Privacy policy

1What we collect

You give us:

• —Your name, phone number and email address when you make an enquiry.
• —Your organisation’s name and the details of what you are asking us to do.
• —For clients: billing details, GSTIN, and the contact details of the people we work with.

Collected automatically:

• —Device type, browser and IP address.
• —Usage logs for this website.

From payment partners: transaction status and a masked reference. We do not receive or store full card numbers, CVV or UPI PINs.

2Why we use it

• —To respond to your enquiry and prepare a proposal.
• —To deliver the services set out in a signed engagement.
• —To raise invoices and take payment.
• —To provide support and handle complaints.
• —To meet our legal, accounting and tax obligations.
• —To secure this website and prevent fraud.

Marketing messages are sent only if you opt in, and you can opt out at any time.

3Legal basis and consent

We process personal data with your consent, or where processing is necessary to perform a contract you have entered into with us, in line with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023.

4Who we share it with

• —Cloud hosting and infrastructure providers.
• —Email, messaging and support-tool providers.
• —Payment gateways and banks.
• —Accountants, auditors and legal advisers.
• —Government or law-enforcement authorities, where legally required.

We engage these providers under contract, and only for the purposes set out above.

5Data we process on behalf of clients

The systems we build and maintain for clients often hold personal data about that client’s own customers, staff or users. For that data the client is the Data Fiduciary and we act as a Data Processor: we handle it only on the client’s documented instructions, for the term of the engagement, and for no purpose of our own.

• —We do not use client data to train models, to build products, or for any purpose beyond delivering the engagement.
• —Our staff have access only where the work requires it, and that access is logged.
• —Sub-processors are engaged only with the client’s knowledge and under equivalent obligations.
• —On termination we return or delete the data as the engagement agreement directs.

If you are an individual whose data sits in a system we built for someone else, your request should go to that organisation. Tell us and we will pass it on, but we cannot act on it without their instruction.

6How long we keep it

Enquiries that do not become engagements

Kept while the enquiry is live, then deleted.

Client records

For as long as the engagement is active.

Invoice and tax records

For 8 years, as required under Indian company and tax law.

Data processed for a client

For the term of the engagement, and returned or deleted afterwards as that agreement directs.

After those periods we delete or anonymise the data.

7Security

Access controls, encryption in transit, restricted staff access, and audit logs. No system is perfectly secure — tell us at once if you suspect a credential we hold has been compromised.

8Your rights

You can access a copy of your data, correct it, withdraw consent, ask for deletion, and complain to our Grievance Officer. Write to hbslbharat@gmail.com. We respond within 30 days. Some data must be retained even after a deletion request where the law requires it.

9Children

This website is intended for businesses and for adults acting on their behalf. We do not knowingly collect the personal data of anyone under 18 through it.

10Cookies

This website uses only what it needs to function. We do not run advertising or cross-site tracking cookies. You can block cookies in your browser; parts of the site may stop working.

11Changes

Any revision is posted here with a new effective date.

12Grievance Officer

Our Grievance Officer is Shiv Shambhu Kumar Bharti. Email hbslbharat@gmail.com or call +91 72929 14859. Hours are Monday to Friday, 10:00 – 18:00 IST.