Introduction & data controller

This Privacy Policy explains how Sarvadhi Solutions Pvt. Ltd. (“Sarvadhi”, “we”, “us”, “our”), an organisation headquartered in Surat, Gujarat, India, collects, uses, stores, shares, and protects personal information that you share with us when you visit sarvadhi.com, engage with our sales team, or use any of our products.

For the purposes of the DPDP Act 2023, Sarvadhi is the data fiduciary (the entity that determines the purpose and means of processing your personal data). You can reach the data controller directly at jatin@sarvadhi.com.

Information we collect

We collect personal information in three contexts:

Information you provide to us

• Contact form submissions — your name, work email, company name, industry, and the message you write to us.

• Email or phone enquiries — anything you choose to share when contacting us directly.

• Engagement onboarding — once a contractual engagement begins, we may collect billing information, signatory details, and operational data necessary to deliver the service.

Information collected automatically

• Server logs (IP address, browser type, pages visited, timestamps) generated by the web server.

• Cookies set by this site for essential functionality and, with your consent, analytics. See Cookies & analytics below.

Information from third parties

We do not buy personal data lists or enrich form submissions from third-party data brokers.

How we use your information

We use the information we collect to:

• Reply to your enquiry and arrange a 30-minute call.

• Scope, build, deliver, and support the services you engage us for.

• Send transactional communication relating to your engagement (invoices, status updates, contract notes).

• Improve sarvadhi.com — understand which content is useful, fix broken flows.

• Comply with legal obligations (tax, GST, audit, court orders).

• We do not sell your personal information to anyone.

• We do not use your contact-form submission to add you to a marketing newsletter without separate opt-in consent.

Legal basis for processing

Under the DPDP Act 2023, we process personal data on the following lawful bases:

• Consent — when you submit the contact form, mail us, or accept cookies for analytics.

• Performance of contract — once an engagement letter or service agreement is signed.

• Legitimate uses — for security, fraud prevention, and compliance with applicable Indian law.

Data residency

All personal data processed by Sarvadhi’s marketing site and managed services is stored on infrastructure hosted in Amazon Web Services, Mumbai region (ap-south-1). This applies to contact-form submissions, account records, and operational data for productised services.

Client deployments that contract for on-premise hosting operate under separate data-handling terms in their service agreement; this policy does not override those terms.

Retention periods

We retain personal information only for as long as necessary to fulfil the purpose it was collected for, or as required by Indian law.

Your rights as a data principal

Under the DPDP Act 2023, you have the right to:

• Access — request a copy of the personal data we hold about you.

• Correct — request that inaccurate or incomplete data be corrected.

• Erase — request that we delete your personal data, subject to legal-retention obligations.

• Withdraw consent — withdraw any consent you previously gave (without affecting prior lawful processing).

• Nominate — nominate another person to exercise these rights on your behalf in the event of death or incapacity.

• Grievance redressal — raise a complaint with our grievance officer (see Grievance officer).

To exercise any of these rights, mail jatin@sarvadhi.com with the subject line “DPDP — <your request>”. We will respond within 30 days.

Sharing with third parties

We share personal data only with sub-processors that help us deliver this site and our services. Each sub-processor is contractually bound to handle data on our instructions and in line with DPDP requirements.

• We do not sell personal data.

• We will not share your personal data with advertisers or list brokers.

• We may disclose information if compelled by a valid Indian court order or by law-enforcement request, in which case we challenge over-broad requests where possible.

Security measures

We use reasonable technical and organisational measures to protect personal data:

• TLS in transit on every page and API.

• Encryption at rest for database storage.

• Least-privilege access — production data is reachable only by the engineers who need it for the engagement.

• Audit logs for production data access, reviewed monthly.

• Annual third-party security review of production infrastructure.

No security measure is perfect. If we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board of India in line with the DPDP Act timelines.

Cookies & analytics

We use a small number of cookies on sarvadhi.com:

• Essential cookies — session integrity, load balancing. Cannot be switched off.

• Analytics cookies — set only after you consent. Used to understand aggregate site usage; no personal identification.

You can clear cookies at any time via your browser settings. We honour the Global Privacy Control (GPC) signal.

Children's data

Sarvadhi’s services are intended for businesses, not consumers, and we do not knowingly collect personal data from anyone under the age of 18. If you believe a child has shared data with us, mail jatin@sarvadhi.com and we will delete it.

Updates to this policy

We may update this policy from time to time. Material changes will be flagged via a banner on sarvadhi.com and, where applicable, via direct mail to active clients. The last updated date at the top of this page is the authoritative version marker.

Grievance officer

In accordance with the DPDP Act 2023, our grievance officer is:

Jatin Dudhaat — CEO & Co-Founder, Sarvadhi Solutions Pvt. Ltd. — jatin@sarvadhi.com — Surat, Gujarat, India

Mail subject line: DPDP — Grievance. We acknowledge every grievance within 5 working days and aim to resolve within 30 days.

This policy is currently a working draft authored in-house. Final wording is subject to review by legal counsel. Updates will be published under a bumped version number above.