Privacy Policy

Last updated: 17 September 2026

1. Introduction and Scope

1.1 This Privacy Policy (the "Policy") is issued by United Acoustic Private Limited, a company incorporated under the laws of India, having its office at 9th Floor, Lotus Business Park, off New Link Road, Veera Desai Industrial Estate, Andheri West, Mumbai, Maharashtra 400053, India, and carrying on business under the brand "UniVicoustic" (the "Company", "we", "us" or "our").

1.2 This Policy sets out the manner in which the Company collects, uses, discloses, transfers, stores and otherwise processes Personal Data in connection with: (a) the websites located at univicoustic.com and apac-middleeast.univicoustic.com (the "Websites"); (b) the UniVicoustic Visual Configurator located at configurator.univicoustic.com, including the Visualizer and the UniVicoustic assistant (the "Configurator"); (c) electronic mail and other communications transmitted by the Company; and (d) any enquiry, sample request, quotation or other dealing between the Company and the User (collectively, the "Services").

1.3 This Policy applies to every natural person whose Personal Data is processed by the Company in connection with the Services, including customers, architects, interior designers, acoustic consultants, contractors, installers, distributors, visitors to the Websites and prospective employees (the "User", "you" or "your").

1.4 The website located at vicoustic.com is operated by Visound Acústica SA ("Vicoustic"), the Company’s joint-venture partner, and is governed exclusively by the privacy policy published on that website (https://vicoustic.com/policies/privacy-policy). This Policy does not apply to vicoustic.com.

1.5 This Policy constitutes the notice required under section 5 of the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and, to the extent applicable, the information required under Articles 13 and 14 of Regulation (EU) 2016/679 and the United Kingdom General Data Protection Regulation (together, the "GDPR").

1.6 Where the Company relies upon the consent of the User as the basis for processing, such consent is obtained separately by means of the mechanisms described in this Policy. The publication of this Policy does not of itself constitute a request for, or the grant of, consent.

2. Definitions

2.1 In this Policy, unless the context otherwise requires:

"Applicable Data Protection Law" means the DPDP Act and the rules made thereunder; the Information Technology Act, 2000 and the rules made thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; and, to the extent applicable to a particular User, the GDPR and any other data protection legislation in force in the jurisdiction in which the User is located;

"Cookies" means cookies, browser local storage objects, pixels, tags, web beacons, software development kits and similar technologies;

"Personal Data" means any data about an individual who is identifiable by or in relation to such data, and includes "personal information" and "personal data" as those terms are defined under Applicable Data Protection Law;

"Processing" means any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, disclosure, transfer, restriction, erasure or destruction;

"Service Provider" means any person that processes Personal Data on behalf of the Company, being a "Data Processor" for the purposes of the DPDP Act and a "processor" for the purposes of the GDPR;

"Usage Data" has the meaning given in clause 3.5.

3. Personal Data Collected

3.1 The categories of Personal Data processed by the Company depend upon the manner in which the User interacts with the Services.

3.2 Personal Data provided by the User. The Company collects the following Personal Data submitted directly by the User:

Category

Personal Data

Context of collection

Contact and enquiry data

Name, email address, telephone number, organisation, designation, country or region, and the content of the enquiry.

Contact forms, requests for quotation, subscription to communications, and correspondence by email or telephone.

Account data

Name, email address, the marketing preference indicated at registration, and authentication records. Authentication is effected by a one-time code transmitted to the User’s email address; the Company does not store a password.

Registration for, and sign-in to, the Configurator.

Configuration data

Surfaces, product types, series, categories, designs, sizes, thicknesses, patterns and finishes selected; designs saved, compared, downloaded or shared; and the region selected.

Use of the Configurator.

Visualizer data

Photographs of rooms or premises uploaded by the User and the areas marked thereon.

Use of the Visualizer.

Assistant data

Messages submitted to the UniVicoustic assistant and the responses generated.

Use of the assistant.

Sample request data

Name, email address, region, quantity and sample size requested, and the contact and delivery particulars required for dispatch.

Request Sample function.

Support and correspondence data

The content of communications exchanged with the Company.

Customer support and general correspondence.

Recruitment data

Curriculum vitae and other information submitted by an applicant.

Careers page.

3.3 The User shall ensure that photographs uploaded to the Visualizer do not depict identifiable individuals, identity documents or other confidential or sensitive material. The Company does not require such content in order to provide the Visualizer and does not knowingly process it.

3.4 Certain features of the Services cannot be provided without the Personal Data indicated above. A User who elects not to provide such Personal Data may be unable to access the corresponding feature.

3.5 Personal Data collected automatically. When the User accesses the Services, the Company collects the following information by automated means, including through Cookies ("Usage Data"): (a) device and connection information, namely device type, operating system, browser type and version, screen resolution, language, Internet Protocol address and the approximate geographic location derived therefrom; (b) interaction data, namely the pages accessed, features used and actions performed within the Configurator (including the product type, category or size selected, the saving, downloading or comparison of a design, and the opening of the Visualizer or the assistant), the duration of use and the referring website; (c) email engagement data, namely whether an email transmitted by the Company was opened and which links therein were selected; and (d) identifiers, namely a randomly generated identifier stored in the User’s browser (uv_anon_id) and the identifiers set by the Cookies described in clause 6.

3.6 Analytics and marketing Cookies are deployed only after the User has selected "Accept all" in the consent banner displayed by the Configurator, as further described in clause 6.

3.7 Personal Data obtained from third parties. The Company may receive Personal Data from: (a) Vicoustic and the Company’s authorised distributors, dealers and installers, where an enquiry, order or project concerning the Company’s territory or products is referred to the Company; (b) Service Providers that collect Personal Data on the Company’s behalf; and (c) publicly available sources or the User’s employer, where the Company deals with the User in a professional capacity. Personal Data so obtained is processed in accordance with this Policy.

4. Purposes and Legal Bases of Processing

4.1 The Company processes Personal Data for the purposes, and on the legal bases, set out below:

Purpose

Description

Legal basis under the GDPR (where applicable)

Provision of the Services

Operation of the Websites and the Configurator; creation and administration of the User’s account; storage, retrieval and export of designs; generation of visualisations; responses to enquiries; processing of sample requests, quotations and orders; and arrangement of delivery through the Company’s authorised partners.

Performance of a contract (Article 6(1)(b)); the Company’s legitimate interest in operating the Services (Article 6(1)(f)).

AI-assisted features

Analysis of uploaded photographs to identify wall surfaces for the purpose of rendering products thereon, and generation of responses by the assistant, as described in clause 5.

Performance of a contract at the User’s request (Article 6(1)(b)).

Service communications

Transmission of one-time sign-in codes, confirmations, responses to enquiries and notices concerning the User’s account or the Services.

Performance of a contract (Article 6(1)(b)); compliance with a legal obligation (Article 6(1)(c)).

Direct marketing

Transmission, to Users who have opted in, of communications concerning the Visual Configurator, the Company’s products, projects and events. Such communications may be tailored by reference to the User’s activity within the Configurator, including designs saved and product types viewed.

Consent (Article 6(1)(a)); in respect of existing customers, the Company’s legitimate interest in marketing similar products (Article 6(1)(f)).

Analytics and improvement

Analysis of the use of products, options and features; measurement of marketing campaigns; identification and rectification of defects; and improvement of the Configurator and the Websites.

Consent, in respect of Cookies; the Company’s legitimate interest in improving the Services, in respect of aggregated statistics (Article 6(1)(f)).

Security and prevention of misuse

Detection, investigation and prevention of misuse of the Services and protection of User accounts.

The Company’s legitimate interest in securing the Services (Article 6(1)(f)).

Legal compliance

Maintenance of records required by law; responses to lawful requests from governmental and regulatory authorities; enforcement of the Company’s terms; and protection of the rights of the Company and of third parties.

Compliance with a legal obligation (Article 6(1)(c)); legitimate interests (Article 6(1)(f)).

4.2 In respect of Users to whom the DPDP Act applies, the Company processes Personal Data on the basis of the consent of the User under section 6 of the DPDP Act, or for the legitimate uses specified in section 7 of the DPDP Act, including where the User has voluntarily provided Personal Data to the Company for a specified purpose and has not indicated that they do not consent to its use for that purpose, and where processing is necessary for compliance with any law or judgment.

4.3 The Company shall not process Personal Data for any purpose incompatible with the purposes set out in this clause 4 without first notifying the User and, where required by Applicable Data Protection Law, obtaining the User’s consent.

5. Automated and AI-Assisted Processing

5.1 Where the User uploads a photograph to the Visualizer, the photograph is transmitted to the Company’s artificial intelligence service provider, Anthropic PBC (the "AI Service Provider"), which analyses the image in order to identify wall surfaces. The Company uses the resulting analysis to render products upon the identified surfaces.

5.2 Where the User submits a message to the assistant, the message, together with the preceding messages in the same conversation, is transmitted to the AI Service Provider for the purpose of generating a response.

5.3 The AI Service Provider is contractually restricted to processing such data solely for the purpose of returning the requested output to the Company and is not permitted to use such data for the training or improvement of its models.

5.4 Outputs generated by the AI-assisted features are produced by automated means and are indicative only. The Company does not make any decision producing legal or similarly significant effects concerning the User solely by automated means.

6. Cookies and Similar Technologies

6.1 The Configurator displays a consent banner upon the User’s first visit. Prior to the User’s selection, only strictly necessary technologies are deployed. Where the User selects "Decline", no analytics or marketing Cookies are deployed. The User may withdraw or modify their selection at any time through the settings of the Configurator, and may remove or block Cookies by means of the controls of their browser. The blocking of strictly necessary Cookies may impair the operation of the Services.

6.2 The Company deploys the following categories of Cookies:

Category

Purpose

Technologies

Maximum duration

Strictly necessary

Maintenance of the User’s authenticated session; storage of the User’s consent selection and settings.

Sign-in session; uv_analytics_consent and uv_anon_id (browser local storage).

Session, or until cleared by the User.

Analytics

Measurement and analysis of the use of the Websites and the Configurator.

Google Analytics 4 and Google Tag Manager (_ga, _ga_*); PostHog (ph_*).

Two (2) years (Google); one (1) year (PostHog).

Marketing

Association of the Configurator activity of a signed-in User who has opted in to direct marketing with that User’s contact record, for the purpose of tailoring communications; measurement of email opens and link selections.

Brevo tracker (sib_cuid); tracking pixel and tracked links within emails.

Six (6) months.

6.3 Google Analytics receives a pseudonymous identifier only. The Company does not transmit the User’s name or email address to Google Analytics.

6.4 The website univicoustic.com is hosted on the Wix platform, which deploys Cookies of its own as described in the cookie notice displayed on that website.

6.5 The Company does not respond to "Do Not Track" signals transmitted by browsers. Users are directed to the consent banner and to the controls of their browser.

7. Disclosure of Personal Data

7.1 The Company does not sell Personal Data and does not disclose Personal Data to third parties for the purposes of such third parties’ own advertising.

7.2 The Company discloses Personal Data to the following categories of recipients:

Recipient

Purpose of disclosure

Location

Brevo SAS

Transmission of email; administration of the Company’s contact database and marketing automations; tracking of the email and Configurator activity of Users who have opted in to direct marketing.

France (EU)

Google LLC and Google Ireland Limited

Google Analytics and Google Tag Manager (analytics); Google Workspace, including Google Sheets, in which sample requests and enquiries are recorded and administered.

United States / EU

PostHog Inc.

Product analytics in respect of the Configurator.

United States

Anthropic PBC

Processing of uploaded photographs and assistant messages, as described in clause 5.

United States

Hosting and infrastructure providers, including Amazon Web Services, Emergent and Wix

Hosting, storage, content delivery and monitoring of the Websites and the Configurator.

United States / EU / India

Visound Acústica SA (Vicoustic)

Handling of enquiries and projects concerning territories or products for which Vicoustic is responsible; coordination of the UniVicoustic brand. Vicoustic processes Personal Data in accordance with its own privacy policy (https://vicoustic.com/policies/privacy-policy).

Portugal (EU)

Authorised distributors, dealers and installers

Provision of quotations, samples, orders and installation services in the User’s region.

The User’s region

Companies within the United Group

Shared administrative, financial and information technology functions.

India

Professional advisers, auditors and insurers

Legal, accounting, audit and insurance services.

India, or as required

Governmental, regulatory and judicial authorities

Compliance with applicable law; responses to lawful requests; enforcement of the Company’s terms; protection of the rights of the Company and of third parties.

As required

7.3 The Company may further disclose Personal Data (a) with the consent or at the direction of the User; and (b) to an actual or prospective acquirer, successor or financier in connection with any merger, acquisition, reorganisation, financing or sale of all or part of the Company’s business or assets, subject to appropriate confidentiality obligations.

7.4 Each Service Provider is engaged under a written contract which requires the Service Provider to process Personal Data only in accordance with the Company’s documented instructions, to maintain the confidentiality and security of such Personal Data, and to comply with Applicable Data Protection Law.

8. Cross-Border Transfers

8.1 The Company is established in India. The Service Providers and partners identified in clause 7 process Personal Data in the European Union, the United Kingdom, the United States of America and other jurisdictions.

8.2 Transfers of Personal Data outside India are made in accordance with section 16 of the DPDP Act and are not made to any country or territory in respect of which the Central Government has, by notification, restricted such transfer.

8.3 Transfers of Personal Data originating in the European Economic Area or the United Kingdom are made on the basis of an adequacy decision or, in the absence thereof, of the Standard Contractual Clauses adopted by the European Commission (supplemented, where relevant, by the International Data Transfer Addendum issued by the United Kingdom Information Commissioner), together with such supplementary measures as may be required.

9. Retention of Personal Data

9.1 The Company retains Personal Data only for so long as is necessary for the purposes for which it was collected, or for such longer period as may be required by applicable law. The retention periods applied by the Company are as follows:

Personal Data

Retention period

Account data and Configuration data

For the duration of the account and for 24 months following the User’s last sign-in, or until erased at the request of the User, whichever is earlier.

Visualizer data (uploaded photographs)

Erased from the Company’s systems upon generation of the visualisation / retained for 90 days.

Assistant data

Ninety (90) days.

Contact, enquiry, sample request and correspondence data

Three (3) years following the last communication with the User.

Direct marketing contact data

Until the User unsubscribes or withdraws consent, following which the User’s email address is retained on a suppression list solely to give effect to the User’s objection.

Analytics data

Google Analytics: fourteen (14) months; PostHog: twelve (12) months.

Records required to be maintained by law, including invoices and contracts

For the period prescribed by applicable law, being in general up to eight (8) years.

9.2 The Company may retain aggregated or anonymised data that does not identify the User for an indefinite period.

9.3 In accordance with section 8(7) of the DPDP Act, the Company shall erase Personal Data upon the withdrawal of the User’s consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, unless retention is necessary for compliance with applicable law.

10. Security

10.1 The Company implements reasonable security practices and procedures, and appropriate technical and organisational measures, to protect Personal Data against unauthorised access, disclosure, alteration, loss and destruction, as required by section 8(5) of the DPDP Act and section 43A of the Information Technology Act, 2000. Such measures include transport-layer encryption, authentication by one-time code, role-based access controls and contractual security obligations imposed on Service Providers.

10.2 No method of transmission or storage is entirely secure, and the Company does not warrant the absolute security of Personal Data. Users are advised not to transmit confidential information to the Company through insecure channels.

10.3 In the event of a personal data breach, the Company shall notify the Data Protection Board of India and each affected User in the form and manner, and within the time, prescribed by Applicable Data Protection Law.

11. Children

11.1 The Services are directed at adults and professionals and are not intended for use by persons under eighteen (18) years of age. The Company does not knowingly process the Personal Data of such persons without the verifiable consent of a parent or lawful guardian. A parent or guardian who becomes aware that a child has provided Personal Data to the Company may contact the Company in accordance with clause 15, whereupon the Company shall erase such Personal Data.

12. Rights of Users

12.1 Users in India. Under the DPDP Act, the User has the right: (a) to obtain a summary of the Personal Data being processed by the Company, the processing activities undertaken and the identities of the persons to whom such Personal Data has been disclosed (section 11); (b) to the correction, completion, updating and erasure of Personal Data (section 12); (c) to withdraw consent at any time, with the ease with which such consent was given, without prejudice to the lawfulness of processing carried out before such withdrawal (section 6); (d) to have readily available means of grievance redressal (section 13); and (e) to nominate any other individual to exercise these rights in the event of the User’s death or incapacity (section 14). A User who is not satisfied with the Company’s response to a grievance may, after exhausting the grievance redressal procedure set out in clause 15, make a complaint to the Data Protection Board of India.

12.2 Users in the European Economic Area and the United Kingdom. Under the GDPR, the User has the right:
(a) of access to their Personal Data (Article 15);
(b) to rectification (Article 16);
(c) to erasure (Article 17);
(d) to restriction of processing (Article 18);
(e) to data portability (Article 20);
(f) to object to processing based on legitimate interests, including profiling and direct marketing (Article 21);
(g) to withdraw consent at any time (Article 7(3));
(h) to lodge a complaint with a supervisory authority (Article 77).
The supervisory authorities of the European Economic Area are listed at edpb.europa.eu (https://edpb.europa.eu/about-edpb/about-edpb/members); the supervisory authority of the United Kingdom is the Information Commissioner’s Office (ico.org.uk (https://ico.org.uk)).

12.3 Users in other jurisdictions. Where the data protection law of the jurisdiction in which the User is located (including the United Arab Emirates, the Kingdom of Saudi Arabia, Singapore and Australia) confers comparable rights, the Company shall give effect to such rights in accordance with that law.

12.4 Exercise of rights. Requests shall be submitted to the Company in accordance with clause 15. The Company may require the User to verify their identity, including by confirmation of the email address associated with the User’s account, before acting upon a request. A request may be submitted by a person authorised by the User, subject to the production of satisfactory evidence of such authority. The Company shall respond to a request within the period prescribed by Applicable Data Protection Law and, in any event, endeavour to respond within thirty (30) days. The Company shall not discriminate against any User for the exercise of their rights. These rights are subject to the exceptions and limitations provided by Applicable Data Protection Law.

12.5 Duties of Users. In accordance with section 15 of the DPDP Act, the User shall not impersonate another person, shall not suppress any material information, shall not register a false or frivolous grievance or complaint, and shall furnish only such information as is verifiably authentic when exercising the right to correction or erasure.

12.6 Direct marketing. The User may at any time cease to receive direct marketing communications by selecting the "Unsubscribe" link contained in each such communication, by amending the preferences associated with their Configurator account, or by contacting the Company in accordance with clause 15. The Company shall continue to transmit service communications, including sign-in codes and notices concerning the User’s account, samples or orders, which are necessary for the provision of the Services.

13. Third-Party Websites

13.1 The Services may contain links to websites and platforms operated by third parties, including vicoustic.com and social media platforms. The Company does not control, and accepts no responsibility for, the privacy practices or content of such websites and platforms, which are governed by their own terms and privacy policies. Information published by the User on public or semi-public platforms may be accessed by other persons.

14. Amendments

14.1 The Company may amend this Policy from time to time in order to reflect changes in its practices, in the Services or in applicable law. The amended Policy shall be published on the Websites and the Configurator with a revised "Last updated" date. Where an amendment materially affects the rights of the User, the Company shall notify the User by email, where an email address is held, or by a notice displayed within the Configurator, and shall obtain fresh consent where required by Applicable Data Protection Law.

15. Grievance Officer and Contact

15.1 In accordance with the DPDP Act and the Information Technology Act, 2000, the Company has appointed the following Grievance Officer, to whom any question, request or grievance concerning this Policy or the processing of Personal Data shall be addressed:

Grievance Officer
United Acoustic Private Limited (UniVicoustic)
9th Floor, Lotus Business Park, off New Link Road, Veera Desai Industrial Estate,
Andheri West, Mumbai, Maharashtra 400053, India
Email: info@univicoustic.com
Telephone: +91 22 4038 7900

15.2 The Grievance Officer shall acknowledge receipt of a grievance within a reasonable time and shall endeavour to resolve it within thirty (30) days of receipt, or within such shorter period as may be prescribed by Applicable Data Protection Law.

15.3 For the purposes of Applicable Data Protection Law, and unless otherwise stated, United Acoustic Private Limited is the Data Fiduciary and data controller in respect of Personal Data processed in connection with the Services.

16. Governing Law

16.1 This Policy shall be governed by and construed in accordance with the laws of India, without prejudice to any mandatory rights conferred upon the User by the data protection law of the jurisdiction in which the User is located. Subject to the foregoing, the courts at Mumbai, Maharashtra shall have exclusive jurisdiction in respect of any dispute arising out of or in connection with this Policy.

Scroll to Top
Order a sample