Privacy Policy

1. Introduction

Bhavya Enterprises ("we," "us," or "our"), operating from SCO 393, 2nd Floor, Sector-37D, Chandigarh, India, is committed to protecting the privacy and personal data of all individuals who interact with our services. We are an ISO 9001:2015 certified multi-domain company specialising in corporate interior design & fit-out, software development, and courier & logistics services PAN India.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data in accordance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and applicable rules thereunder.

By using our website (bhavyaenterprises.com), submitting forms, using our chat widget, or engaging our services, you acknowledge that you have read and understood this policy.

2. Definitions

• Data Principal — You, the individual whose personal data is being processed.
• Data Fiduciary — Bhavya Enterprises, who determines the purpose and means of processing your data.
• Personal Data — Any data about an individual who is identifiable by or in relation to such data.
• Processing — Any operation performed on personal data, including collection, storage, use, sharing, and erasure.
• Consent Manager — A registered entity that manages consent on behalf of Data Principals.

3. Data We Collect

a) Information You Provide

• Contact forms: Name, email address, phone number, company name, enquiry type, message content.
• Chat widget: Chat transcripts, name or contact details if voluntarily provided. Conversations may be processed by third-party AI services for response generation.
• Newsletter: Email address and subscription preferences.
• Service engagement: Project details, billing information, delivery addresses, business documents shared during service delivery.

b) Automatically Collected Data

• Device information: IP address, browser type and version, operating system, device identifiers.
• Usage data: Pages visited, session duration, referral source, click patterns.
• Cookies: Session cookies, analytics cookies, and functional cookies (see Section 7 for details).
• Location: Approximate geolocation derived from IP address.

4. Purpose of Data Collection

We process your personal data only for specific, clearly defined purposes:

• Responding to enquiries and providing service quotations
• Delivering contracted services (interior design, software development, logistics)
• Client relationship management and communication
• Sending newsletters and service updates (only with separate consent)
• Website analytics, performance monitoring, and improvement
• AI-powered chat support and query resolution
• Compliance with legal and regulatory obligations
• ISO 9001:2015 quality management processes
• Fraud prevention and security

5. Legal Basis for Processing

Under the DPDP Act 2023, we process your data based on:

• Consent: Your explicit, informed, and freely given consent for specific processing activities.
• Contractual necessity: Processing required to fulfil a contract or service engagement with you.
• Legitimate uses: As permitted under Section 7 of the DPDP Act, including compliance with legal obligations, responding to government orders, and medical emergencies.

6. Consent

We obtain your consent through clear, affirmative action. We do not use pre-checked boxes, bundled consents, or consent walls. You may provide or deny consent separately for:

• Essential service delivery (required for using our services)
• Analytics and performance cookies
• Marketing communications and newsletters
• AI-powered chat processing

Withdrawing Consent

You may withdraw consent at any time by emailing privacy@bhavyaenterprises.com or using the cookie preferences panel on our website. Withdrawal is as easy as giving consent. Please note that withdrawing consent may affect our ability to provide certain services.

7. Cookies & Tracking Technologies

Our website uses the following categories of cookies:

No non-essential cookies are loaded before you provide consent. You can manage your cookie preferences at any time by clicking the cookie settings icon at the bottom of any page.

8. Third-Party Data Sharing

We may share your data with the following categories of third parties:

• AI service providers: Chat conversations may be processed by OpenAI for response generation. OpenAI's API does not use your data for model training.
• Analytics providers: Aggregated, anonymised usage data for website improvement.
• Cloud & hosting providers: Data stored on secure cloud infrastructure.
• Logistics partners: Delivery addresses and shipment details shared with DTDC and Delhivery for order fulfilment.
• Payment processors: Payment data processed by PCI-DSS compliant payment gateways (if applicable).
• Government authorities: When required by law, court order, or regulatory directive.

We do not sell your personal data to any third party. All third-party processors are contractually bound to handle your data securely and only for the specified purposes.

9. Cross-Border Data Transfers

Some of our service providers (cloud hosting, AI processing, analytics) may process data outside India. Under the DPDP Act, data transfers are permitted to all countries except those specifically restricted by the Central Government. We ensure appropriate safeguards are in place for all international transfers, including contractual data processing agreements.

10. Data Retention

We retain your personal data only as long as necessary:

• Enquiry data: 12 months from last interaction, unless a service contract is initiated.
• Service/project data: Duration of the contract plus 5 years for legal and tax compliance.
• Chat transcripts: 6 months from the date of conversation.
• Newsletter subscribers: Until you unsubscribe.
• Cookie data: As per individual cookie lifespans (see cookie preferences).
• Analytics data: 26 months (aggregated and anonymised).

In accordance with DPDP Rules 2025, we will provide 48 hours advance notice before erasing data due to account inactivity. Data required for legal obligations is retained as mandated by applicable laws.

11. Data Security

We implement reasonable security safeguards as required under the DPDP Act:

• Encryption of data in transit (TLS/SSL) and at rest
• Role-based access controls and multi-factor authentication
• Regular security assessments and vulnerability testing
• ISO 9001:2015 certified quality management processes
• Employee training on data handling and privacy
• Incident response procedures with notification within 72 hours of a breach

12. Your Rights as a Data Principal

Under the DPDP Act 2023, you have the following rights:

• Right to Access: Request a summary of your personal data being processed and the processing activities.
• Right to Correction: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Right to Withdraw Consent: Withdraw previously given consent at any time.
• Right to Nominate: Nominate an individual to exercise your rights in case of death or incapacity.
• Right to Grievance Redressal: File a complaint with us or escalate to the Data Protection Board of India.

To exercise any of these rights, contact our Grievance Officer (details below). We will respond within 30 days of receiving your request.

13. Children's Data

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without verifiable parental consent, we will take steps to delete such data promptly. If you believe a child has provided us with personal data, please contact us immediately.

14. Grievance Redressal

In accordance with the DPDP Act 2023 and IT Act 2000, we have appointed a Grievance Officer to address your concerns:

We will acknowledge your grievance within 24 hours and resolve it within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India as established under the DPDP Act.

15. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or services. Material changes will be communicated via a prominent notice on our website or by email (for registered users). The "Last Updated" date at the top of this policy indicates the most recent revision.

16. Contact Us

For any questions, concerns, or requests related to this privacy policy or your personal data, please contact us: