Privacy Policy

1. Introduction

Jadal Technologies ("we", "us", or "our") is a technology services firm based in Solapur, Maharashtra, India. We are registered as an MSME (Udyam Registration: UDYAM-MH-32-0280388) with our registered office at Plot No.10A Taporatna Yogirajendra Swami Nagar, Solapur 413006.

This Privacy Policy explains how we collect, store, process, transfer, and safeguard personal data collected from visitors, prospects, and users ("Data Principals" or "you") of our website (jadaltech.com). We are committed to protecting your privacy in alignment with the **Digital Personal Data Protection (DPDP) Act, 2023** and the **DPDP Rules, 2025**.

2. Our Role: Data Fiduciary vs. Data Processor

It is important to distinguish our role depending on the context of data processing:

• Data Fiduciary: When we collect personal data from you through this website (such as via our inquiry forms, scheduling tools, or lead magnet downloads) to respond to your queries, compile technical proposals, or manage our sales pipeline, we act as the **Data Fiduciary**. We determine the purpose and means of this processing.
• Data Processor:When we build, host, maintain, or manage custom software, databases, or workflow portals for our business clients, we process the personal data of their end-users solely on our clients' instructions. In those scenarios, our business clients act as the Data Fiduciaries, and we act as the **Data Processor**. This website Privacy Policy does not cover client-application data, which is governed by the respective client's privacy notice and our service agreements (SLAs).

3. Personal Data We Collect

We collect only the personal data that is necessary to fulfill your requests or maintain the security of our website.

A. Information You Voluntarily Provide

When you request a consultation, complete our operational discovery form, or download a resource, we collect:

• Your Name
• Email Address
• Phone Number (WhatsApp or Call Preference)
• Company Name
• Industry or Sector
• Project Specifics (Bottlenecks, challenges, goals, timeline, and estimated budget)

B. Information Automatically Collected

• IP Address: Resolved server-side from request headers for the sole purpose of rate limiting to prevent spam and denial-of-service attacks.
• User-Agent: To identify browser type, operating system, and prevent automated script submissions.
• Browser Local Storage: We store an inquiry summary in your browser's Local Storage (named jadal_inquiry_summary) purely to display your submitted answers on the thank-you confirmation page. This data remains on your local device and is not saved as a cookie.
• Usage Data (Analytics): If Google Analytics is active, we collect anonymous usage data (e.g. scroll depth thresholds, outbound link clicks, and time spent) via analytical cookies.

4. Purposes and Legal Basis for Processing

We process your personal data under the following lawful grounds:

C. Separation of Marketing Consent

We keep enquiry processing and promotional marketing strictly separate. Submitting a contact form, discovery form, or lead magnet request does **not** enroll you in promotional marketing or newsletter lists. If we introduce separate marketing campaigns in the future, they will require your explicit, separate opt-in consent.

5. Third-Party Service Providers & Data Transfers

We do not sell, rent, or trade your personal data. We transmit personal data only to the following processors to perform essential technical operations:

• Resend (Email Service): Used to route consultation notification emails from our website forms to our inbox. Resend processes email contents on servers situated outside India.
• HubSpot (CRM Platform):Used as our customer relationship database to manage active business leads. Personal data points (excluding technical headers) are uploaded to HubSpot's cloud infrastructure outside India.
• Upstash (Redis Hosting): Temporary IP rate-limiting logs are processed by Upstash Redis to secure our API endpoints.
• Google Analytics (if enabled): Sets cookies to track anonymous traffic statistics on Google infrastructure.

*Note: When you submit data to us, you acknowledge that it will be transferred to and processed by these secure global cloud platforms in compliance with industry-standard security frameworks.*

6. Data Security

We implement reasonable technical and organizational security measures to protect your personal data, including:

• Enforcing HTTPS (SSL/TLS) encryption across all endpoints and webpages.
• Server-side input sanitization and verification to prevent injection attacks.
• API Rate Limiting (sliding window checks per IP address) to block malicious bots.
• Restricted environment variable access, ensuring CRM tokens and email APIs are never exposed client-side.

7. Data Retention

We retain personal data only for as long as is necessary to satisfy the purpose for which it was collected:

• Inquiry & Lead Information: We generally retain enquiry information for up to one month while we follow up on and evaluate the enquiry. If an enquiry develops into an active business relationship, we may retain relevant information for longer where reasonably necessary for ongoing communication, proposal/project records, contractual commitments, service delivery, accounting, legal obligations, or dispute resolution.
• Rate-Limit Logs (IP Address): Stored temporarily in Upstash Redis or server-side memory and automatically expired within 10 minutes.
• Local Storage (Summary): Managed entirely by your browser on your local device. It persists until manually cleared by you or overwritten by a new form submission.
• Analytics Tracking Cookies:Google Analytics cookies expire in accordance with Google's standard configuration parameters (typically 14 months).

8. Your Rights as a Data Principal

Under the DPDP Act, 2023, you hold the following rights:

• Right to Access: Ask for confirmation of whether we are processing your personal data, and a summary of what data we hold.
• Right to Correction & Completion: Ask us to correct, update, or complete any inaccurate or incomplete personal data.
• Right to Erasure: Ask us to delete your personal data when it is no longer necessary for the purpose of processing.
• Right to Withdraw Consent: Withdraw your consent at any time where processing is based on consent.
• Right to Grievance Redressal: File a complaint with our Grievance Officer regarding any breach or unresolved request.

To exercise any of these rights, please visit our dedicated Privacy & Data Requests Page for detailed instructions and ready-to-use request formats.

9. Children's Data

Our services are directed toward business owners and enterprises. We do not knowingly collect, process, or target personal data from children under the age of eighteen (18) years. If we discover that a child's personal data has been submitted, we will take immediate steps to delete it.

10. Grievance Redressal Mechanism

If you have any questions, concerns, or complaints regarding how we handle your personal data, or wish to escalate a request, please contact our designated Grievance Officer:

We will acknowledge your grievance within 48 hours and endeavor to resolve all valid requests or disputes within thirty (30) days from receipt.

11. Updates to this Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically to stay informed about our data practices.