Privacy Policy

01 · Who we are

Apna Project ("Apna Project", "we", "us") is a software development and business automation company based in Pune, India, working with clients in India, the USA and the UAE. We design, build, automate and support software for businesses.

For personal data we collect through this website, our enquiries and our own business operations, we are the data fiduciary (data controller) under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and, where it applies, the EU/UK General Data Protection Regulation ("GDPR"). You can reach us at animesh@apnaproject.in.

02 · What this policy covers

This policy covers personal data we handle when you visit this website, send us a brief or message, book a call, receive a proposal, or become a client.

When we build or run software for a client, the personal data inside that software (for example, the client's own customers or staff) belongs to the client. We process it only on the client's documented instructions, as a data processor, under our agreement with that client. Questions about that data should go to the client first.

03 · Information we collect

Information you give us:

• Contact details such as your name, work email, phone number, company name and website.
• Details about your project: the services you are interested in, your requirements, timelines, budgets and any files, links or notes you share.
• Call bookings: the date and time you choose and the details you enter when booking.
• Client and billing information: billing contacts, addresses, GST or tax registration numbers, purchase orders, invoices and payment records.
• Project materials you give us access to, such as content, brand assets, data samples, and credentials or access to your tools and systems.

Information collected automatically: like most websites, our hosting and infrastructure providers record basic technical data such as IP address, browser and device type, pages requested and timestamps. We use this only to keep the website secure, reliable and working. Please do not send us sensitive personal data (such as health, financial account or government ID details) through our forms or email unless we have specifically agreed a secure way to do so.

04 · How we use your information

We use personal data to:

• Reply to your enquiry, understand your requirements and prepare estimates, proposals and statements of work.
• Schedule and hold calls and meetings.
• Deliver, support and maintain the services you have engaged us for.
• Send invoices, collect payments and meet our accounting, tax and other legal obligations.
• Keep our website, systems and client projects secure, and prevent fraud and misuse.
• Improve our website and services.
• Send occasional updates about our work, but only if you have opted in. You can unsubscribe at any time.

We do not sell your personal data, and we do not use it for third-party advertising.

05 · Our legal grounds

Under the DPDP Act we process personal data on the basis of your consent (given when you submit a form, email us or book a call) or for legitimate uses permitted by law, such as performing a contract you have asked us to enter into and complying with legal obligations. You can withdraw consent at any time; this does not affect processing already carried out, and we may still keep data we are legally required to retain.

If the GDPR applies to you, we rely on the performance of a contract or steps before entering one, our legitimate interests in running and securing our business, compliance with legal obligations, and your consent for optional communications.

06 · Who we share it with

We share personal data only where needed, and with providers bound by confidentiality and data protection obligations:

• Hosting, cloud infrastructure and website delivery providers.
• Email, communication, video-call and scheduling tools (for example, a calendar booking service such as Calendly when you book a call).
• Project management, file-sharing and source-code hosting tools used to deliver your project.
• Accounting, invoicing, banking and payment providers.
• Our professional advisers, such as lawyers, accountants and auditors.
• Government authorities, courts or regulators where we are required to by law or to protect our legal rights.
• A buyer or successor if our business is reorganised, merged or sold, under equivalent protections.

07 · International transfers

Some of the tools and providers we use store or process data outside India, including in the USA and Europe. Where we transfer personal data across borders, we do so as permitted by applicable law, including any restrictions notified under the DPDP Act, and, where the GDPR applies, with appropriate safeguards such as standard contractual clauses.

08 · Cookies and similar technologies

This website does not use advertising cookies or third-party analytics trackers. It may use strictly necessary storage that the site needs to work, such as remembering basic interface settings. If we introduce analytics or other non-essential cookies in future, we will update this policy and, where required, ask for your consent first. You can also block or delete cookies in your browser settings.

09 · How long we keep it

We keep personal data only for as long as we need it for the purposes above:

• Enquiries that do not turn into a project: up to 24 months after our last contact, then deleted.
• Client contracts, invoices and financial records: for as long as Indian tax, GST and accounting laws require, typically up to 8 years.
• Project materials and access credentials: for the duration of the engagement. At the end of a project we return or delete your materials on request and remove our access to your systems.
• Marketing preferences: until you unsubscribe or ask us to delete them.

10 · How we protect it

We use reasonable technical and organisational safeguards, including access controls and least-privilege access, encrypted connections, secure storage of credentials, and confidentiality obligations for everyone who works on client projects. No method of transmission or storage is completely secure, but if a personal data breach affects you, we will notify you and the relevant authorities as required by law.

11 · Your rights

Depending on the law that applies to you, you can ask us to:

• Tell you what personal data we hold about you and how we use it.
• Correct, complete or update inaccurate or incomplete data.
• Erase your data when it is no longer needed, subject to our legal retention obligations.
• Withdraw your consent, or opt out of updates at any time.
• Nominate another person to exercise your rights if you die or become unable to do so (DPDP Act).
• If the GDPR applies: restrict or object to processing, receive your data in a portable format, and complain to your local data protection authority.

To make a request, email animesh@apnaproject.in. We may need to verify your identity, and we aim to respond within 30 days.

12 · Children

Our website and services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has shared personal data with us, contact us and we will delete it.

13 · Grievance officer

If you have a question or complaint about how we handle personal data, contact our Grievance Officer at animesh@apnaproject.in (Apna Project, Pune, Maharashtra, India). We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India or, where the GDPR applies, to your local data protection authority.

14 · Changes to this policy

We may update this policy from time to time. The latest version will always be on this page with its "Last updated" date. If we make significant changes, we will take reasonable steps to let our clients know.