Privacy Policy & DPDP Notice

1. About Us & Data Fiduciary Role

Arimini ("we", "us", "our") is a Technology & IT Solutions company. We design and develop web applications, mobile apps, SaaS platforms, AI automation systems, cloud infrastructure, and provide IT consulting services to clients worldwide.

Under India's Digital Personal Data Protection (DPDP) Act, 2023, Arimini acts as a Data Fiduciary determining the purpose and means of processing personal data collected through our website (www.arimini.in), inquiry channels, and client engagements.

2. Scope & Statutory Notice (Section 5, DPDP Act 2023)

This Privacy Policy serves as our statutory notice under Section 5 of the DPDP Act, 2023. It applies when you:

• Visit or browse our website at www.arimini.in
• Submit your details via our contact form, discovery call bookings, or email inquiries
• Engage us for custom software, SaaS, or AI product development services
• Interact with our team via chat, telephone, or digital communications

Multi-Lingual Notice: This notice is published in English. In accordance with Section 5(3) of the DPDP Act, if you require this notice in any of the 22 languages specified in the Eighth Schedule to the Constitution of India (e.g., Hindi, Marathi, Tamil, Telugu, Bengali), please contact our Grievance Officer at grievance@arimini.in and a translated copy will be made available.

3. What Personal Data We Collect

3.1 Contact & Inquiry Data

When you contact us or request a consultation, we collect: your full name, company name, work email address, phone number (with country dial code), budget range, selected service interest, and project description.

3.2 Client & Engagement Data

During an active client engagement, we process business contact details, billing information, technical specifications, and API/cloud credentials shared securely under a mutual Non-Disclosure Agreement (NDA).

3.3 Technical & Analytical Data

We collect anonymized telemetry and device data (such as browser type, approximate geolocation country/city, referring URL, pages visited) via Google Analytics to diagnose performance and improve user experience. This data is non-personally identifiable.

3.4 Cookies & Local Storage

We use essential cookies for core website functionality, security tokens, and user preference retention (e.g. theme and cookie consent preferences). Non-essential analytics cookies are subject to user choice via our Cookie Banner.

4. Specified Purposes & Lawful Grounds of Processing

We process personal data only for lawful, specified purposes under Sections 6 and 7 of the DPDP Act 2023 and Article 6 of the GDPR:

• Responding to Voluntary Inquiries (Section 7(a), DPDP Act): To evaluate your project requirements, schedule discovery calls, and formulate project proposals you requested.
• Contract Performance: To execute statements of work, deliver software architecture, codebases, and IT infrastructure.
• Legitimate Communications: To send service milestones, invoices, and necessary security advisories.
• Legal & Tax Compliance: To maintain invoicing records as required by Indian taxation statutes (GST & Income Tax Act).
• Informed Consent (Section 6, DPDP Act): Where you explicitly opt in for product news or marketing updates.

✓ We do NOT sell, lease, monetize, or trade your personal information to any third parties for advertising or unsolicited promotions.

5. Security Safeguards (Section 8(5), DPDP Act)

We enforce reasonable organizational, technical, and physical security safeguards to prevent personal data breaches:

• End-to-end TLS 1.3 / HTTPS encryption across all web traffic and forms
• Role-based access controls (RBAC) ensuring only authorized engineers access project records
• Mutual Non-Disclosure Agreements (NDAs) available prior to discussing proprietary architecture
• Encrypted cloud repository management and continuous vulnerability scans

6. Data Retention & Purpose Limitation (Section 8(7), DPDP Act)

We retain personal data only for as long as necessary to fulfill the specified purpose or comply with statutory retention laws:

• Inquiry & Lead Data (Non-Clients): 12 months from the date of initial contact, after which it is permanently purged.
• Active Client Project Records: Duration of the active service engagement.
• Post-Project Archival: 3 years from engagement completion for warranty and legal defense.
• Statutory Invoices & Financials: 7 years (as mandated under Indian tax laws).
• Telemetry & Web Analytics: Up to 14–26 months (aggregated and anonymized).

7. Data Principal Rights (Sections 11–14, DPDP Act 2023)

As a Data Principal, you are entitled to the following rights under Indian law and international data regulations:

• Right to Access Information (Section 11): Request a summary of personal data being processed about you and the identities of any Data Processors with whom it has been shared.
• Right to Correction & Erasure (Section 12): Request correction of inaccurate/misleading data, completion of incomplete records, or erasure of data no longer required for the purpose collected.
• Right to Grievance Redressal (Section 13): Access an effective, readily accessible grievance redressal mechanism provided by Arimini.
• Right to Nominate (Section 14): Nominate an individual who shall, in the event of your death or incapacity, exercise your data protection rights on your behalf.
• Right to Withdraw Consent (Section 6(4)): Withdraw any consent previously granted at any time, with the same ease as providing consent.

To exercise any of these rights, email our Grievance Officer at grievance@arimini.in with the subject: "DPDP Data Rights Request — [Your Full Name]". We acknowledge requests within 48 hours and process substantive requests within 30 days.

8. Children's Data & Age of Majority (Section 9, DPDP Act)

Arimini is a B2B digital engineering and SaaS development agency. Our website and services are intended solely for individuals who are at least 18 years of age (the legal age of majority in India). We do not knowingly collect personal data from children under 18, nor do we conduct tracking, profiling, or targeted marketing toward minors. If you believe a child has submitted personal data to us, please contact us immediately for expedited deletion.

9. Designated Grievance Redressal Officer & DPBI Escalation

In compliance with Section 8(9) and Section 13 of the DPDP Act, 2023, Arimini has designated a Grievance Redressal Officer to address any privacy inquiries, data subject requests, or complaints:

Escalation to the Data Protection Board of India (DPBI): If you are not satisfied with the resolution provided by our Grievance Redressal Officer, or if we fail to respond within the statutory timeframe, you have the right to lodge a complaint with the Data Protection Board of India in accordance with Section 13(3) of the DPDP Act, 2023.

10. Third-Party Service Providers & Data Processors

We engage trusted third-party service providers who process data on our behalf under strict confidentiality and security covenants:

• EmailJS: For delivering inbound contact form notifications securely
• Google Workspace: For secure business communications and client document collaboration
• Google Analytics: For aggregate, privacy-preserving website traffic analytics (IP anonymized)
• Razorpay / Stripe: Payment gateway processing for client invoices (no card/banking details stored on Arimini servers)

11. Cross-Border Transfers of Personal Data (Section 16, DPDP Act)

Personal data processed by Arimini may be transferred outside India only in compliance with Section 16 of the DPDP Act, 2023 and subject to any restrictions notified by the Central Government of India. For EU/EEA clients, international transfers are safeguarded under Standard Contractual Clauses (SCCs).

This Privacy Policy is effective as of May 24, 2026, and was updated on May 26, 2026 to incorporate compliance requirements under the Digital Personal Data Protection Act, 2023. Any material revisions will be reflected on this page with updated timestamps.