Privacy Policy

This policy explains what personal data Dawki Infotech Pvt. Ltd. collects through www.dawkiinfotech.com, why we collect it, who it is shared with, how long we keep it, and the rights you have under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it. We have written it to describe what this website actually does, in plain language.

Terms & ConditionsCookie Policy

1. Who we are

This website is operated by Dawki Infotech Pvt. Ltd., a private limited company incorporated in India (“Dawki Infotech”, “we”, “us”). For personal data collected through this website we are the Data Fiduciary under the DPDP Act: we decide why and how it is processed, and we are responsible for it.

When we handle personal data inside a client’s own systems as part of a project (for example their CRM or customer database), we act as a Data Processor on that client’s documented instructions, and the client’s own privacy policy and our contract with them govern that data. Section 12 below describes how we treat client information.

2. What we collect, and why

We collect only what each form visibly asks for, plus a small amount of technical data needed to keep the forms secure. There is no hidden profiling.

2.1 Enquiry and contact form

• What: your name, email address, phone number, and — if you choose to give them — your company, the service you are interested in, a budget range and your message.
• Why: to reply to your enquiry, prepare a proposal if you ask for one, and manage the business relationship that may follow.

2.2 Meeting bookings

• What: your name, phone number, email address, the date and time you choose, your time zone and any notes you add.
• Why: to arrange and hold the meeting and to contact you about it.

2.3 Job applications (Careers page)

• What: your name, email address, phone number, your resume (PDF, DOC or DOCX, up to 5 MB) and any note you add, together with the role you applied for.
• Why: only to assess your application for that role and to contact you about it. Resumes are kept in private storage that is never published on the website, and can be opened only by authorised staff after signing in; every opening is recorded.

2.4 Technical and security data sent with a form

• What: the time you gave consent and which version of the consent notice you saw; your browser and device type; and your IP address, which we do not store as-is — it is converted into a one-way, salted hash that cannot be turned back into the address.
• Why: to keep a record of your consent, to stop spam, duplicate and abusive submissions (rate limits and duplicate detection), and to investigate misuse. Our forms also use a short “press and hold” human check that runs on our own servers — no third-party CAPTCHA and no cookie.

2.5 Campaign attribution — only if you allow it

• What: the page you first landed on, the website that referred you, and campaign tags in the link you followed (UTM parameters).
• Why: if you go on to send an enquiry or book a meeting, this tells us which marketing brought you, so we spend on what genuinely helps people find us. It is held in your browser only for the current tab session, is attached to your submission only if you submit one, and is never used to follow you across other websites. It is switched off unless you accept “Attribution” in our cookie banner.

2.6 Usage analytics — only if you allow it

• What: pages viewed and actions such as clicking a call or WhatsApp button (Google Analytics 4); and, through Microsoft Clarity, how pages are used — clicks, taps, scrolling and mouse movement — shown to us as heatmaps and session recordings. Clarity masks text typed into forms and drop-down choices, and they are never sent to Microsoft. We may also use Google Tag Manager to load further analytics tags — only analytics tags, never advertising ones.
• Why: to learn which pages are useful and where they are confusing or hard to use, so we can improve the website. Each tool is loaded only if we have enabled it on the site and you accept “Analytics” in our cookie banner. We tell Google and Microsoft that advertising use is denied and do not use analytics for advertising. Google Analytics is loaded directly by our website, set to switch off Google signals and ad personalisation and never to send the text of a web address’s query. About our forms, analytics records which form was started or sent, the service or job you picked and an enquiry reference number (so each enquiry is counted once) — never your name, contact details or message.

2.7 When you contact us directly

If you email, phone or WhatsApp us, we receive whatever you choose to share (for example your number and message) and use it to respond. WhatsApp messages are handled by WhatsApp (Meta) under its own terms and privacy policy.

2.8 How we contact you

We collect personal details like your name, email address, and phone number etc. By sharing your information, you authorize Dawki Infotech to contact you via SMS, RCS, WhatsApp, Email, and other communication channels. This consent overrides any NDNC/DND registration as per TRAI regulations.

3. The legal basis for processing

• Consent. Each form shows a short notice and asks for your consent, which we record with the time and notice version. Analytics and campaign attribution also rely on your consent through the cookie banner.
• Legitimate uses permitted by the DPDP Act, such as using data you have voluntarily provided for the purpose you provided it, and complying with a legal obligation (for example keeping financial records required by law, or responding to a lawful request from an authority).

4. How we use data — and how we don’t

• We use your data only for the purposes described in section 2.
• We do not sell, rent or trade personal data, and we do not give it to anyone for their own marketing.
• We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not build advertising profiles.
• We will not use data given for one purpose for an unrelated purpose without telling you and, where required, asking for your consent again.

5. Where your data is stored and who receives it

Website submissions are stored in our own database on a server hosted by Hostinger in Mumbai, India. Within Dawki Infotech, access is limited to the staff who need it, through a staff-only administration system that requires a personal login and role-based permissions.

We share personal data only with:

• Hosting and infrastructure — Hostinger International Ltd., which runs the server our website and database are on.
• Email delivery — the email service provider we use to send ourselves a notification of each new enquiry, booking or application, and to correspond with you. Resumes are never attached to these notifications.
• Customer relationship management — if we connect a CRM, enquiry details are passed to it so our team can follow up.
• Messaging providers — the SMS, RCS and WhatsApp services that deliver the messages we send you (section 2.8), which receive your name and phone number for that purpose.
• Google (Google Analytics, Google Tag Manager) and Microsoft (Microsoft Clarity) — for analytics, only as described in section 2.6.
• Professional advisers and authorities — our lawyers, auditors or accountants where needed, and government, regulatory or law-enforcement authorities where the law requires us to disclose information.
• A successor business — if Dawki Infotech is reorganised, merged or sold, to the new owner, who must continue to protect it as this policy describes.

These providers act on our instructions and may use the data only to provide their service to us. Some of them may process data on servers outside India; where that happens, we only transfer data to countries the Government of India has not restricted, and we require the provider to protect it.

Some pages also load content directly from other services, which then receive your IP address and browser details as part of any web request: photographs served by Unsplash on certain service pages, and a YouTube video only after you press play. Links to WhatsApp, our social media profiles, Google Maps and our product websites connect you to those services only when you click them. See the Cookie Policy for details.

6. How long we keep data

• Enquiries and meeting bookings: up to 24 months after our last contact with you, then deleted — unless you become a client, in which case we keep what the engagement needs for its duration, and records the law requires (such as invoices and accounting records, kept for eight years) for as long as the law requires.
• Job applications and resumes: up to 12 months after the hiring decision for that role, then deleted. If you ask us to delete your application sooner, we delete the application and its resume file together.
• Consent records: for as long as we keep the data the consent relates to, plus any period needed to show that we obtained consent properly.
• Campaign attribution: in your browser only until you close the tab, and on our side only as part of a submission you choose to send.
• Analytics: under the shortest data-retention setting Google Analytics offers, if analytics is enabled. Microsoft keeps Clarity session recordings for 30 days, and longer only for individual recordings we choose to keep, within Microsoft’s limits.

If you withdraw consent or ask us to erase your data, we delete it unless the law requires us to keep part of it, in which case we keep only that part, for only as long as required.

7. How we protect your data

• All traffic to the website is encrypted in transit (HTTPS, with HSTS enforced).
• IP addresses are stored only as salted one-way hashes.
• Resumes sit in private storage that is never served publicly, are checked by file type on upload, and are opened by staff only through an authenticated, logged download.
• The staff administration system requires an individual account, role-based permissions and a strong password; passwords are stored only as one-way bcrypt hashes, and default passwords must be changed at first sign-in.
• Credentials for email delivery are stored encrypted (AES-256-GCM) and are never shown again once saved.
• Forms are protected by rate limits, duplicate detection, a hidden spam trap and our own human check, and every form is validated on the server.
• Administrative actions on personal data are recorded in an audit log.

No system is perfectly secure, but we take reasonable security safeguards as the DPDP Act requires, and review them as the website changes.

8. If something goes wrong

If a personal data breach occurs, we will act promptly to contain it, and we will inform the Data Protection Board of India and the people affected, as the DPDP Act and its rules require, together with any other authority we are obliged to notify (such as CERT-In). Our message to you will explain what happened, what it means for you and what we are doing about it.

9. Your rights

Under the DPDP Act you have the right to:

• Access — ask for a summary of the personal data we hold about you, what we do with it, and who we have shared it with;
• Correction and erasure — ask us to correct, complete or update inaccurate data, or to erase data we no longer need or that you have withdrawn consent for;
• Withdraw consent at any time — as easily as you gave it. For analytics and attribution, use the Cookie Preferences link in the footer of every page; for anything else, write to us. Withdrawal stops future processing; it does not make past processing unlawful;
• Grievance redressal — complain to us about how we have handled your data (section 10); and
• Nominate another person to exercise these rights for you in the event of your death or incapacity.

To exercise any of these rights, email info@dawkiinfotech.com with the subject “Data request”. We may ask you to confirm your identity before acting, so that we never disclose or delete someone else’s data. We aim to respond within 30 days, and in any case within the period required by law. There is no charge.

10. Grievance Officer

Questions, requests and complaints about personal data are handled by our Grievance Officer, who can be reached at:

We will acknowledge your grievance and resolve it within the period required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

11. Children

This website and our services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their data, contact us and we will delete it. We do not track children or show them targeted advertising.

12. How we treat client information

Our work often gives us access to things that belong to our clients — analytics and ad accounts, CRMs, servers, source code, commercial figures and sometimes personal data about their own customers. We treat all of it as confidential:

• Access is given only to the people doing the work, only for as long as it is needed.
• We do not disclose a client’s data or documents outside the engagement, except to a sub-processor the client has agreed to or where the law requires.
• We do not publish a client’s name, logo, review or results without their permission.
• Credentials are never shared in plain text and are removed when no longer needed.
• At the end of an engagement we return or delete client data on request, and confirm what was done. These duties continue after the project ends, as set out in each client agreement.

13. Changes to this policy

We will update this policy when our practices change; the date at the top shows the latest version. If a change affects how we use data you have already given us, we will tell you and, where required, ask for your consent again — for example, a material change to what our cookie banner covers will cause it to ask you again.

14. Contact us