Data Stewardship Codex · Multi-Jurisdictional Privacy Architecture

Comprehensive Privacy Policy, Telemetry Ingestion Codex & Data Rights Framework

Statutory Framework Ref: PRIV-GDPR-DPDPA-2026.4 · Extraterritorially Enforceable

DISAVOWAL OF PECUNIARY RESTITUTION IN DATA CONTINGENCIES

STATUTORY STIPULATION: WHILE THIS CODEX CODIFIES OUR COMPREHENSIVE PROTOCOLS CONCERNING DATA CONFIDENTIALITY, ALL SUBSCRIBERS EXPLICITLY COVENANT THAT NEITHER UNINTENDED DATA ERASURE, HARDWARE PURGING, DATABASE CORRUPTION, NETWORK LATENCY, NOR PLATFORM INACCESSIBILITY SHALL UNDER ANY JURIDICAL RATIONALE IMPOSE RESTITUTIONARY OR PECUNIARY LIABILITY UPON bookwithqr. UNDER NO CIRCUMSTANCE WHATSOEVER ARE FEES REFUNDABLE, DISCOUNTABLE, OR RETRACTABLE IN THE EVENT OF ANY DATA LOSS, DATA MUTATION, OR CLOUD INFRASTRUCTURE FAILURE.

Article I.Epistemological Demarcation: Data Controller vs. Data Processor

In strict accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 - “GDPR”), the Indian Digital Personal Data Protection Act, 2023 (“DPDPA”), the California Consumer Privacy Act as amended (“CCPA/CPRA”), and congruent extraterritorial privacy statutes, bookwithqr operates under a bifurcated legal ontology:

  • Data Controller: The Company acts as an autonomous Data Controller solely with respect to subscriber administrative credentials, billing metadata, technical telemetry logs, and direct inquiries submitted via our public interfaces (such as bookwithqr.com);
  • Data Processor / Fiduciary Agent: With respect to end-client personal dossiers, salon appointment booking records, customer telephone numbers, and Point-of-Sale billing logs uploaded or generated by the merchant subscriber, the SUBSCRIBER REMAINS THE SOLE AND EXCLUSIVE DATA CONTROLLER. bookwithqr functions exclusively as a transient computational Data Processor executing programmatic instructions on behalf of the subscriber.

Article II.Exhaustive Taxonomy of Ingested Telemetry and Personal Data

Our multi-tenant application environment captures and processes discrete data taxonomies strictly necessary for operational orchestration:

Tenant Identity Telemetry

Enterprise trade name, administrative email identities, salted-and-hashed cryptographic authentication tokens (Bcrypt/Argon2id), billing identifiers, payment processor transaction tokens, and tax identification numbers.

Artisanal Operations Telemetry

Client appointment booking schedules, patron names, dialling numbers, electronic mail vectors, point-of-sale itemizations, inventory stock SKUs, and employee commission attribution logs.

Network & Device Telemetry

Client IP addresses (IPv4 and IPv6 representations), user-agent parsing tokens, hardware screen geometries, HTTP referrer headers, transport security handshakes, and diagnostic performance metrics.

Notification Routing State

Telegram chat identifiers, Viber delivery verification receipts, WhatsApp Business webhook status payloads, and automated reminder delivery confirmation stamps.

Article III.Lawful Juridical Bases for Algorithmic Processing

Every discrete computational operation executed upon personal data is validated under rigorous lawful foundations:

  • Contractual Performance (Art. 6(1)(b) GDPR): Executing authentication handshakes, multi-tenant database partitioning, appointment scheduling synchronization, and generating POS invoices;
  • Legitimate Commercial Interests (Art. 6(1)(f) GDPR): Mitigating denial-of-service incursions, enforcing rate-limiting heuristics, debugging server execution faults, and protecting multi-tenant data boundaries;
  • Statutory Compliance (Art. 6(1)(c) GDPR): Adhering to accounting standards, statutory invoice archival, tax reporting, and responding to judicial warrants issued by competent courts.

Article IV.Retention Protocols, Erasure Cycles & Total Exculpation for Data Loss

Data is retained during the active operational tenure of the subscriber’s contract. Following termination, cancellation, or abandonment of an account, data enters a thirty (30) day dormant grace lifecycle, following which the Company possesses the unencumbered right to execute irreversible cryptographic overwriting and catastrophic binary deletion.

Absolute Exculpatory Protocol on Data Corruption & Strict Non-Refundability:

THE SUBSCRIBER EXPLICITLY COVENANTS THAT IN THE EVENT THAT ANY DATA IS DELETED, PURGED, LOST, CORRUPTED, ALTERED, LEAKED, OR RENDERED INACCESSIBLE—WHETHER ARISING THROUGH ACCIDENTAL OPERATOR ERROR, MALICIOUS CYBERNETIC EXPLOITS, HARDWARE CRASHES, CLOUD HOST DECOMMISSIONING, OR SYSTEM OUTAGES—bookwithqr DISCLAIMS ALL MONETARY AND RESTITUTIONARY LIABILITY. UNDER NO CIRCUMSTANCE WHATSOEVER SHALL ANY REFUND, COMPENSATION, COMPENSATORY DAMAGES, REBATE, OR REVERSAL BE CONCEDED FOR LOSS OF DATA OR INACCESSIBILITY OF CLOUD ARCHIVES.

Article V.Data Subject Rights & Procedural Authentication Protocols

Qualified data subjects possess specific statutory prerogatives, subject to procedural identity verification:

  • The right to demand formal confirmation and copies of personal data under processing (Right of Access);
  • The right to rectify inaccurate or obsolete personal data entries (Right to Rectification);
  • The right to demand cryptographic erasure of records where statutory retention mandates have elapsed (Right to Erasure);
  • The right to export tenant customer ledgers in structured, machine-readable CSV format (Right to Portability).

To exercise these statutory prerogatives, formal requests may be transmitted via our dedicated Data Subject Access Request Portal.

Article VI.Statutory Data Protection Officer & Supervisory Liaison

For jurisprudential inquiries, regulatory oversight submissions, or data protection officer consultations, communication must be addressed to:

Designation: Data Protection Officer & Regulatory Compliance Counsel

Entity: bookwithqr Computational Data Governance

Privacy Direct: [email protected]

Statutory Grievance Redressal: [email protected]