DECCAN RESERVE
The House · Privacy Policy

Privacy Policy

What the House knows about you, why, who else sees it, how long it is kept, and your rights under India’s Digital Personal Data Protection Act, 2023.

Version
2026-11
Issued by
Deccan Reserve, Banjara Hills, Hyderabad, Telangana

Who is responsible

Deccan Reserve, Banjara Hills, Hyderabad, Telangana (“the House”) decides how your personal data is used, and is its Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“the DPDP Act”). Questions and requests go to The House Registrar at [email protected].

What the House collects

Your application
Name, email address, mobile number, what you do, your introduction, and a password (stored only as a one-way hash).
Your identity
Your PAN, stored encrypted, and the copy of your PAN card or passport you upload, kept in private storage that only the House’s administrators can open. The House asks you not to send your Aadhaar.
Your deposit
The amount, how you paid, and the payment and refund references from Razorpay or your bank transfer. Card and bank details are entered with Razorpay and are not seen or stored by the House.
Your activity
Your paddle number, every bid you place and when, any standing maximum you leave with the House (kept secret from other members and sellers), the lots you watch, your viewing requests, any non-binding syndicate interest you register, the lots you consign with their descriptions and photographs, invoices and settlement records for lots you buy or sell, and your acceptance of these terms and its date.
Invitations
If you invite someone, the email address you give for them and whether they applied. The House uses it only to send that one invitation.
WhatsApp
If you switch on WhatsApp alerts, your WhatsApp number and when you agreed. You can switch them off on your Credentials page at any time; the House then deletes the number.
Emails
The emails the House sends you (confirmations, outbid notices, reminders before lots you watch or bid on close, results, invoices, deposit receipts) and any you send the Registrar.
Technical data
Your IP address and browser details, in server logs and to limit repeated attempts to sign in or apply.

Why, and on what basis

The House processes your data with your consent, which you give when you apply and when you accept these documents, and for the uses the DPDP Act allows without it, such as complying with the law. It uses your data to:

  • decide on your application and keep you informed about it;
  • verify who you are before you bid, so sellers know every bid is from a real, identified person;
  • take, hold and return your deposit;
  • run the sale: record bids, bid for you up to any maximum you leave, tell you when you are outbid or a lot you follow is closing, arrange viewings, and introduce buyer and seller when a lot sells;
  • issue invoices and track payment and handover;
  • keep the site secure and prevent fraud; and
  • meet the House’s legal, tax and accounting obligations.

The House does not sell your data, and does not use it for advertising.

Who else sees it

  • Other members see you only by paddle number.
  • The seller of a lot you bid on sees your name, so they know who is bidding. When a lot sells, buyer and seller are introduced so the sale can complete.
  • The House’s service providers, who process data only on the House’s instructions: website hosting and backups, email delivery, Razorpay for payments, Meta for WhatsApp alerts (only if you switch them on), and Cloudflare, which carries traffic to the site and protects it from attack.
  • Authorities, where the law requires it.

Some of these providers may process data outside India. Where they do, it is only to countries the Government of India has not restricted under the DPDP Act.

If you came to the House through one of its partners, by their link (which leaves a cookie naming them for 60 days) or their referral code, the House records that partner and may pay them a finder’s fee; it does not share your application or your bids with them.

Cookies

The site uses the cookies it needs to work: a session cookie that keeps you signed in, and a security token that protects your forms from being submitted by another site. Cloudflare may also set a cookie to tell people from automated traffic. One more cookie is set only if you arrive through a partner’s link: it holds nothing but that partner’s code, for 60 days, so the House knows who introduced you. There are no analytics or advertising cookies, and no cookie is used to follow you across other sites.

How long it is kept

  • Your account, bids and consignments are kept while you are a member.
  • If an application is declined or a membership ends, the House keeps records of bids, sales and deposits for 8 years, as tax and accounting law may require, and erases the rest once it is no longer needed.
  • Your identity document is erased once the House no longer needs it to show who placed a bid or bought a lot.
  • Copies held in backups are overwritten as the backups rotate.

Your rights

Under the DPDP Act you may:

  • Access a summary of the personal data the House holds about you, what it does with it, and who it has been shared with;
  • Correct or update data that is inaccurate or incomplete;
  • Erase data the House no longer needs, except what the law requires it to keep;
  • Withdraw your consent at any time. This does not affect what was done before, and without it the House may be unable to keep your membership open;
  • Nominate someone to exercise these rights for you in the event of your death or incapacity; and
  • Raise a grievance with the House, and, if it is not resolved, complain to the Data Protection Board of India.

Every request is read and answered by a person. Nothing is erased automatically: the House first confirms that the request came from you. Signed-in members can use the data request form; anyone may also write to the grievance officer below.

Grievance officer

The House Registrar
Deccan Reserve, Banjara Hills, Hyderabad, Telangana
[email protected]

The House aims to reply to every request within 30 days.

Keeping it safe

Your PAN is encrypted. Identity documents are kept in private storage and served only to the House’s administrators. Backups are encrypted. Access to members’ data is limited to the people at the House who need it. No system is perfectly secure; if a breach affects your data, the House will tell you and the Data Protection Board as the DPDP Act requires.

Changes

When this policy changes, its version above changes too, and you will be asked to accept the new version before your next bid.