Privacy Policy
1. Who is responsible
Webinnovators Technologies (OPC) Private Limited (trading as Webinnovators), CIN U72900WB2019OPC235194, operates webinnoovators.com. Registered office: C/O MD MOZAHIRUL HAQUE, PANCHANANTALA ROAD, KORMOKARER GALI PROFESSOR, PRANTIK COLONY, MURSHIDABAD, West Bengal, India – 742101. Privacy and grievance officer: Azfar Alam, sales@webinnoovators.com, +91 90622 17468. This notice covers our website, business enquiries, client administration, marketing, and communications. It is information about our practices, not blanket consent to every kind of processing.
2. Our role and client-controlled data
We determine the purposes of our own visitor, prospect, business contact, and administration records. For client projects, we may instead handle personal data on a client’s documented instructions. That client’s notice and the project’s data processing terms then govern the client-controlled processing. A client does not authorise unrelated reuse of its customer data merely by appointing us. If your request concerns a client’s website or application, identify that client so we can route the request appropriately.
3. Information and sources
Information you provide may include your name, work email, telephone number, business name, project brief, goals, messages, meeting details, files you choose to share, account or support information, and billing or transaction references. We receive this through forms, email, telephone, chat, WhatsApp, meetings, and the agreed project channels. A business customer may give us details of its authorised contacts. Technical information may include IP address, browser and device information, page and referral information, timestamps, cookie identifiers, interaction events, and security logs. We may receive payment status or transaction references from a payment provider where used. Do not send full card details, financial passwords, identification documents, health records, or other sensitive records through ordinary enquiry forms. A specific project involving such information needs a separate lawful arrangement.
4. Why we process information
We use the information relevant to a request to respond, arrange a consultation or audit, prepare a proposal, administer an agreed engagement, deliver and support work, manage access and invoices, resolve disputes, prevent misuse, and meet legal obligations. Website measurement helps us understand visits and contact interactions; advertising tools may support campaign measurement, audience creation, and remarketing. Marketing communications must be appropriate to the consent or other permission required for the channel and location. An enquiry does not automatically authorise unrelated promotional email, SMS, telephone calls, WhatsApp campaigns, or sale of an audience list.
5. Consent and other lawful grounds
Where consent is required, it must relate to a stated purpose and can be withdrawn. Refusing optional marketing should not prevent an ordinary service enquiry. Where the applicable law permits, other grounds may include steps requested before a contract, performance of a contract with you, compliance with a legal duty, and proportionate legitimate business interests subject to your rights. These are not interchangeable grounds in every country: in India, consent or a permitted statutory use must support processing when the relevant DPDP provisions apply. For EEA or UK processing to which those laws apply, legitimate interests can include secure operation and reasonable business administration, subject to balancing and objection rights. We do not rely on public-interest or vital-interest grounds as a routine marketing justification.
6. Cookies, analytics, advertising, and communications providers
Our website includes Google Analytics / Google tag, Meta Pixel advertising integrations, Tidio chat, and WhatsApp contact links. Hosting and website infrastructure providers also process technical information. Booking, form, notification, anti-spam, and payment features may involve additional providers when used. Some providers act on our instructions and others also determine purposes under their own terms. Read our Cookies Policy for categories, example identifiers, and controls. Relevant provider notices include Google, Meta, Tidio, and WhatsApp. An external link opens a separate service. Advertising disclosures can qualify as “sharing”, “sale”, or targeted advertising under some US state laws even where no money is paid for the data. California online tracking / Do Not Track: third-party analytics and advertising services may collect information about activity on this site and, through their own integrations, over time across other sites. Do not assume that the legacy browser Do Not Track setting prevents this collection: we have not verified a uniform automatic response to that signal. It is different from a legally recognised opt-out preference signal. See the Cookies Policy for available controls and contact us to exercise an applicable opt-out right.
7. Recipients and restricted uses
Information is disclosed as needed for hosting and security, communications and booking, analytics and advertising, payment processing, project delivery, professional advice, or lawful reporting. Relevant employees, authorised contractors, and providers should only receive the information needed for the task. Project-specific providers and subprocessors must be addressed in the client agreement where applicable. We may disclose information for a lawful authority request, to establish or defend rights, or for a genuine business reorganisation with appropriate protections and notice. This notice does not authorise unrestricted disclosure to affiliates, promotional partners, or other website users.
8. International handling
We are based in India and may work with customers and providers in other countries, including the USA and Kenya. Access from India or a provider’s overseas systems may constitute an international transfer. The destination and available safeguards depend on the service and provider; you can ask the privacy contact for details of a relevant transfer. Merely using the website is not a waiver of transfer protections. Where required, the engagement must establish a valid transfer route and safeguards before client data is transferred. This may involve contractual safeguards and assessments, or an applicable statutory exception. EEA/UK restricted transfers may require appropriate standard clauses and assessments; Kenyan transfers must meet Kenyan requirements. We do not claim that an EU adequacy decision, a particular certification, or a completed transfer agreement covers every provider or project.
9. Retention and deletion
Retention depends on the record’s purpose: enquiries and follow-ups are kept while needed for the enquiry or an authorised ongoing relationship; project and support records for delivery, support, and legitimate claims; accounting records for applicable tax and company-law periods; security logs for the period needed or required by law; and consent, objection, and suppression records to evidence and respect choices. We should delete or anonymise data when its purpose and lawful retention requirements end. A deletion request may not remove records we must retain for tax, security, a legal hold, or a dispute; we will explain the relevant limitation. Backup copies may remain until their normal replacement cycle and must remain protected. Client-controlled data is returned or deleted under the client agreement and applicable law. No single indefinite retention period applies to every record.
10. Security and incidents
Reasonable security must reflect the information and risks involved. The measures relevant to a project should be documented, including authorised access, secure handling, and incident responsibilities. No internet service can guarantee absolute security. This notice is not a claim of ISO certification, an independent security audit, encryption of every record, or a guarantee that a breach cannot occur. Suspected exposure of personal data can be reported to the privacy contact. Where a notification duty applies, we must notify affected customers, individuals, or regulators within the relevant legal time limits.
11. Your choices and requests
You may contact us to ask about information we hold, correct it, request deletion, withdraw consent, object to marketing or another processing activity, or make a complaint. Access, portability, restriction, appeal, and other rights depend on the law and relevant exceptions. We will seek only proportionate verification and do not require an identity-document upload as a routine first step. Please identify the email or business relationship concerned; do not send additional sensitive data unnecessarily. See Privacy Rights and Grievance Redressal for methods, timelines, and regulator routes. You may unsubscribe through the message’s mechanism or contact us. Stopping marketing does not stop necessary service, billing, or security communications.
12. India and the DPDP transition
The Digital Personal Data Protection Act, 2023 and Rules, 2025 have phased commencement. As at 20 October 2026, the Gazette schedules most core processing obligations and individual rights to begin 18 months after publication; the Consent Manager provisions have a separate one-year phase. We apply provisions when legally operative and do not describe all future rights as already enforceable. Existing applicable Indian information-technology, privacy, security, contract, and consumer requirements continue during the transition. Our rights contact can receive access, correction, deletion, consent-withdrawal, and grievance requests now; the legal basis and remedy depend on the provisions in force. The companion rights page explains the DPDP rights framework, including nomination when available.
13. Kenya, USA, and other overseas visitors
Kenyan residents may have rights to information, access, objection, correction, deletion, and other protections under the Data Protection Act and regulations. Complaints can be made to Kenya’s Office of the Data Protection Commissioner. US privacy rights vary by state and statutory applicability. Where a relevant state law covers the processing, requests may include access, correction, deletion, portability, opting out of sale/sharing or targeted advertising, and an appeal. California rights also include applicable limits on sensitive information and protection against unlawful discrimination. We do not claim that every US state statute applies merely because a visitor is in the USA. EEA/UK rights and regulator routes apply where those regimes cover the processing. Mandatory local rights are not displaced by our Indian location or these policies.
14. Children, careers, and tools
Our business services and contracting channels are intended for adults aged 18 and over. If you believe a child supplied personal data, contact us so it can be assessed and handled appropriately. A project involving children’s information requires specific legal and technical arrangements before processing; this website notice does not supply parental consent. Recruitment services or applications may have a separate collection notice. Free website tools have different technical functions; follow any on-page explanation of local or external processing and avoid submitting confidential or third-party personal information without authority. General website traffic and security processing may still occur when using a tool.
15. Changes and contacting us
We will update this notice when relevant practices or requirements change, date the revision, and provide additional notice or seek fresh consent where required. A later notice does not silently authorise an incompatible new use of previously collected information. Contact Azfar Alam at sales@webinnoovators.com or +91 90622 17468. Written correspondence may be sent to our registered office above, marked “Privacy / Grievance”.
