01.Introduction & Corporate Entity
This Privacy Policy describes how Svarnix Technologies Private Limited ("Svarnix", "we", "our", or "us"), an incorporated company in India, collects, uses, processes, stores, and protects personal data obtained through our website (svarnix.com), our diagnostic assessment tools, software applications, and consulting services.
Under the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023) and the Information Technology Act, 2000 (along with the IT Rules, 2011), Svarnix operates as a Data Fiduciary determining the purpose and means of processing personal data shared with us.
02.Scope & Applicability
This Policy applies to individuals ("Data Principals") whose digital personal data is processed by Svarnix across our touchpoints:
- Visitors & Enquirers: Individuals browsing our website, submitting project briefs, or scheduling discovery discussions.
- Diagnostic & Assessment Users: Professionals taking our Digital Maturity Assessment to obtain workflow evaluations and scorecards.
- Clients & Partners: Business founders, enterprise teams, and CA firms partnering with Svarnix for custom engineering, automation, or managed technical operations.
Where we process confidential client data solely under an executed Master Services Agreement (MSA) or Statement of Work (SOW) on behalf of enterprise clients, Svarnix acts as a Data Processor, processing data strictly per the client's instructions.
03.Personal Data We Collect
In line with data minimization principles, we only collect personal information necessary to deliver our services effectively:
A. Information You Voluntarily Provide
- Contact Information: Name, work email address, phone number, company name, and job role.
- Project Details: Project descriptions, scope requirements, timeline preferences, and desired delivery model (Build & Manage vs. Build & Handover).
- Diagnostic Inputs: Operational bottlenecks, software tools used, team scale, and automation pain points submitted in digital assessments.
B. Technical & Operational Data
- Device & Browser Telemetry: Browser type, operating system, approximate region/city, and screen resolution.
- Session Information: Authenticated session tokens (via Supabase Auth) and user interface preferences (such as dark mode theme).
- Anonymous Analytics: Aggregated page engagement data (only recorded if performance cookies are accepted).
04.Grounds for Processing under the DPDP Act, 2023
Under Section 4 and Section 7 of India's Digital Personal Data Protection Act, 2023, Svarnix processes personal data strictly under lawful grounds:
Where you voluntarily provide data (submitting an enquiry form, completing an assessment, or enabling optional analytics). Consent may be withdrawn at any time.
Processing necessary for fulfilling contractual deliverables, generating invoices, responding to your direct inquiries, and safeguarding network security against cyber threats.
05.Purpose of Data Use
We use your personal data strictly for transparent business and engineering purposes:
- Consulting & Scoping: Reviewing your technical requirements, preparing architectural proposals, and scheduling discovery calls.
- Assessment Reports: Calculating digital maturity scores and delivering tailored PDF reports to your email.
- Service Delivery: Setting up staging repositories, executing custom development milestones, and providing technical support.
- Security & Abuse Prevention: Monitoring API traffic to prevent automated spam, brute-force attempts, and unauthorized access.
- Statutory & Tax Compliance: Maintaining GST records, invoices, and accounting documentation mandated under Indian law.
06.Infrastructure & Sub-processors
Svarnix does not sell, rent, or trade personal data to third parties. We engage industry-standard technology infrastructure providers solely to operate our software:
| Provider | Role & Function | Security Standard |
|---|---|---|
| Supabase | Managed database, auth sessions & backend edge functions | SOC 2 Type II, AES-256 encryption at rest |
| Amazon Web Services (AWS) | Cloud hosting & server infrastructure | ISO 27001, SOC 2, resilient cloud architecture |
| Resend | Transactional enquiry and report delivery emails | TLS 1.3 transport security |
| Google Analytics (Optional) | Aggregated anonymous usage metrics | Loaded only upon explicit user consent |
07.Cloud Storage & Data Transfers
Svarnix utilizes enterprise-grade cloud servers (AWS and Supabase) that comply with cross-border data transfer regulations under Section 16 of the DPDP Act, 2023. Data in transit is secured using modern TLS 1.3 cryptographic protocols, and databases are protected by AES-256 encryption. We do not transfer personal data to any jurisdiction restricted by the Government of India.
08.Data Retention & Erasure
We retain personal data only for as long as needed to fulfill the stated purposes, or as mandated by applicable statutory laws:
09.Reasonable Security Practices (IT Act, 2000)
In compliance with Section 43A of the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, Svarnix implements comprehensive administrative, physical, and technical controls:
10.Rights of the Data Principal (DPDP Act, 2023)
Under the DPDP Act, 2023, you have clear statutory rights regarding your personal data:
- Right to Access Information (Section 11): Request a summary of your personal data processed by Svarnix and identities of any data fiduciaries or processors with whom it was shared.
- Right to Correction and Erasure (Section 12): Request correction of inaccurate information, completion of incomplete data, or erasure of personal data that is no longer necessary.
- Right of Grievance Redressal (Section 13): Right to readily accessible grievance redressal provided by Svarnix before approaching the Data Protection Board of India.
- Right to Nominate (Section 14): Right to nominate another individual who shall exercise your data rights in the event of death or incapacity.
- Right to Withdraw Consent: You may withdraw your consent for any non-essential processing at any time without penalty.
11.International Clients & Global Standards
While Svarnix is an Indian entity primarily serving domestic businesses, we also collaborate with international partners and overseas clients. For international visitors, our privacy framework is built on globally recognized principles (consistent with the EU/UK GDPR and standard data protection norms):
- We do not sell personal information to third parties.
- You may request access, correction, or deletion of your records.
- Where cross-border engineering engagements occur, we execute mutually agreed Data Processing Addendums (DPAs) with standard safeguards.
13.Protection of Minors
Our services and tools are designed exclusively for business professionals and individuals aged 18 and older. In compliance with Section 9 of the DPDP Act, 2023, we do not knowingly process personal data of children. If a minor has submitted information, contact us at connect@svarnix.com to have it removed immediately.
14.Policy Updates
We may update this Privacy Policy from time to time to mirror platform changes or evolving rules under the DPDP Act. Updated versions will be posted on this page with an updated effective date.
15.Inquiries & Grievance Redressal
Under the DPDP Act, 2023, you have the right to swift grievance redressal. For any questions, data requests, or concerns, contact us:
Svarnix Technologies Private Limited
Email: connect@svarnix.com
Location: India
Website: https://svarnix.com
We acknowledge and respond to all privacy and grievance requests promptly.