Privacy Policy & DPDP Notice
Compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act, Act No. 22 of 2023) and the Information Technology Act, 2000 of India.
Under the Digital Personal Data Protection Act, 2023 (DPDP Act), you are the Data Principal and B A C Web Development & Cloud Solutions operates as the Data Fiduciary. We collect, store, and process only digital personal data that is strictly necessary for specified lawful purposes with your explicit, informed consent or legitimate statutory grounds. You retain absolute rights to access, correct, erase your personal data, withdraw consent at any time, and seek time-bound grievance redressal.
1 Data Fiduciary Identity & Scope of Policy
This Privacy Policy applies to all digital personal data collected or processed by B A C Web Development & Cloud Infrastructure (referred to as "B A C", "we", "us", or "our"), headquartered in Ahmedabad, Gujarat, India, through our website (officialbac.in), client portal, application deployment tools, subdomains, status matrices, and related API nodes.
This notice is published pursuant to Section 5 of the Digital Personal Data Protection Act, 2023 (DPDP Act) and Rule 3 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
2 Categories of Personal Data We Process
We process the following specific categories of digital personal data provided directly by you or generated during system utilization:
Full Name, Email Address, Phone/WhatsApp number, Company Name, Billing Address, Country/State.
Git repository URLs, custom domain mappings, server logs, Node.js runtime parameters, IP addresses, browser User-Agent.
Razorpay Order IDs, Payment Transaction Hashes, GST numbers, Invoice receipts. (Raw credit card/banking data is never stored on our servers).
Browser Web-Push VAPID tokens, selected monitored microservices, regional edge node preferences, notification event logs.
3 Lawful Grounds and Purposes of Processing
In strict accordance with Section 4 and Section 6 of the DPDP Act, 2023, personal data is processed solely for specified, lawful, and transparent purposes:
- Execution of Service Contracts: To provision web development projects, initialize cloud hosting containers, build code packages, and manage custom domain edge routers.
- Billing & Statutory Taxation: To generate GST-compliant invoices and securely process project payments through authorized payment gateways (Razorpay).
- Service Telemetry & Reliability Monitoring: To dispatch automated alerts on system downtime, maintenance schedules, and security incidents.
- Customer Support & Diagnostics: To resolve technical tickets, appeals, and system inquiries via authenticated channels.
- Compliance with Legal Obligations: To adhere to applicable statutory regulations, tax filings, and directives from judicial or law enforcement authorities in India.
4 Consent Architecture & Right to Withdraw Consent
Consent is obtained through clear, affirmative actions (e.g., submitting forms, accepting client onboarding terms, or activating push subscriptions). Consent notices are presented in simple language.
5 Your Statutory Rights as a Data Principal (DPDP Act, 2023)
Under Chapter III (Sections 11 to 14) of the DPDP Act, you are entitled to the following enforceable statutory rights:
1. Right to Access Information (Section 11)
You may request a complete summary of your personal data being processed, processing activities conducted, and the identities of all third-party Data Processors with whom data has been shared.
2. Right to Correction and Erasure (Section 12)
You have the right to correct inaccurate data, complete incomplete information, update outdated details, and demand the complete erasure (deletion) of personal data when the original processing purpose is satisfied or consent is withdrawn.
3. Right of Grievance Redressal (Section 13)
You have the right to register complaints regarding any aspect of data processing with our designated Grievance Officer and receive time-bound redressal within 30 days.
4. Right to Nominate (Section 14)
You may nominate another individual who, in the event of your death or incapacity, shall exercise your Data Principal rights.
6 Data Retention Schedules & Erasure Mandates (Section 8(7))
Pursuant to Section 8(7) and 8(8) of the DPDP Act 2023, personal data is permanently deleted once the specified purpose has been achieved or consent is withdrawn, unless retention is mandated by law:
| Data Classification | Retention Window | Statutory Justification |
|---|---|---|
| Client Profiles & Git Deploys | Active account tenure + 30 days grace | Contractual execution under Section 4 DPDP Act |
| Financial Invoices & GST Records | 8 Years from fiscal year end | Statutory obligation under Central Goods and Services Tax Act |
| Consent Audit Logs & Preferences | 365 Days | Proof of compliance under Section 6 DPDP Act |
| Edge Diagnostics & Access Logs | 90 Rolling Days | CERT-In security directions and breach investigations |
7 Reasonable Security Safeguards & Breach Protocols (Section 8(5) & 8(6))
Under Section 8(5) of the DPDP Act, we enforce stringent technical and organizational security controls to prevent unauthorized access, alteration, disclosure, or destruction:
- Encryption Standards: AES-256 encryption at rest for sensitive configurations, bcrypt salting for passwords, and TLS 1.3 cryptographic protocols in transit.
- Role-Based Access Control (RBAC): Principle of least privilege enforced across internal engineering and administrative dashboards.
- Mandatory Breach Notification (Section 8(6)): In the event of a verified personal data breach, B A C will immediately notify the Data Protection Board of India (DPBI) and all affected Data Principals in the prescribed form and manner without delay.
8 Processing of Children's Personal Data (Section 9)
Our web development and cloud infrastructure services are directed exclusively to business clients and individuals aged 18 years or older. In compliance with Section 9 of the DPDP Act 2023, we do not process personal data of children below 18 years without verifiable parental consent. We strictly prohibit tracking, behavioral monitoring, or targeted advertising directed toward children.
9 Cross-Border Data Transfers & Third-Party Processors (Section 16)
Data Localization: Primary client application data, databases, and authentication logs reside in India (Ahmedabad and regional Edge Datacenter Nodes).
Cross-Border Transfers (Section 16 DPDP Act): Personal data is transferred outside India only to countries or territories not restricted by the Central Government, under robust Data Processing Agreements with verified global processors:
10 Multilingual Accessibility (Section 5(3) DPDP Act)
Under Section 5(3) of the DPDP Act 2023, every Data Principal has the statutory option to access this privacy notice in English or any of the 22 languages specified in the Eighth Schedule to the Constitution of India.
Assamese, Bengali, Bodo, Dogri, Gujarati (ગુજરાતી), Hindi (हिन्दी), Kannada (ಕನ್ನಡ), Kashmiri, Konkani, Maithili, Malayalam (മലയാളം), Manipuri, Marathi (मराठी), Nepali, Odia (ଓଡ଼ିଆ), Punjabi (ਪੰਜਾਬੀ), Sanskrit, Santali, Sindhi, Tamil (தமிழ்), Telugu (తెలుగు), and Urdu.
To request an official certified translation in your preferred Indian language, email [email protected] with subject "DPDP Section 5(3) Language Request" and we will provide the translated notice within 48 hours.
11 Statutory Duties of Data Principals (Section 15 DPDP Act)
Under Section 15 of the DPDP Act, when using B A C services, Data Principals shall:
- Comply with provisions of all applicable Indian laws while exercising rights.
- Not impersonate any other individual while providing personal data for a specified purpose.
- Not suppress any material information while providing personal data for official registrations.
- Not register false or frivolous grievances or complaints with the Data Fiduciary or the Board.
12. Statutory Grievance Redressal Officer & DPBI Escalation
In compliance with Section 13 of the Digital Personal Data Protection Act, 2023 and Rule 3(11) of the Information Technology Intermediary Rules, 2021:
If you are dissatisfied with our Grievance Officer's resolution, or if your grievance is not resolved within thirty (30) days from registration, you retain the statutory right under Chapter V of the DPDP Act to file a complaint before the Data Protection Board of India (DPBI).