Privacy Policy

1. Data Collection & Consent (DPDP Act Compliance)

In compliance with the Digital Personal Data Protection (DPDP) Act, 2023, NIRVIAN collects personal data solely based on your explicit consent for specific business purposes. We collect:

• Identity Data: Name, email address, and phone/WhatsApp number submitted via forms.
• Business Data: Project requirements, budgets, and operational structures necessary for engineering execution.
• Technical Data: IP addresses and browser telemetry utilized for security and analytics.

2. Purpose & Processing

Your data is processed strictly for the following operational requirements:

• Executing web engineering, SEO, and digital marketing contracts.
• Processing payments and generating GST-compliant invoices.
• Communicating project timelines and delivering milestone updates.
• Fulfilling legal obligations mandated by the Government of India.

3. Data Retention & Erasure

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by Indian tax and corporate laws (typically 7-8 years for financial records). Upon the termination of our working relationship, project-specific operational data is purged from our active systems within 90 days unless otherwise mandated.

4. Third-Party Sharing

We never sell, rent, or monetize your data. Data is shared exclusively with verified operational partners under strict confidentiality:

• Infrastructure: Vercel, Firebase, and AWS for hosting and database management.
• Financial: Razorpay/Stripe or banking partners for secure payment routing.
• Legal: Authorities and regulators when compelled by a valid legal order.

5. Security Infrastructure

All data transfers occur over encrypted SSL/TLS protocols. We utilize modern authentication standards and decentralized database architectures to protect against unauthorized access, alteration, or data breaches.

6. Your Rights

Under Indian law, you possess the right to:

• Access: Request a summary of personal data held by us.
• Correction: Mandate the rectification of inaccurate data.
• Erasure: Request the deletion of data (subject to legal retention requirements).
• Withdraw Consent: Revoke consent for data processing (which may terminate our ability to provide services).