Privacy Policy

Last Updated: 3 April 2026

1. Introduction

Kaarastu Consultancy Services ("Kaarastu", "we", "us", "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal data when you visit kaarastu.com (the "Site") or contact us through it.

This policy is issued in accordance with:

• →The EU General Data Protection Regulation (GDPR) (Regulation 2016/679)
• →India's Digital Personal Data Protection Act 2023 (DPDP Act)
• →Applicable data protection laws in other jurisdictions where we operate

If you have questions about this policy or how we handle your data, contact us at contact@kaarastu.com.

2. Data Controller

Kaarastu Consultancy Services Noida, Uttar Pradesh, India contact@kaarastu.com

Kaarastu is the data controller for personal data collected through this Site.

3. Personal Data We Collect

We collect personal data only where you voluntarily provide it or where it is collected automatically as part of standard web analytics.

3.1 Contact Form Data

When you submit the contact form at kaarastu.com/contact, we collect:

| Field | Required | Purpose | |---|---|---| | Full name | Yes | To address you in our response | | Company name | Yes | To understand your organisational context | | Work email address | Yes | To respond to your enquiry | | Subject | Yes | To route your enquiry to the relevant architect | | Project description | Yes | To understand the nature of your enquiry | | Timeline | No | To understand your urgency | | How you heard about us | No | For internal marketing attribution only |

We do not collect sensitive personal data (as defined under GDPR Article 9 or the DPDP Act) through this Site.

3.2 Analytics Data

We use Google Analytics 4 (GA4) to collect anonymised, aggregated information about how visitors use the Site. This includes: pages visited, session duration, approximate geographic location (country/region level), device type, browser type, and traffic source. GA4 does not receive your name, email address, or any directly identifying information.

3.3 Cookies and Similar Technologies

We use the following cookies:

| Cookie | Type | Purpose | Duration | |---|---|---|---| | _ga | Analytics | Google Analytics — distinguishes users | 2 years | | _ga_* | Analytics | Google Analytics — session state | 2 years | | kaarastu-color-scheme | Functional | Stores your light/dark mode preference | Session / persistent |

We do not use advertising cookies, tracking pixels, or third-party marketing cookies.

On your first visit to the Site, you will see a cookie consent banner. Analytics cookies (_ga, _ga_*) are set only after you provide consent. The functional cookie (kaarastu-color-scheme) is set to preserve your display preference and does not require consent.

You may withdraw analytics consent at any time by adjusting your cookie preferences via the consent banner, or by installing the Google Analytics Opt-out Browser Add-on.

4. Legal Basis for Processing (GDPR)

For visitors in the European Economic Area, we rely on the following legal bases:

| Processing Activity | Legal Basis | |---|---| | Responding to contact form enquiries | Article 6(1)(b) — processing necessary to take steps prior to entering a contract, or Article 6(1)(f) — legitimate interests (responding to a business enquiry) | | Analytics cookies | Article 6(1)(a) — consent | | Functional cookies | Article 6(1)(f) — legitimate interests (providing a consistent user experience) |

5. How We Use Your Personal Data

We use personal data only for the purposes for which it was collected:

• →Contact form data is used solely to respond to your enquiry. We do not add you to any marketing list, newsletter, or automated communication sequence as a result of submitting the form.
• →Analytics data is used to understand how the Site is used and to identify improvements. We cannot identify individual visitors from analytics data.
• →We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

6. Data Sharing and Third-Party Processors

We share personal data with the following third-party processors only as necessary to operate the Site:

| Processor | Purpose | Data Shared | Location | |---|---|---|---| | Google LLC (GA4) | Website analytics | Anonymised usage data | USA (EU Standard Contractual Clauses apply for EEA visitors) | | Amazon Web Services (SES) | Delivery of contact form submissions to our inbox | Form content in transit only; not stored by AWS SES post-delivery | USA / India |

We have data processing agreements in place with both processors. No other third parties receive your personal data.

7. International Data Transfers

Kaarastu is headquartered in India. If you are located in the EEA or UK, your personal data may be transferred to and processed in India or the USA (via our third-party processors). For EEA visitors, such transfers are subject to appropriate safeguards including EU Standard Contractual Clauses (SCCs) as required under GDPR Chapter V.

8. Data Retention

| Data Type | Retention Period | |---|---| | Contact form submissions (enquiries that did not lead to an engagement) | 12 months from date of submission | | Correspondence related to an active or completed engagement | Duration of engagement plus 3 years, for contractual and legal compliance purposes | | Google Analytics data | 14 months (per our GA4 data retention setting) |

After the applicable retention period, personal data is securely deleted or anonymised.

9. Your Rights

9.1 Rights Under GDPR (EEA and UK residents)

You have the following rights in relation to your personal data:

• →Right of access (Article 15) — You may request a copy of the personal data we hold about you.
• →Right to rectification (Article 16) — You may request correction of inaccurate or incomplete personal data.
• →Right to erasure (Article 17) — You may request deletion of your personal data where there is no legitimate reason for us to continue processing it.
• →Right to restriction of processing (Article 18) — You may request that we restrict processing of your personal data in certain circumstances.
• →Right to data portability (Article 20) — You may request your personal data in a structured, commonly used, machine-readable format.
• →Right to object (Article 21) — You may object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.
• →Right to lodge a complaint — You have the right to lodge a complaint with your national data protection supervisory authority. For EEA residents, a list of supervisory authorities is available at edpb.europa.eu.

9.2 Rights Under India's DPDP Act 2023 (Indian residents)

As a Data Principal under the DPDP Act, you have the following rights:

• →Right to access information (Section 11) — You may request a summary of the personal data we process about you and the processing activities undertaken.
• →Right to correction and erasure (Section 12) — You may request correction of inaccurate, incomplete, or outdated personal data, or erasure of personal data that is no longer necessary for the purpose for which it was collected.
• →Right to grievance redressal (Section 13) — You have the right to have grievances regarding our processing of your personal data addressed. Grievances will be acknowledged within 48 hours and resolved within 30 days.
• →Right to nominate (Section 14) — You may nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of the above rights, submit a written request to contact@kaarastu.com. We will verify your identity before fulfilling the request. We will respond within 30 days for GDPR requests and within the timeframes prescribed under the DPDP Act.

We will not charge a fee to process rights requests unless they are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted transmission (HTTPS/TLS), access controls limiting data access to authorised personnel, and use of reputable, contractually bound third-party processors.

No method of transmission over the internet is completely secure. We cannot guarantee absolute security, but we are committed to protecting your data using industry-standard practices.

11. Children's Privacy

This Site is not directed at children under the age of 18 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at contact@kaarastu.com and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last Updated" date at the top of this page indicates when the policy was most recently revised. Material changes will be communicated by updating this page. We encourage you to review this policy periodically.

13. Contact and Grievance Officer

For privacy-related requests, questions, or grievances:

Data Controller / Grievance Officer Kaarastu Consultancy Services Noida, Uttar Pradesh, India Email: contact@kaarastu.com

For DPDP Act grievances, we will acknowledge your communication within 48 hours and provide a resolution within 30 days. If you are dissatisfied with our response, you may escalate to the Data Protection Board of India once it is established and operational.