding your Account credentials and for enabling any additional authentication factor made available to you.
11.3 In the event of a personal data breach, we will notify the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under the DPDP Act and the rules made under it, and will report the incident to the Indian Computer Emergency Response Team within 24 (Twenty four) hours of becoming aware of it, in accordance with the directions issued under Section 70B(6) of the Information Technology Act, 2000. Where Annexure I applies, we will additionally notify the competent supervisory authority within seventy two hours where the breach is notifiable.
12. RIGHTS OF DATA PRINCIPALS
12.1 Subject to and in accordance with the DPDP Act, you have the following rights: the right to obtain a summary of the Personal Data being processed and of the processing activities undertaken, together with the identities of all other Data Fiduciaries and Data Processors with whom the Personal Data has been shared and a description of the Personal Data so shared, under Section 11; the right to correction, completion, updating and erasure of your Personal Data, under Section 12; the right of grievance redressal in respect of any act or omission of the Company regarding the performance of its obligations, under Section 13; and the right to nominate another individual to exercise your rights in the event of your death or incapacity, under Section 14.
12.2 You may exercise these rights through the settings available in your Account or by written request to the Grievance Officer at the particulars in Clause 18. We may require you to verify your identity before acting on a request, and may decline a request which is manifestly unfounded, excessive or repetitive, or which would prejudice the rights of another person, giving reasons.
12.3 We will respond to a request within such period as is prescribed and, in the absence of a prescribed period, within thirty days of receipt of a verifiable request. There is no fee for making a request.
12.4 You are under a duty, under Section 15 of the DPDP Act, to comply with Applicable Law when exercising your rights, not to impersonate another person, not to suppress material information when providing Personal Data for any document or identifier issued by the State, not to register a false or frivolous grievance or complaint, and to furnish only information which is verifiably authentic when seeking correction or erasure.
12.5 If you are dissatisfied with our response, you may make a complaint to the Data Protection Board of India in the manner prescribed under the DPDP Act.
13. AUTOMATED PROCESSING AND PROFILING
13.1 We use automated processing to generate the estimates and analytics described in Clause 4.10, to rank and recommend collaborators and Works, to detect fraud, abuse and infringement, and to screen content and transactions for risk.
13.2 We do not take any decision which produces a legal effect concerning you or which similarly significantly affects you based solely on automated processing without human involvement. Where an automated system flags an Account, a Work or a transaction, the resulting action, including suspension, withholding of a payout or removal of content, is subject to human review, and you may seek a review of the outcome through the grievance mechanism in Clause 18.
14. ARTISTS AND BUSINESS USERS AS INDEPENDENT DATA FIDUCIARIES
14.1 Where an Artist or a Business User obtains Personal Data through the Platform, including the name, delivery address and contact details of a Fan for the fulfilment of an Order, the contact details of a collaborator, or a mailing list subscription, that Artist or Business User determines its own purpose and means of processing and is therefore an independent Data Fiduciary in respect of that Personal Data.
14.2 Such an Artist or Business User must process the Personal Data only for the purpose for which it was disclosed, must not use it for unsolicited marketing without a valid consent, must implement reasonable security safeguards, must publish its own privacy notice where required, must honour the rights of Data Principals, and must comply with the DPDP Act and any other applicable data protection law. The Company is not responsible for the processing of Personal Data by any Artist or Business User, and any grievance in that regard should be raised with that person in the first instance and may thereafter be escalated to our Grievance Officer.
15. MARKETING AND PROMOTIONAL COMMUNICATIONS
15.1 We send transactional and service communications, including communications relating to your Account, a transaction, a security incident and a change to our terms, on the basis of our contract with you. You cannot opt out of such communications while you hold an Account.
15.2 We send marketing communications only where you have consented. You may withdraw consent at any time through the unsubscribe facility in the communication or through your Account settings.
15.3 Where you elect to follow an Artist or to subscribe to an Artist's mailing list, your contact details are disclosed to that Artist and the resulting communications are sent by that Artist and not by us. Clause 14 applies to that processing.
15.4 Where we feature you, your name, likeness or Work in a case study, testimonial or promotional material, we do so on the basis of the promotional licence granted under the Terms of Service, which you may withdraw at any time by notice to contact@blosical.com.
16. LINKS TO THIRD-PARTY SERVICES
16.1 The Platform contains links to, and integrations with, third-party services, including social media platforms, streaming services, distributors and the Payment Processor. Those services are controlled by third parties and are governed by their own privacy policies. We do not control and are not responsible for their processing of Personal Data. You should review the privacy policy of each such service before using it or connecting it to your Account.
17. CHILDREN
17.1 The Platform does not knowingly process the Personal Data of a child within the meaning of Section 2(f) of the DPDP Act. without the informed consent of a guardian.
17.2 Where we become aware that we have processed the Personal Data of a child without verifiable consent of a parent or lawful guardian, we will cease that processing, delete the Personal Data and close the Account concerned. If you believe that we hold the Personal Data of a child, please notify the Grievance Officer immediately.
17.3 We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
18. GRIEVANCE REDRESSAL AND CONTACT
18.1 Any grievance, request or question in relation to this Policy or to the processing of your Personal Data may be addressed to the Grievance Officer, whose particulars are as follows. Name: Abhishek Nair. Designation: Grievance Officer. Entity: Blosical Private Limited. Address: 8- 106 /WeWork Blue One Square, Sector 18, Phase-IV, Gurugram, Haryana 122016. Email: Nairesto@blosical.com.
18.2 The Grievance Officer is designated both under Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and as the person to answer questions of Data Principals about the processing of their Personal Data under Section 8(9) of the DPDP Act. The Grievance Officer will acknowledge a grievance within twenty-four hours and will endeavour to dispose of it within fifteen days of receipt.
18.3 General enquiries may be addressed to contact@blosical.com and support enquiries to support@blosical.com.
19. CHANGES TO THIS POLICY
19.1 We may amend this Policy from time to time. The amended Policy will be posted on the Platform with a revised effective date and, where the amendment is material or where it involves processing for a new purpose requiring your consent, we will give you notice by email or by in-product notification and, where required, obtain your fresh consent before the amendment takes effect in relation to you.
19.2 We maintain an archive of prior versions of this Policy, a copy of which is available on request to the Grievance Officer.
ANNEXURE I: SUPPLEMENTARY INFORMATION FOR DATA SUBJECTS IN THE EUROPEAN ECONOMIC AREA, THE UNITED KINGDOM AND SWITZERLAND
This Annexure applies where the General Data Protection Regulation (Regulation (EU) 2016/679), the United Kingdom General Data Protection Regulation read with the Data Protection Act 2018, or the Swiss Federal Act on Data Protection applies to our processing of your personal data. In this Annexure, expressions defined in those instruments bear the meanings assigned to them there.
A1.1 CONTROLLER AND REPRESENTATIVE
A1.1.1 Blosical Private Limited is the controller of the personal data described in Clause 2.1 of this Policy. Where we process personal data on behalf of an Artist or a Business User as described in Clause 2.2, that person is the controller and we are a processor.
A1.1.2 We have not at present appointed a representative in the European Union or the United Kingdom under Article 27. Where our processing brings us within the scope of that Article, we will appoint a representative and publish its particulars in this Annexure.
A1.2 LEGAL BASES FOR PROCESSING
A1.2.1 Performance of a contract under Article 6(1)(b): creation and administration of your Account, provision of the Platform and its features, processing of Subscriptions, Orders, payouts and refunds, generation and storage of Split Sheets and Collaboration Agreements, transmission of Metadata at your direction, and provision of support.
A1.2.2 Compliance with a legal obligation under Article 6(1)(c): maintenance of accounting, tax and audit records, response to lawful requests of a competent authority, and notification of a personal data breach.
A1.2.3 Legitimate interests under Article 6(1)(f): security, fraud and abuse prevention, protection of intellectual property, product analytics and improvement, direct marketing to existing customers where permitted, enforcement of our terms, and the establishment, exercise or defence of legal claims. In each case we have assessed that our interests are not overridden by your interests or fundamental rights, and you may obtain a summary of that assessment on request.
A1.2.4 Consent under Article 6(1)(a): non-essential cookies and analytics, electronic marketing communications where consent is required, use of your name, likeness and Work in promotional material, and the connection of a third-party service to your Account. You may withdraw consent at any time without affecting the lawfulness of prior processing.
A1.2.5 We do not seek to process special category data under Article 9. You should not upload identity documents, health information or other special category data except where expressly requested for a verification or payout purpose, in which case processing is undertaken on the basis of Article 9(2)(a) or (f) as applicable.
A1.3 YOUR RIGHTS
A1.3.1 You have the right of access under Article 15, the right to rectification under Article 16, the right to erasure under Article 17, the right to restriction of processing under Article 18, the right to data portability under Article 20, the right to object to processing carried out on the basis of legitimate interests and, at any time and without qualification, to processing for direct marketing, under Article 21, and the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, under Article 22.
A1.3.2 You may exercise these rights by writing to the Grievance Officer at the particulars in Clause 18. We will respond within one month of receipt, extendable by two further months where the request is complex or numerous, in which case we will inform you of the extension and the reasons for it.
A1.3.3 You have the right to lodge a complaint with the supervisory authority of the member state of your habitual residence, place of work or place of the alleged infringement, or, in the United Kingdom, with the Information Commissioner's Office.
A1.4 INTERNATIONAL TRANSFERS
A1.4.1 Personal data is transferred to India and to the other territories identified in the Schedule to Clause 7. India has not been the subject of an adequacy decision of the European Commission or of the United Kingdom. Such transfers are therefore effected on the basis of the Standard Contractual Clauses adopted by the European Commission under Implementing Decision (EU) 2021/914, and, in respect of United Kingdom transfers, the International Data Transfer Addendum issued by the Information Commissioner, together with such supplementary technical, organisational and contractual measures as are appropriate following a transfer impact assessment. A copy of the relevant clauses, with commercially confidential terms redacted, is available on request.
A1.5 RETENTION
A1.5.1 Retention periods are as set out in Clause 10. Where no period is specified, personal data is retained for so long as is necessary for the purpose concerned and thereafter for the applicable limitation period.
ANNEXURE II: SUPPLEMENTARY INFORMATION FOR RESIDENTS OF CALIFORNIA
This Annexure applies to residents of the State of California and is issued under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (the "CCPA"). Expressions defined in the CCPA bear the meanings assigned to them there. This Annexure applies only to the extent the CCPA applies to our processing.
A2.1 CATEGORIES OF PERSONAL INFORMATION AND NOTICE AT COLLECTION
A2.1.1 In the preceding twelve months we have collected the following categories of personal information: identifiers, including name, stage name, email address, postal address, telephone number, Account identifier, internet protocol address and device identifier; personal information described in Section 1798.80(e) of the California Civil Code, including name, address, telephone number, and financial and payment account information in masked form; commercial information, including records of Orders, Subscriptions, purchases and licensing enquiries; internet and other electronic network activity information, including usage, session, referral and interaction data; geolocation data of an approximate and non-precise nature derived from internet protocol address; professional or employment-related information, including your role, credits, catalogue and business particulars; audio and visual information, including profile photographs, audio files and artwork you upload; and inferences drawn from the foregoing, including estimated revenue, audience analytics and collaborator recommendations. We do not collect biometric information, education information or precise geolocation.
A2.1.2 The sources, purposes and categories of recipient of each category are as set out in Clauses 4, 5 and 7 of this Policy.
A2.1.3 Sensitive personal information. Where we collect an account log-in in combination with a credential permitting access to the Account, or government identification numbers for a payout or verification purpose, that information is sensitive personal information. We use and disclose it only for the purposes permitted by Section 7027(m) of the CCPA regulations, namely to perform the services requested, to prevent and investigate security incidents and fraud, to ensure physical safety, and to verify and maintain the quality of our services. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you, and accordingly no right to limit its use arises.
A2.2 SALE, SHARING AND RETENTION
A2.2.1 We do not sell personal information, and have not done so in the preceding twelve months. We do not share personal information for cross-context behavioural advertising, and have not done so in the preceding twelve months. We do not have actual knowledge of selling or sharing the personal information of any consumer under sixteen years of age, the Platform being restricted to persons of eighteen years and above.
A2.2.2 We disclose personal information for business purposes to the categories of recipient set out in the Schedule to Clause 7. Each such recipient is engaged as a service provider or contractor under a written agreement which restricts its use of the personal information to the performance of the services.
A2.2.3 Retention periods are as set out in Clause 10. We do not retain personal information for longer than is reasonably necessary for the disclosed purpose.
A2.3 YOUR CALIFORNIA RIGHTS
A2.3.1 You have the right to know the categories and specific pieces of personal information we have collected, the categories of source, the business or commercial purpose, and the categories of third party to whom it is disclosed; the right to delete personal information, subject to the exceptions in Section 1798.105(d); the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information, which is not applicable given Clause A2.2.1; the right to limit the use of sensitive personal information, which is not applicable given Clause A2.1.3; and the right not to receive discriminatory treatment for exercising any of these rights. We do not offer any financial incentive in exchange for personal information.
A2.3.2 You may exercise these rights by writing to the Grievance Officer at the particulars in Clause 18. We will acknowledge a request within ten business days and respond within forty five days, extendable by a further forty five days where reasonably necessary, in which case we will notify you of the extension.
A2.3.3 We will verify your request by matching the information you provide against the information held in your Account, and may request additional information where the request concerns sensitive or valuable personal information. An authorised agent may submit a request on your behalf on production of written authority signed by you, and we may require you to verify your identity directly.
A2.3.4 Because we do not sell or share personal information, we do not act on opt-out preference signals. Should our practices change, this Annexure will be amended and we will honour such signals as required by the CCPA.
ACKNOWLEDGEMENT
By accessing or using the Blosical Platform, or by giving your consent in response to a notice issued under Section 5 of the Digital Personal Data Protection Act, 2023, you acknowledge that you have read and understood this Privacy Policy.
Blosical Private Limited, operating the Blosical platform.