This policy explains what personal data Ferrowright Engineering collects, why, who we share it with, how long we keep it, and the rights you have over it. It is written to comply with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
01Who we are and scope
Ferrowright Engineering (“Ferrowright”, “we”, “us”) is an MSME (Udyam) registered business (UDYAM-RJ-28-0060965) operating from India. For personal data collected through ferrowright.com and its subdomains (the “Site”) and through our sales and communication channels, we act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
When we process personal data on behalf of a client — for example, end-user data inside an application, database, or analytics account we build, host, debug, or manage — the client is the Data Fiduciary and we act as a Data Processor, processing that data only on the client's documented instructions under the applicable agreement. This includes the server logs of visitors to client websites we host under our Managed Hosting plan. This policy does not govern that data; the client's own privacy policy does.
02Personal data we collect
We collect only what we need for the purposes in Section 3:
- Contact form: name, email address, phone/WhatsApp number (optional), service of interest, budget range (optional), and the project details you choose to write.
- Direct communication: anything you send us by email, WhatsApp, phone, LinkedIn, or during calls, including attachments.
- Free site scan tool: the website URL you submit. We do not need, and ask you not to submit, URLs containing personal data or access tokens.
- Usage data: if analytics is enabled, Google Analytics collects pages viewed, approximate location (city/country level), device and browser type, referring site, and interaction events, using cookies or similar identifiers. Our hosting provider records standard server logs (IP address, request time, user agent) for security and reliability.
- Client engagement data: if you become a client, billing details (business name, address, GSTIN, contact person) and project communications.
We do not knowingly collect sensitive data such as financial account credentials, health information, or government ID numbers through the Site. Please do not include them in forms or messages.
03Why we use it (purpose and lawful basis)
We process personal data on the basis of your consent (given when you submit a form or contact us) or for legitimate uses permitted under Section 7 of the DPDP Act, for these purposes only:
- to respond to your enquiry, scope your project, and send quotes and proposals;
- to perform an engagement you sign with us, including invoicing and support;
- to run the free site scan you request and return its results;
- to secure the Site, prevent abuse and spam, and diagnose technical faults;
- to understand aggregate Site usage and improve our content and services;
- to comply with legal, tax, and accounting obligations, and to establish or defend legal claims.
We do not sell personal data, rent it, use it for automated decision-making that affects you, or add you to marketing lists without a separate, explicit opt-in.
05International transfers
Some of our service providers store or process data outside India (including the United States and the European Union). We transfer personal data only to jurisdictions not restricted by the Government of India under Section 16 of the DPDP Act, and only to providers that maintain industry-standard safeguards.
06How long we keep it
- Enquiries that do not become projects: up to 24 months from our last communication, then deleted, unless you ask us to delete them sooner.
- Client records: for the duration of the engagement and up to 8 years afterwards, as required for tax, GST, and accounting compliance.
- Analytics data: per the retention period configured in Google Analytics (no longer than 14 months).
- Server and security logs: for a rolling 180 days, as required by the CERT-In directions of 28 April 2022, and not more than 1 year unless needed to investigate an incident or legal claim.
- Hosting clients: name, address, contact details, and service dates of clients on our Managed Hosting plan, for 5 years after the service ends, as required by the CERT-In directions.
When the purpose is fulfilled and no legal obligation requires retention, we erase the data or irreversibly anonymise it.
07How we protect it
We apply reasonable security safeguards appropriate to the data, including TLS encryption in transit, provider-level encryption at rest, access restricted to team members who need it, multi-factor authentication on administrative accounts, and input validation on every form. No system is perfectly secure; if a personal data breach occurs, we will notify affected individuals and the Data Protection Board of India as required by the DPDP Act and its rules, report cyber security incidents to CERT-In within the required 6 hours, and, where the data belongs to a client, notify that client within 24 hours.
08Your rights
Under the DPDP Act you have the right to:
- obtain a summary of the personal data we hold about you and how we process it;
- correct, complete, or update inaccurate or incomplete data;
- have your data erased where it is no longer needed for a lawful purpose;
- withdraw consent at any time — this does not affect processing already carried out;
- nominate another person to exercise these rights in the event of your death or incapacity;
- have your grievances addressed by us, and then by the Data Protection Board of India.
To exercise any right, email contact@ferrowright.com with the subject line “Privacy request”. We may ask you to verify your identity before acting. We respond within 30 days. If you withdraw consent, we may be unable to continue discussing or delivering a project with you.
10Children
The Site and our services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has submitted data to us, contact us and we will delete it.
11Third-party sites
The Site links to live client products and external platforms. Those sites have their own privacy practices, and we are not responsible for them.
12Changes to this policy
We may update this policy as our services or the law change. The “Last updated” date above shows the current version. Material changes affecting how we use data you have already provided will be notified by email where we have your address.
13Contact and grievance officer
For privacy questions, requests, or complaints, contact our Grievance Officer in accordance with the DPDP Act and the Information Technology Act, 2000:
Narayan Jat, Grievance Officer
Ferrowright Engineering
Email: contact@ferrowright.com
Rajsamand, Rajasthan, India
We acknowledge grievances within 24 hours. We resolve complaints about content on sites we host within 7 days, and privacy requests within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.