01Who we are and what this policy covers
This Privacy Policy explains how KRHydroly (a software development business operating across India and global markets) (“KRHydroly”, “we”, “us”) handles personal data when you visit krhydroly.in, contact us on WhatsApp, or work with us as a client, prospect or supplier.
It is our notice to you under section 5 of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, and our privacy policy under section 43A of the Information Technology Act, 2000 and Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).
Our two roles
- Data Fiduciary. For personal data about visitors, prospects, client contacts and suppliers, we decide why and how the data is used. This policy applies.
- Data Processor. When we build, host or maintain software for a client, we may handle personal data of that client's customers or staff. We do so only on the client's documented instructions and under a written contract, as section 8(2) of the DPDP Act requires. The client is the Data Fiduciary for that data, and the client's own privacy notice applies. If your question is about such a system, please contact the business that runs it. We will help them answer you.
02Summary notice
The table below is the short version. The sections after it give the detail.
| Personal data | Why we use it | Basis | How long we keep it |
|---|---|---|---|
| Name, company, work email, phone (optional), project description and timeline that you type into the inquiry form and choose to send on WhatsApp | To reply to your inquiry, understand your requirement and prepare a proposal | Data you voluntarily give us for this purpose (DPDP Act s.7(a)); your consent | Up to 12 months after our last conversation if no engagement follows |
| Your WhatsApp number and profile name, or your email address, and the messages and files you send us | To talk to you about your inquiry or project | Data you voluntarily give us (s.7(a)); your consent | Same as above, or for the length of the engagement |
| Client contact details, billing name, GSTIN, billing address, contracts, invoices and payment records | To deliver the services you contracted, invoice, and meet tax and accounting law | Your consent; compliance with law (s.8(7)) | For the period tax, GST and company law require, generally up to 8 years |
| IP address, browser type, pages requested and time, recorded in server logs | To keep the website secure and available, and to investigate incidents | Compliance with law, including CERT-In Directions | 180 days, unless an incident needs longer |
We do not sell personal data. We do not use it for advertising, profiling or automated decisions about you, and we do not use your messages or project data to train AI models.
03Personal data we collect
Information you give us
- Inquiry form: full name, company name, work email, phone or mobile number (optional), a description of your business challenge or project, and your anticipated timeline.
- WhatsApp and email conversations: your WhatsApp number and profile name or your email address and name, and the content of any messages, voice notes, documents or images you send us.
- During an engagement: names, roles and business contact details of your team, billing and tax details (such as GSTIN and billing address), signed agreements, invoices and payment records.
Information collected automatically
krhydroly.in does not use analytics tools, advertising or tracking pixels, session recording or cookies.
Like every website, our hosting provider (Hostinger) records standard server logs when your browser requests a page. These logs contain your IP address, the date and time, the page requested, your browser's user-agent and the referring page.
The site also loads fonts from Google Fonts, a styling library from the Tailwind CSS content delivery network, and some images from Google's image servers. To deliver those files, these providers receive your IP address and browser information. Their own privacy policies govern how they use it.
Information we do not ask for
We do not need, and ask you not to send us, sensitive personal data or information as defined in Rule 3 of the SPDI Rules. That includes passwords, bank account, card or other payment instrument details, health or medical records, biometric information and sexual orientation.
Production credentials for your systems should be shared only through the secure channel agreed in your engagement, never in a WhatsApp message. See our Security page.
04How the inquiry form works
Our inquiry form does not send your details to our servers. When you press “Send Inquiry on WhatsApp”, your own browser puts your answers into a pre-filled WhatsApp message and opens WhatsApp. Nothing reaches us until you press Send inside WhatsApp.
When you do send it, the message is carried by WhatsApp, a service of Meta Platforms. WhatsApp's own terms and privacy policy apply to that transmission. The pre-filled text is part of the wa.me link, so it may also be saved in your browser history.
05Why we use personal data
We use personal data only for the purposes stated in this notice:
- to respond to your inquiry, schedule a discussion, and prepare scope, estimates and proposals;
- to perform an agreed engagement: discovery, design, development, deployment, maintenance and support;
- to issue invoices, receive payments and keep accounting, tax and GST records;
- to keep our website and systems secure, detect misuse and respond to incidents;
- to comply with law, court orders and lawful requests from government authorities; and
- to establish, exercise or defend legal claims.
We will only send you updates or newsletters if you have asked for them. You can stop them at any time by replying “STOP” on WhatsApp or “Unsubscribe” by email.
If we want to use your data for a new purpose, we will tell you first and, where the law requires it, ask for your consent.
06Consent and withdrawing it
Where we rely on your consent, it is free, specific, informed and limited to the purposes above. You give it by sending us a message or inquiry, or by agreeing to an engagement.
You can withdraw consent at any time, and doing so is as easy as giving it. Send “Withdraw consent” to +91 93191 66011 or write to our Grievance Officer at grievance@krhydroly.in. We will then stop processing the data and erase it, unless the law requires us to keep it.
Withdrawal does not affect processing that already took place. If you withdraw consent in the middle of an engagement, we may not be able to continue the services that depend on that data.
08Processing outside India
Some of our service providers, including WhatsApp and Google, may process or store data on servers outside India. Section 16 of the DPDP Act permits this, except to any country the Central Government restricts by notification. We will follow any such restriction and will require providers to protect data to the standard this policy describes.
09How long we keep it
| Data | Retention |
|---|---|
| Inquiries and WhatsApp conversations that do not lead to an engagement | Erased within 12 months of our last communication, or sooner if you ask |
| Engagement correspondence and project contact details | For the engagement and up to 3 years after it ends, to support warranty, maintenance and dispute handling |
| Contracts, invoices, payment and tax records | For the period required by the Income-tax Act, 1961, the GST laws and company law, generally up to 8 years |
| Server logs | 180 days, in line with the CERT-In Directions of 28 April 2022, unless an incident investigation needs longer |
| Client system data we handle as a Data Processor | Returned or deleted at the end of the engagement, as the client instructs |
When a retention period ends, or the purpose is served, we erase the data or make it anonymous, as section 8(7) of the DPDP Act requires.
10Your rights
Under the DPDP Act, as a Data Principal you have the right to:
- Access (s.11): a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction, completion and updating (s.12): to fix data that is inaccurate, incomplete or out of date.
- Erasure (s.12): to have data deleted when it is no longer needed for the purpose, unless the law requires us to keep it.
- Withdraw consent (s.6(4)): see Consent and withdrawing it.
- Grievance redressal (s.13): to have a complaint handled by our Grievance Officer.
- Nominate (s.14): to name another person who can exercise these rights for you if you die or become incapacitated.
How to make a request
Message +91 93191 66011 or write to grievance@krhydroly.in. Say which right you want to exercise and give enough detail for us to find your data. To protect you, we may ask you to confirm your identity from the number or address we already have, or ask for reasonable proof.
We will acknowledge your request within 2 business days and respond in full within 30 days. If we cannot do something you asked, we will tell you why. There is no fee.
If you are not satisfied
Please use our grievance process first. Section 13(3) of the DPDP Act asks you to do so before approaching the regulator. If you are still not satisfied, you may complain to the Data Protection Board of India.
As a Data Principal you also have duties under section 15 of the Act. For example, you must not impersonate another person, and you must not file false or frivolous complaints.
11Children
Our services are for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, tell us and we will delete it.
Where a client system we build processes children's data, the client, as Data Fiduciary, is responsible for obtaining verifiable parental consent under section 9 of the DPDP Act. We build the features they need to do so.
12How we protect it
We take reasonable security safeguards to prevent personal data breaches, as section 8(5) of the DPDP Act and Rule 8 of the SPDI Rules require. These include access on a need-to-know basis, multi-factor authentication on our accounts, encrypted connections, and confidentiality obligations on everyone who works with us.
No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act and Rules require, and report cyber incidents to CERT-In within the time it prescribes. Details are on our Security page.
14Visitors outside India
We are based in India, and this policy is written to Indian law. If you contact us from the European Union, the United Kingdom or another region with its own data protection law, that law may also apply to you and give you comparable rights: access, correction, erasure, restriction, objection and portability.
For visitors under the GDPR, we rely on your consent or on steps you ask us to take before entering a contract to respond to inquiries; on contract performance for engagements; on legal obligations for records; and on our legitimate interest in keeping the website secure.
Contact us to exercise these rights. You may also complain to your local supervisory authority.
15Changes to this policy
We may update this policy as our services or the law change, including as the remaining provisions of the DPDP Rules, 2025 come into force. The “Last updated” date at the top shows the current version. If a change is significant, we will mention it on our home page and, where we hold your contact details for an active engagement, tell you directly.
16Contact and Grievance Officer
- Data Fiduciary
- KRHydroly, a software development business
- Operations
- Across India and global markets
- Grievance Officer
- Shweta
- +91 93191 66011
- grievance@krhydroly.in (personal data and grievances)
info@krhydroly.in (everything else)
Full details of the process are on our Grievance Redressal page.