1. Introduction & Statutory Scope
Welcome to The Layer Company ("we," "our," "us," or "the Studio"). We operate an on-demand additive manufacturing, 3D printing, and sublimation studio based in Najafgarh, New Delhi, serving creators, engineering founders, and commercial clients across Delhi NCR and PAN India through our website (thelayercompany.com).
We are deeply committed to safeguarding personal data and client intellectual property. This Privacy Policy serves as the statutory notice under Section 5 of the Digital Personal Data Protection (DPDP) Act, 2023 (Act No. 22 of 2023, India), the Information Technology Act, 2000, and the Consumer Protection (E-Commerce) Rules, 2020. It transparently details how we collect, process, protect, and retain personal data and design assets.
Pursuant to Section 5(3) of the DPDP Act, this notice is presented in clear English. If you require access to this notice in any of the languages specified in the Eighth Schedule to the Constitution of India, please contact our Grievance Officer.
2. Information We Collect
In accordance with data minimization principles, we collect only the personal information strictly required to evaluate projects, execute additive manufacturing, manage logistics, and provide customer support:
- Contact & Communication Data: Full name, email address, telephone/WhatsApp number, delivery address, billing address, and organization or studio name submitted via our quote form, contact portal, or direct correspondence.
- Design & Technical Assets: Proprietary 3D CAD files (.STL, .STEP, .STP, .OBJ, .3MF, .ZIP archives), 2D vector illustrations, dimensional drawings, and project briefs.
- Commercial Records: Structured quotation summaries, purchase order numbers, billing invoices, and GST details required for statutory tax accounting. Note: We never process or store raw payment credentials such as credit card numbers, CVVs, net banking credentials, or UPI PINs.
- Telemetry & Technical Logs: Standard web server connection data (IP address, browser type, device category) collected solely for infrastructure security, fraud defense, and diagnostic reliability.
3. CAD & Design File Confidentiality Guarantee
We recognize that clients share confidential prototypes, unreleased hardware models, patented geometries, and trademarked brand mascots. Your digital files remain your sole and exclusive intellectual property.
Our operational protocol enforces strict confidentiality:
- Your CAD models and graphics are processed strictly for quoting, mesh analysis, slicing, machine setup, quality inspection, and fabrication of your authorized order.
- We will never sell, lease, publicize, license, or disclose your proprietary files to any outside third party.
- We will never photograph or publish images of your custom prototype or bespoke prints on our website, social media, or portfolio without your prior written authorization.
- Upon order completion and receipt confirmation, CAD files can be permanently erased from our workstations upon your written request.
4. Purpose of Processing & Legal Grounds
Under Section 4 and Section 6 of the DPDP Act, 2023, personal data is processed solely on the legal basis of your affirmative consent or for legitimate fulfillment purposes:
- Manufacturing & Fulfillment: Reviewing geometry, calculating material consumption, operating 3D printers, post-processing, packaging, and dispatching your finished pieces.
- Engineering Estimates: Providing formal itemized quotations, technical recommendations, and lead-time schedules.
- Transactional Communication: Sending dispatch notifications, courier tracking numbers, and technical customer service updates.
- Statutory Tax Compliance: Generating commercial tax invoices and fulfilling GST obligations under Indian law.
6. Payment Security & Payment Gateways
Online payments for shop purchases and confirmed custom quotations are executed exclusively through Reserve Bank of India (RBI) licensed payment gateways (such as Razorpay).
Payment information is transmitted using end-to-end Transport Layer Security (TLS 1.2/1.3) encryption directly to PCI-DSS Level 1 certified gateway processors. The Layer Company never has visibility or storage access to your payment card numbers, bank credentials, or UPI MPIN.
7. Logistics & Third-Party Service Providers
We share minimal necessary data strictly with trusted service partners under contractual confidentiality:
- Courier & Delivery Carriers: We share your recipient name, delivery destination, and phone number with verified logistics partners (e.g., Blue Dart, Delhivery, DTDC via Shiprocket) solely for package transit and live SMS/WhatsApp tracking updates.
- Secure Cloud Hosting: Website infrastructure and database backups are hosted on enterprise-grade infrastructure adhering to stringent security controls.
- Legal Disclosures: We may disclose data only when legally mandated by Indian law enforcement, court order, or statutory regulatory bodies.
8. Protection of Children's Personal Data (Section 9, DPDP Act)
In strict compliance with Section 9 of the Digital Personal Data Protection Act, 2023:
- The Layer Company's website, products, and custom manufacturing services are intended for individuals who are at least 18 years of age.
- We do not knowingly collect, process, or solicit personal data from children under 18 years of age without verifiable consent from their parent or lawful guardian.
- We do not engage in behavioral tracking, behavioral monitoring, or targeted advertising directed at children.
- If we discover that personal data of a minor has been collected without verifiable parental consent, we will promptly delete that information from our records.
9. Data Retention & Data Principal Rights (DPDP Act, 2023)
We retain transaction records and commercial invoices for the period mandated by Indian tax and accounting statutes (typically 8 years). Project CAD assets and inquiry messages are retained only as long as necessary for production review or re-orders, and are purged upon request.
Under Sections 11, 12, 13, and 14 of the DPDP Act, 2023, as a Data Principal you possess the following enforceable statutory rights:
- Right to Access (Section 11): You have the right to obtain a summary of personal data held about you and the identities of all third parties with whom your data has been shared.
- Right to Correction & Updating (Section 12): You may request the correction of inaccurate personal data, completion of incomplete records, or updating of your contact details.
- Right to Erasure (Section 12): You may request the deletion of your personal data when it is no longer required for the purpose for which it was collected or for statutory tax compliance.
- Right to Withdraw Consent (Section 6(4)): Where processing is based on consent, you may withdraw your consent at any time as easily as it was granted by writing to our Grievance Officer.
- Right to Nominate (Section 14): You have the legal right to nominate any individual who shall, in the event of your death or incapacity, exercise your data rights under the DPDP Act.
- Right of Grievance Redressal (Section 13): You have the right to a readily available grievance redressal mechanism regarding any act or omission by us regarding your personal data.
10. Grievance Redressal & Data Protection Board of India Escalation
In accordance with Rule 5(3)(e) of the Consumer Protection (E-Commerce) Rules, 2020 and Section 13 of the Digital Personal Data Protection Act, 2023, The Layer Company has appointed a designated Grievance Officer:
The Layer Company — Grievance Redressal & DPO Liaison
For inquiries regarding personal data, CAD confidentiality, withdrawal of consent, data deletion, or service grievances:
Redressal: within 30 days
Under Section 13(3) of the Digital Personal Data Protection Act, 2023, if you are not satisfied with the response or resolution provided by our Grievance Officer, or if you do not receive a response within the prescribed timeline, you have the legal right to register a formal complaint with the Data Protection Board of India in the manner prescribed under Indian law.