FlexiWork privacy notice

DBCB Baid Real Estate & Services Pvt. Ltd., together with its FlexiWork brand and affiliates (collectively, “FlexiWork”, “we”, “us”, or “our”), respects your privacy and is committed to protecting your Personal Data.

This Privacy Notice explains how we collect, use, disclose, store and otherwise process your Personal Data when you access or use:

• the FlexiWork website and related web pages;
• digital products, online services and applications operated by or on behalf of FlexiWork / DBCB; and
• any other digital channels through which FlexiWork provides its products and services.

The above are collectively referred to as the “Platforms” or the “Platform”.

This Privacy Notice applies to individuals who access or use the Platform, including prospective customers, members, employees of members, visitors, applicants, authorised representatives, vendors, business partners and other users interacting with FlexiWork through the Platform.

By using our website, you acknowledge that you have read and understood this Privacy Notice. Our Platforms may contain links to third-party websites or services; those are governed by their own privacy policies, and we do not control how they handle your data. Our Terms of Service also apply to use of the Site.

Parent company information and corporate contacts for DBCB are published on DBCB Realty.

Terms below are used in line with the DPDPA and our internal privacy practices:

• “Personal Data” means any data about an individual who can be identified by or in relation to that data.
• “Data Principal” refers to the individual to whom the Personal Data relates (for example, you as a user of our website).
• “Data Fiduciary” means the entity that determines the purpose and means of processing Personal Data. For this notice, FlexiWork / DBCB acts as the Data Fiduciary.
• “Data Processor” means any person or entity that processes Personal Data on behalf of the Data Fiduciary.
• “Processing” means any operation performed on Personal Data, including collection, storage, use, sharing, or deletion.
• “Consent” means your clear, informed, and voluntary agreement for processing your Personal Data for a specific purpose. You may withdraw consent at any time.

We process your Personal Data in accordance with applicable data protection laws, including the DPDPA.

2.1 Consent

In most cases, we process Personal Data based on your consent — for example, when you fill out a form, request a quote, create an account, or choose to receive marketing communications. When we rely on consent, we explain why data is collected, you may choose whether to provide it, and you may withdraw consent at any time. If we need to use Personal Data for a new purpose, we will seek consent again where required.

2.2 Legitimate uses

Applicable law may permit processing without consent in certain cases under Section 7 of the DPDPA, including where you voluntarily provide Personal Data for a specified purpose; processing is necessary to comply with legal obligations; processing is required pursuant to a judgment, decree or order; processing is necessary to respond to medical emergencies or disasters; processing is necessary to protect the safety of individuals; or processing is otherwise permitted under applicable law.

We collect Personal Data to provide workspace discovery, booking and membership services securely and efficiently. We collect only what is necessary for the purposes below. Some data is mandatory to provide services; optional data may be declined, though that may limit certain features.

We may also obtain Personal Data from your company, employer, partner, authorised representative or host if you visit or access one of our spaces, and from publicly or commercially available sources as permitted by law. Where we obtain data from a third party, we take reasonable steps to verify it was sourced legitimately.

If you provide Personal Data relating to any third party (employees, guests, contractors, etc.), you represent that you have obtained all necessary permissions or consent before sharing that data with us.

We share Personal Data only where necessary to provide our services, operate the Platform, or comply with applicable laws.

4.1 Service providers and partners

We may share Personal Data with trusted processors who support website and business operations — for example IT and hosting providers, payment processors, analytics providers, marketing partners (where you have consented), and operational vendors. They must handle data securely, use it only for specified purposes, and comply with applicable data protection requirements.

4.2 Legal and regulatory disclosures

We may disclose Personal Data to government authorities, regulators, law enforcement or courts where required to comply with legal obligations, respond to lawful process, or prevent, detect or investigate fraud or other unlawful activity.

4.3 Third-party services you request

If you request a service that involves a third party, we may share Personal Data with that party to fulfil your request. Where sharing is necessary for the service, you may not be able to use that service without it.

4.4 Identity verification

Where required for service delivery or compliance (including KYC), we may share limited Personal Data with verification partners.

4.5 Sharing within the DBCB group & transfers

FlexiWork is a sub-brand of DBCB. We primarily store and process Personal Data in India. Personal Data may be shared with DBCB group entities or service providers as needed to deliver FlexiWork and related real-estate services. Where data is accessed from outside India, we implement appropriate safeguards consistent with applicable law.

We implement appropriate technical and organisational measures to protect Personal Data against unauthorised access, disclosure, alteration or destruction. Personal Data is stored in secure environments and accessible only to authorised personnel who need it for legitimate business purposes.

Measures may include encryption in transit and at rest, multi-factor authentication where appropriate, role-based access controls, monitoring, and periodic access reviews. These examples are illustrative; we review and enhance controls in line with applicable laws and industry practice.

Under the DPDPA, you may have the following rights (subject to applicable law and verification):

• Right to access — review Personal Data we process about you.
• Right to nominate — nominate another individual to exercise your rights in the event of death or incapacity.
• Right to correction & erasure — request correction, completion, update or deletion of your Personal Data.
• Right to grievance redressal — raise concerns about our processing of your Personal Data.

To exercise these rights or register a nominee, email privacy@flexiwork.in. We may take reasonable steps to verify your identity. If you are not satisfied after exhausting our internal process, you may escalate to the Data Protection Board of India as provided under applicable law.

Our Platform is not intended for children (individuals below 18 years of age), and we do not knowingly collect Personal Data of children. If we become aware that a child’s Personal Data was collected inadvertently, we will take prompt steps to delete it. Contact privacy@flexiwork.in if you believe a child has shared Personal Data with us.

We may process Personal Data relating to persons with disabilities to facilitate accessibility or reasonable accommodations. Where a person cannot provide valid consent independently under applicable law, we will process such data only after obtaining verifiable consent from a lawful guardian or authorised representative.

We use cookies, local storage and similar technologies on the Website to provide functionality, remember preferences, analyse usage, improve performance, enhance security and deliver requested services.

You may manage or block cookies through your browser settings. Disabling certain cookies may impact Site functionality. Where we present a cookie preference control, you may update or withdraw consent through that control.

We retain Personal Data only as long as necessary for the purposes for which it was collected, including to provide services and to meet legal, regulatory, contractual, accounting, security and reporting requirements. Retention periods vary by category (for example identity, transaction, security logs, and marketing preferences).

We may retain data longer where required or permitted by law (fraud prevention, dispute resolution, or establishment of legal claims). When data is no longer required, we take reasonable steps to securely delete, anonymise or de-identify it. You may request deletion subject to legal retention obligations.

In the event of a personal data breach, we will promptly investigate and contain the incident; notify affected Data Principals as required by law; report to relevant authorities including the Data Protection Board of India where required; and take steps to prevent recurrence.

Report suspected misuse or security incidents to privacy@flexiwork.in.

We may update this Privacy Notice to reflect changes in our services, the law, or how we handle Personal Data. The revised notice will be published on this page with an updated “Last updated” date. Continued use of the Platform after updates constitutes acknowledgement of the changes. If you do not agree, you may stop using our services and withdraw consent through our grievance channels.

For queries or grievances regarding this Privacy Notice or use of our online channels: