GDPR Compliance Statement

1. Introduction

One Shop Seva ("we", "us", or "our"), operating as eForm Seva, is committed to complying with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) for our users in the European Union and European Economic Area.

While we are an India-based company, we recognize the global nature of data protection and have implemented comprehensive measures to ensure GDPR compliance for our EU/EEA users.

2. GDPR Applicability and Scope

This GDPR compliance framework applies when we process personal data of:

• Individuals located in the European Union (EU)
• Individuals in the European Economic Area (EEA)
• EU/EEA citizens regardless of their location

3. Core GDPR Principles Implementation

We adhere to the core principles of GDPR in our data processing activities:

4. Data Subject Rights Under GDPR

EU/EEA data subjects have the following rights regarding their personal data:

5. Lawful Basis for Processing

We process personal data under the following GDPR Article 6 lawful bases:

5.1 Contractual Necessity (Article 6(1)(b))

Processing necessary for performance of our service agreement:

• User account creation and management
• Form processing and submission services
• Payment processing and subscription management
• Customer support and service communications

5.2 Legal Obligation (Article 6(1)(c))

Processing necessary for compliance with legal requirements:

• Tax and financial record keeping (7 years)
• KYC verification as per Indian regulations
• Government form submission mandates
• Legal dispute resolution requirements

5.3 Legitimate Interests (Article 6(1)(f))

Processing necessary for our legitimate business interests:

• Service security and fraud prevention
• Service improvement and analytics
• Network and information security
• Direct marketing (with opt-out rights)

5.4 Consent (Article 6(1)(a))

Processing based on explicit, informed consent:

• Non-essential cookies and tracking technologies
• Marketing communications and newsletters
• Participation in surveys and research
• Special category data processing (where applicable)

6. International Data Transfers

As an India-based service provider, personal data of EU/EEA users is transferred outside the European Economic Area. We ensure compliance through:

6.1 Transfer Mechanisms

• Adequacy Decision: Relying on EU-India adequacy discussions where applicable
• Standard Contractual Clauses (SCCs): Implementing EU Commission-approved clauses
• Binding Corporate Rules: For intra-organizational transfers
• Derogations: Necessary for contract performance with data subjects

6.2 Supplementary Measures

• Data encryption in transit and at rest
• Strict access controls and authentication
• Regular security assessments and audits
• Data minimization and pseudonymization

7. Data Protection by Design and Default

We implement data protection principles throughout our service lifecycle:

8. Data Security Measures

We implement comprehensive technical and organizational security measures:

• Encryption: End-to-end SSL/TLS encryption for data in transit
• Access Controls: Role-based access and multi-factor authentication
• Network Security: Firewalls, intrusion detection, and DDoS protection
• Physical Security: Secure data center facilities with access controls
• Incident Response: Documented procedures for data breach response
• Staff Training: Regular data protection and security awareness training

9. Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee our GDPR compliance:

Data Protection Officer Contact:

• Email: help@eformseva.in
• Phone: +91 7790956989
• Address: Data Protection Officer, One Shop Seva, Jaipur, Rajasthan, India

10. Data Breach Notification

In the event of a personal data breach affecting EU/EEA data subjects:

• Supervisory Authority Notification: Within 72 hours of awareness
• Data Subject Notification: Without undue delay when high risk to rights
• Documentation: Comprehensive breach records maintained
• Remediation: Immediate measures to contain and address breaches

11. Records of Processing Activities

We maintain comprehensive records as required by GDPR Article 30:

• Purposes of processing and data categories
• Data recipient categories and international transfers
• Data retention periods and deletion procedures
• Technical and organizational security measures

12. Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities:

• Systematic description of processing operations
• Assessment of necessity and proportionality
• Risk assessment to rights and freedoms
• Risk mitigation measures and safeguards

13. Cooperation with Supervisory Authorities

We cooperate fully with EU supervisory authorities including:

• Providing access to processing records and documentation
• Participating in investigations and compliance checks
• Implementing authority recommendations and decisions
• Designating EU representative if required by Article 27

14. Changes to This Compliance Statement

We may update this GDPR Compliance Statement to reflect:

• Changes in GDPR interpretation or enforcement
• Updates to our data processing activities
• Legal and regulatory developments
• User feedback and best practices

15. Contact Information

For GDPR-related inquiries, rights requests, or complaints: