Privacy Policy

Chakraborty Concern ("we", "us", "our") builds websites, ecommerce stores, mobile apps, and custom software for businesses. For the personal data described in this policy, we are the "controller" under the EU General Data Protection Regulation (GDPR) and the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the rules made under it.

• Registered office: Ranchi Road Bye Lane, Beside ADM Bungalow, Purulia, West Bengal 723101, India
• Bengaluru office: No. 103, Kishan Homes, 15 Vibhutipura Extension, Doddanekundi, Bengaluru, Karnataka 560037, India
• Email: info@chakrabortyconcern.com

This policy covers personal data we collect through chakrabortyconcern.com (the "website"), when you contact us, and when we deal with you as a prospective or current client, supplier, or partner.

When we build or run software for a client, we often handle personal data of that client's own customers or staff. In that work the client decides why and how the data is used, and we act only on their documented instructions as a "processor" (GDPR) or "Data Processor" (DPDP Act). That processing is governed by our contract with the client and the client's own privacy notice, not by this policy. If you are a customer of one of our clients, please contact that business first.

We collect only what we need. Specifically:

• Contact form: your name, email address, company name (optional), the subject you choose, and your message.
• Email and other correspondence: your name, email address, and anything you choose to include, such as your role, phone number, or project details.
• Client and supplier relationships: business contact details, billing details, GST or tax information, contract records, and project communications.
• Technical data: when you visit the website, our hosting provider automatically records server logs such as IP address, browser and device type, pages requested, referring page, and the date and time of the request. We use this only to keep the website running and secure.

We do not ask for sensitive or special-category data (such as health, biometric, financial account, or government ID numbers) through the website. Please do not include it in your message.

We use personal data only for the purposes below. Under the GDPR each purpose relies on a legal basis in Article 6. Under the DPDP Act we process data either with your consent or for a "legitimate use" under Section 7, for example where you have voluntarily provided the data for a specified purpose and have not said you do not consent to that use.

• To reply to your enquiry and discuss a possible project. GDPR: steps at your request before entering a contract (Art. 6(1)(b)) and our legitimate interest in responding to business enquiries (Art. 6(1)(f)). DPDP: data you voluntarily provided for this purpose (Section 7(a)), or your consent.
• To prepare proposals, enter into and perform contracts, invoice, and collect payment. GDPR: performance of a contract (Art. 6(1)(b)). DPDP: consent, or legitimate use where applicable.
• To keep the website secure, prevent abuse and spam, and fix errors. GDPR: legitimate interests (Art. 6(1)(f)). DPDP: legitimate use, including compliance with law.
• To meet legal, tax, accounting, and regulatory obligations, and to respond to lawful requests from authorities. GDPR: legal obligation (Art. 6(1)(c)). DPDP: Section 7 legitimate uses for compliance with law and judgments.
• To establish, exercise, or defend legal claims. GDPR: legitimate interests (Art. 6(1)(f)). DPDP: legitimate use where permitted by law.
• To send occasional updates about our services, only if you have asked for them. GDPR and DPDP: consent, which you can withdraw at any time.

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see "Your rights").

Where we rely on consent, it is free, specific, informed, and given by a clear action. You can withdraw consent at any time by emailing us, and withdrawing will be as easy as giving it. Withdrawal does not affect processing already carried out, but we will stop that processing and erase the related data within a reasonable time unless a law requires us to keep it.

Under the DPDP Act you may also give, manage, review, or withdraw consent through a registered Consent Manager where one is available for our services.

The website does not use advertising cookies, analytics cookies, tracking pixels, or third-party trackers. We do not build profiles of visitors.

If we add analytics or other non-essential cookies in future, we will update this policy and ask for your consent before setting them where the law requires.

We do not sell personal data and do not share it for advertising. We share it only with:

• Service providers who act on our behalf, such as website hosting, email, cloud storage, and accounting providers. They are bound by contract to use the data only to provide their service to us and to protect it.
• Professional advisers such as accountants, auditors, and lawyers, under a duty of confidentiality.
• Government, regulators, courts, or law enforcement where required by law or to protect our legal rights.
• A buyer or successor if our business is reorganised, merged, or sold, subject to equivalent protections.

We are based in India and our service providers may store or process data in India or in other countries. Transfers out of India are made in line with the DPDP Act and any restrictions notified by the Government of India.

If you are in the European Economic Area, the United Kingdom, or Switzerland, your data will be transferred to India, which does not currently have an adequacy decision. We protect such transfers using the European Commission's Standard Contractual Clauses (or the UK equivalent) or another safeguard permitted by Chapter V of the GDPR. You can ask us for a copy of the relevant safeguard.

We keep personal data only as long as needed for the purpose it was collected for, then erase it, unless a law requires us to keep it longer.

• Enquiries that do not lead to work: up to 24 months after our last contact.
• Client, supplier, and contract records: for the life of the relationship and then for the period required by Indian tax, accounting, and company law, generally up to 8 years.
• Server and security logs: kept for a limited period for security purposes, and for at least one year where Indian law requires it.

Under the DPDP Act, where you have not engaged with us for the period prescribed by law, we will erase your data and, where required, tell you at least 48 hours before we do so.

We take reasonable technical and organisational security safeguards to protect personal data, including encrypted connections (HTTPS), access controls limited to people who need the data, and contracts that require our service providers to protect it.

No system is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as required by the DPDP Act and its rules, and, where the GDPR applies, the competent supervisory authority within 72 hours of becoming aware of it, and affected individuals without undue delay where the breach is likely to result in a high risk to them.

Depending on where you are, you have the following rights. To use any of them, email us (see "Contact and grievances"). We may need to verify your identity before acting on a request. We do not charge a fee unless a request is manifestly unfounded or excessive.

Under the GDPR (EEA, UK, and Switzerland):

• Access a copy of your personal data.
• Correct inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict how we process your data.
• Receive your data in a portable, machine-readable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time.
• Not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make such decisions about you.
• Lodge a complaint with your local data protection supervisory authority.

Under the DPDP Act (India), as a Data Principal you can:

• Obtain a summary of the personal data we process about you and the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared (Section 11).
• Have your personal data corrected, completed, updated, or erased (Section 12).
• Have your grievances addressed by us (Section 13).
• Nominate another person to exercise your rights if you die or become incapable (Section 14).
• Withdraw consent at any time.
• Complain to the Data Protection Board of India if you are not satisfied with our response, after first using our grievance process.

We aim to respond within one month under the GDPR (extendable by two months for complex requests, in which case we will tell you), and within the time limits set by the DPDP rules, and in any case within 90 days for grievances.

Under the DPDP Act, Data Principals also have duties: not to impersonate anyone, not to suppress material information, not to register false or frivolous grievances, and to provide only verifiably authentic information when asking for correction or erasure.

Our services are for businesses and are not directed at children. We do not knowingly collect personal data of anyone under 18 (or under 16 in the EEA). If you are under 18, please do not send us personal data. If we learn we have collected data from a child without verifiable consent from a parent or lawful guardian, we will delete it. We do not track, behaviourally monitor, or target advertising at children.

For any question about this policy, to exercise your rights, or to raise a grievance, contact our Grievance Officer at info@chakrabortyconcern.com with the subject "Privacy request" or "Grievance", or write to us at our registered office: Ranchi Road Bye Lane, Beside ADM Bungalow, Purulia, West Bengal 723101, India.

We will acknowledge your message and respond within the time limits described above. If you are in India and are not satisfied with our response, you may complain to the Data Protection Board of India. If you are in the EEA, UK, or Switzerland, you may complain to your local supervisory authority.

We may update this policy when our practices or the law change. We will post the new version on this page with a new "Last updated" date, and where changes are significant we will tell you directly or ask for fresh consent where required.