Privacy Policy

We collect as little personal data as we can, use it only to reply to you and deliver our services, and never sell it. This policy explains the details in plain language.

1. Who we are

This website and our services are operated by Harnika Design (OPC) Private Limited (“Harnika Design”, “we”, “us”). For the purposes of India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary for the personal data described in this policy. For visitors in the European Union or United Kingdom, we are the “controller” under the GDPR.

2. What this policy covers

This policy covers personal data we process when you visit www.harnikadesign.com, contact us, request a quote, or become a client. When we build or maintain a website for a client and handle personal data of that client's customers, we do so on the client's instructions as a Data Processor; the client's own privacy policy applies to that data.

3. What we collect

Information you give us

• Enquiries: your name, email address, and optionally your phone number, business name, budget range and project details, when you message us by WhatsApp, email or phone. Forms on this website send your message to us by email from the website itself and email you a confirmation, or, if you choose WhatsApp, open WhatsApp with your message ready. Either way they save a copy of what you send in our own website system, so we can reply. With it we keep the date and a one-way code made from your IP address, used only to stop spam; we never store the IP address itself. To keep out spam bots, forms also check that a person is sending them: with Cloudflare Turnstile, which sees your IP address and basic browser details for that check only, or with a short sum.
• Client projects: contact details, project content (text, images, files) and, where you choose to share them, access details for your domain, hosting or other accounts so we can do the work.
• Billing: name, billing address, GSTIN (if any) and payment records needed for invoices and tax compliance. Card and bank details are entered with our payment processor and are not seen or stored by us.

Information collected automatically

• Security logs: our hosting provider records technical data such as IP address, browser type, pages requested and time, to keep the website secure and working.
• Your cookie choice: stored in your browser so we don't ask again. See our Cookie Policy.
• Analytics (only with your consent): if you accept analytics cookies and analytics are enabled on this site, Google Analytics collects pseudonymous usage data such as pages viewed and approximate location. Nothing optional loads until you agree.

What we don't collect

We don't ask for sensitive personal data such as health, financial account passwords, biometrics or government ID numbers through this website, we don't knowingly collect data from children, and we don't buy or sell personal data.

4. How and why we use it

• To reply to your enquiry and prepare a quote, based on your consent, which you give when you contact us.
• To deliver the services you've asked for, including communication, project management, support and maintenance, under our agreement with you.
• To invoice and keep accounts, as required by tax and company law.
• To keep the website and our systems secure and to prevent misuse, which is a legitimate use permitted by law.
• To understand how the website is used, only if you consent to analytics.
• To send updates or marketing, only if you have specifically opted in. You can opt out at any time.

We do not use your data for automated decisions that have legal or similarly significant effects on you.

5. Who we share it with

We share personal data only when necessary, and only with:

• Service providers who help us run the business: website hosting, email and document storage, WhatsApp (Meta) when you choose to message us there, payment processors such as Razorpay, and our accountants. They may only use the data to provide their service to us.
• Platforms you ask us to use for your project, such as your hosting company, domain registrar or payment gateway.
• Authorities, where the law requires it, or to protect our rights, our clients or the public.

We never sell, rent or trade personal data.

6. Transfers outside India

Some of our service providers store or process data outside India. Where that happens, we use reputable providers with appropriate safeguards, and we comply with any restrictions notified by the Government of India under the DPDP Act. For EU and UK visitors, transfers rely on adequacy decisions or standard contractual clauses where applicable.

7. How long we keep it

• Enquiries that don't become projects: up to 24 months, then deleted.
• Client project data: for the length of the project and any care plan, then up to 24 months unless you ask us to delete it sooner. Access details you share are removed or handed back when the work ends.
• Invoices and accounting records: for as long as tax and company law requires, generally up to 8 years.
• Security logs: kept by our host for a limited period, usually no more than 12 months.

8. How we protect it

We use reasonable security practices in line with the Information Technology Act, 2000 and its rules, including encrypted connections (HTTPS), strong unique passwords stored in an encrypted password manager, two-factor authentication on key accounts, least-privilege access and regular updates. If a personal data breach occurs, we will notify the Data Protection Board of India and affected people as required by law.

9. Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data we hold about you and how we process it;
• have inaccurate or incomplete data corrected, completed or updated;
• have your data erased when it's no longer needed or you withdraw consent, unless the law requires us to keep it;
• withdraw your consent at any time, as easily as you gave it;
• nominate another person to exercise your rights in the event of death or incapacity; and
• have your grievances addressed.

If you are in the EU or UK, you also have rights to access, rectification, erasure, restriction, data portability and objection, and you may complain to your local data protection authority.

To use any of these rights, use our data request page or email contact@harnikadesign.com. We may ask you to confirm your identity. We aim to respond within 30 days, and always within the time the law requires.

10. Children

Our website and services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18, and our forms ask you to confirm you are 18 or older. If you believe a child has sent us personal data, contact us and we will delete it. Where any project requires processing children's data on a client's behalf, the client is responsible for obtaining verifiable parental consent as required by the DPDP Act, and we do not track or target advertising at children.

11. Cookies

We use only strictly necessary browser storage by default. Optional analytics and marketing cookies run only if you accept them in our cookie banner, and you can change your mind at any time using “Cookie settings” in the footer. We also respect the Global Privacy Control signal. Full details are in our Cookie Policy.

12. Grievance Officer

In accordance with the Information Technology Act, 2000, its rules and the DPDP Act, our Grievance Officer is:

We acknowledge grievances within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.

13. Changes to this policy

We may update this policy when our practices or the law change. The date at the top shows the latest version. Significant changes will be highlighted on this page.