Logo

Privacy Policy

CUPID LIMITED

WEBSITE PRIVACY POLICY & DATA PROTECTION NOTICE

Compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act) & Information Technology Rules

Data Fiduciary Name:

Cupid Limited (CIN: L25193MH1993PLC070846)

Registered Office:

A-68, MIDC, Sinnar, Nashik – 422111, Maharashtra, India

Effective Date & Version:

August 2026 | Version 2.0 (DPDP Act 2023 Edition)

Governing Statute:

Digital Personal Data Protection Act, 2023 (DPDP Act) read with IT Act, 2000

Grievance & Privacy Officer:

Grievance Redressal Officer (privacy@cupidlimited.com / info@cupidlimited.com)

 

IMPORTANT LEGAL NOTICE UNDER DPDP ACT, 2023
This Privacy Policy informs you about how Cupid Limited collects, uses, stores, shares, and protects your personal data when you visit https://www.cupidlimited.com/, interact with our investor relations portal, contact our customer support, or engage with our commercial products and services. In accordance with Section 6 of the Digital Personal Data Protection Act, 2023 (DPDP Act), processing of your personal data is based on your explicit consent or applicable statutory grounds.

 

  1. INTRODUCTION AND LEGAL SCOPE

Cupid Limited (“Company”, “We”, “Us”, or “Our”) is a premier healthcare, wellness, and medical device manufacturing company registered under the Companies Act, 1956/2013, having its registered office at A-68, MIDC, Sinnar, Nashik – 422111, Maharashtra, India. As a public limited company listed on BSE and NSE, and as a global manufacturer and exporter of male/female condoms, lubricants, IVD diagnostic kits, and personal care products, Cupid Limited is committed to maintaining the highest standards of data privacy, security, and statutory compliance.

This Privacy Policy (“Policy”) establishes the privacy framework governing the collection, processing, storage, disclosure, and transfer of Digital Personal Data collected from Data Principals who access our official website (https://www.cupidlimited.com/), submit web forms, apply for employment, or interact with our investor and corporate governance portals.

This Policy has been formulated strictly pursuant to:

  • The Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) and Rules framed thereunder;
  • The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
  • Securities and Exchange Board of India (SEBI) Listing Obligations and Disclosure Requirements (LODR) Regulations, 2015 for shareholder data governance.
  1. DEFINITIONS & KEY CONSTRUCTS

For the purposes of this Policy, the following terms shall have the meanings ascribed to them under Section 2 of the DPDP Act, 2023:

  • “Data Principal” (User / Shareholder / Visitor): Means any individual to whom the personal data relates. Where such individual is a child (under 18 years of age) or a person with disability, it includes their parent or lawful guardian.
  • “Data Fiduciary”: Means Cupid Limited, which alone or in conjunction with other persons determines the purpose and means of processing personal data.
  • “Data Processor”: Means any entity or individual who processes personal data on behalf of Cupid Limited under a valid contract (e.g., website hosts, Registrar & Transfer Agents, IT vendors).
  • “Personal Data”: Means any data about an individual who is identifiable by or in relation to such data, collected in digital form or digitized subsequently.
  • “Processing”: In relation to personal data, means a wholly or partly automated operation or set of operations performed on personal data, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment, sharing, or erasure.
  • “Personal Data Breach”: Means any unauthorized processing or accidental disclosure, acquisition, sharing, alteration, destruction, or loss of access to personal data that compromises its confidentiality, integrity, or availability.
  • “Board” / “DPBI”: Means the Data Protection Board of India established by the Central Government under Section 18 of the DPDP Act, 2023.
  1. CATEGORIES OF PERSONAL DATA COLLECTED

Cupid Limited collects personal data only to the extent reasonably necessary to fulfill specific, lawful purposes. The categories of personal data collected include:

3.1 Data Provided Directly by You

  • Contact & Inquiry Data: Full name, business/residential address, official/personal email address, telephone number, job title, and organization name when you submit forms via our ‘Contact Us’ or inquiry pages.
  • Shareholder & Investor Data: Name, PAN (Permanent Account Number), Demat account number (DP ID & Client ID), folio number, bank account details (for unpaid/unclaimed dividend processing), address, and official correspondence submitted via KYC forms.
  • Job Applicant Data: Curriculum Vitae (CV), employment history, educational qualifications, professional references, and identity proofs submitted for career inquiries.
  • Vendor & Commercial Partner Data: Authorized signatory details, GST registration details, PAN, bank account credentials, and professional contact information.

3.2 Technical Data Collected Automatically

  • Device & Technical Identifiers: Internet Protocol (IP) address, operating system, browser type and version, language settings, device model, and time-zone settings.
  • Website Usage Data: Pages visited, session duration, referring URL, clickstream data, and navigation patterns on https://www.cupidlimited.com/.
  • Cookies & Identifiers: Data collected via essential and analytical cookies (e.g., Google Analytics) to ensure web performance, security, and optimized user experience.
  1. SPECIFIED PURPOSES AND LEGAL BASIS FOR PROCESSING

In strict compliance with Section 4, Section 6, and Section 7 of the DPDP Act, 2023, Cupid Limited processes personal data solely for specified, lawful purposes based on either Explicit Consent or Certain Legitimate Uses.

Data Category

Specified Processing Purpose

Legal Basis (DPDP Act)

Retention Period

Web Inquiries & Support

To respond to product inquiries, customer support requests, and commercial RFPs.

Explicit Consent (Sec 6)

Duration of inquiry + 1 year

Shareholder KYC & Dividends

To process dividend payments, handle IEPF transfers, manage shareholder registers, and comply with SEBI/Companies Act rules.

Legitimate Use / Statutory Duty (Sec 7(a))

Statutory requirement (7-8 years under Companies Act)

Job Applications

To evaluate candidates, schedule interviews, and conduct background verification.

Explicit Consent (Sec 6)

1 year from submission unless hired

Website Security & Analytics

To detect cyber threats, prevent unauthorized access, maintain server stability, and optimize website layout.

Legitimate Use / Explicit Consent

Session duration / Max 2 years for aggregated analytics

Regulatory Compliance

To comply with judicial orders, statutory investigations, tax disclosures, and SEBI compliance filings.

Certain Legitimate Use (Sec 7(b))

As mandated by applicable statutory laws

 

  1. NOTICE, CONSENT ARCHITECTURE AND CONSENT WITHDRAWAL

Under Section 6 of the DPDP Act, 2023, consent given by a Data Principal must be freely given, specific, informed, unconditional, and unambiguous with clear affirmative action.

5.1 Itemized and Clear Notice

Every request for personal data on our website (e.g., contact forms, shareholder registration) is accompanied by a clear, standalone notice detailing the specific purpose of collection, the right to withdraw consent, and contact details of our Grievance Redressal Officer. Such notice is available in English and may be made available upon request in any language specified in the 8th Schedule to the Constitution of India.

5.2 Mechanism to Withdraw Consent

In accordance with Section 6(4) of the DPDP Act, you have the right to withdraw your consent for personal data processing at any time. Withdrawal of consent can be initiated by:

  • Submitting an email request to our Data Protection / Grievance Officer at privacy@cupidlimited.com or info@cupidlimited.com;
  • Clicking the ‘Unsubscribe’ link present in our commercial email communications; or
  • Adjusting your preferences on our web Cookie Management Banner.

Effect of Withdrawal: Upon receipt of your request to withdraw consent, Cupid Limited and its Data Processors shall cease processing your personal data within a reasonable timeframe (not exceeding 30 days), unless continued processing is required or authorized under statutory obligations (such as Companies Act or SEBI regulations). Withdrawal of consent does not affect the lawfulness of processing conducted prior to such withdrawal.

  1. DATA PRINCIPAL RIGHTS UNDER DPDP ACT, 2023

Sections 11 to 14 of the DPDP Act grant Data Principals specific statutory rights regarding their digital personal data. Cupid Limited has established dedicated procedures to honor these rights:

  • Right to Access Information (Sec 11): You have the right to request a summary of your personal data being processed by us, the identities of all third parties with whom your personal data has been shared, and any other information prescribed by DPDP Rules.
  • Right to Correction & Completion (Sec 12(1)): You have the right to request correction of inaccurate or misleading data, completion of incomplete personal data, and updating of obsolete records.
  • Right to Erasure / To Be Forgotten (Sec 12(2)): You have the right to request erasure of your personal data when the processing purpose is no longer valid or upon consent withdrawal, subject to legal retention obligations.
  • Right to Grievance Redressal (Sec 13): You have the right to readily available grievance redressal provided by Cupid Limited regarding any act or omission concerning your personal data rights.
  • Right to Nominate (Sec 14): You have the right to nominate any other individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal.

HOW TO EXERCISE YOUR DATA RIGHTS
To exercise any of the above rights, please send a written request to privacy@cupidlimited.com specifying your full name, contact details, relationship with Cupid Limited (e.g., visitor, shareholder, vendor), and the specific right you wish to exercise. We will respond within 30 days of receiving a verified request.

 

  1. DATA FIDUCIARY OBLIGATIONS & SECURITY SAFEGUARDS

In accordance with Section 8 of the DPDP Act, 2023, Cupid Limited implements comprehensive technical, operational, and organizational security measures to prevent personal data breaches:

7.1 Technical & Security Controls

  • Encryption in Transit & at Rest: All data transmissions across https://www.cupidlimited.com/ are encrypted using SSL/TLS 1.2/1.3 protocol.
  • Access Control & Authentication: Strict role-based access control (RBAC) and least-privilege access protocols limit data access exclusively to authorized personnel.
  • Infrastructure Security: Web application firewall (WAF), regular patch management, malware scanning, and periodic Vulnerability Assessment & Penetration Testing (VAPT) audits.
  • Audit Logs & Monitoring: Automated system logging, intrusion detection, and audit trails to monitor data handling activities.

7.2 Personal Data Breach Protocols (Sec 8(6))

In the event of a confirmed or suspected Personal Data Breach, Cupid Limited shall immediately activate its Incident Response Protocol and notify the Data Protection Board of India (DPBI) and affected Data Principals in the manner and form prescribed under the DPDP Rules.

  1. DATA RETENTION, ARCHIVAL AND ERASURE

Under Section 8(7) of the DPDP Act, Cupid Limited shall erase personal data as soon as it is reasonable to assume that the specified purpose for which it was collected is no longer being served, or upon receipt of a valid erasure request from the Data Principal, whichever is earlier.

Statutory Exceptions: Notwithstanding consent withdrawal or purpose fulfillment, personal data may be retained for longer periods where required to comply with statutory laws, including:

  • Companies Act, 2013 & SEBI Regulations (Shareholder records, statutory filings: 7 to 8 years);
  • Income Tax Act, 1961 and GST Laws (Financial & transaction records: 8 years);
  • Litigation hold requirements in active legal disputes.
  1. THIRD-PARTY DISCLOSURES AND CROSS-BORDER TRANSFERS

Cupid Limited does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes.

9.1 Authorized Service Providers & Data Processors

We may share personal data with trusted third-party Data Processors under strict Data Processing Agreements (DPAs) that mandate compliance with DPDP standards:

  • Registrar & Transfer Agents (RTAs) (e.g., Bigshare Services / Link Intime) for managing shareholder records and dividend payouts;
  • IT hosting, cloud infrastructure, and website maintenance service providers;
  • Statutory auditors, legal counsel, and regulatory advisory partners;
  • Law enforcement agencies, tax authorities, or regulatory bodies pursuant to valid judicial orders or legal mandates.

9.2 Cross-Border Data Transfers (Sec 16)

Cupid Limited may transfer personal data outside India for hosting, analytics, or international business operations, provided that such transfer complies with Section 16 of the DPDP Act and is not restricted by any notification or negative list issued by the Central Government of India.

  1. PROVISIONS REGARDING CHILDREN AND PERSONS WITH DISABILITIES

In compliance with Section 9 of the DPDP Act, 2023:

  • Verifiable Parental Consent: Cupid Limited does not knowingly collect or process personal data of children under eighteen (18) years of age or persons with disabilities without obtaining verifiable consent from their parent or lawful guardian.
  • Prohibition on Tracking: We do not engage in behavioral tracking, targeted advertising, or processing of personal data that is likely to cause detrimental effects on the well-being of a child.
  1. COOKIE POLICY & TRACKING TECHNOLOGIES

Our website https://www.cupidlimited.com/ uses cookies and similar tracking technologies to enhance user experience, analyze traffic patterns, and maintain secure sessions.

Cookie Category

Description & Function

Control / Opt-Out

Strictly Necessary

Essential for website navigation, security, and functional performance. Cannot be switched off.

Mandatory for site operation

Performance / Analytics

Collects anonymized data regarding site visits, page load times, and user navigation (e.g., Google Analytics).

Opt-in via Cookie Banner

Functional Cookies

Remembers user preferences, language selection, and contact form pre-fills.

Opt-in via Cookie Banner

 

  1. GRIEVANCE REDRESSAL & DATA PROTECTION OFFICER

In accordance with Section 8(10) and Section 13 of the DPDP Act, 2023, Cupid Limited has designated a Data Protection / Grievance Redressal Officer to address all queries, concerns, and grievances regarding personal data processing.

DATA PROTECTION & GRIEVANCE REDRESSAL OFFICER DETAILS

Designation: Grievance Redressal Officer & Data Protection Lead

Company Name: Cupid Limited

Registered Address: A-68, MIDC, Sinnar, Nashik – 422111, Maharashtra, India

Dedicated Email: privacy@cupidlimited.com / info@cupidlimited.com

Telephone Contact: 02551-230280 / 02551-230282

Grievance Resolution SLA: Acknowledgement within 48 hours; Complete resolution within 30 days

 

Escalation to Data Protection Board of India (DPBI): If you are dissatisfied with the resolution provided by our Grievance Officer, or if your grievance is not resolved within 30 days, you have the statutory right under Section 13(3) of the DPDP Act to file a complaint directly with the Data Protection Board of India (DPBI).

  1. POLICY AMENDMENTS AND GOVERNANCE

Cupid Limited reserves the right to update or modify this Privacy Policy periodically to reflect changes in legal mandates, technological advancements, or our business operations. Any updates will be published on https://www.cupidlimited.com/ with a revised ‘Effective Date’. We encourage users and shareholders to review this page periodically to stay informed about how we protect their personal data.