Privacy Policy

01. Who we are

Sparrowgen is a website design and development studio based in Kolkata, West Bengal, India, run by its co-founders. We design and build business websites, online stores, landing pages, and website chatbots and automation for businesses.

For the personal data described in this policy, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”): we decide why and how that data is used.

02. What this policy covers

This policy covers personal data we handle when you:

• visit this website, including the free website preview and the SparrowBot chat;
• send us a project request through the booking form;
• contact us by email, WhatsApp, phone or Instagram; and
• work with us as a client.

When we build a website for a client, the personal data of that client's customers (for example people who fill in a form on the client's website) belongs to the client. The client is the Data Fiduciary for it, and we handle it only on their instructions, as their Data Processor. Their own privacy policy applies to it, not this one.

03. Personal data we collect, and why

We collect only what we need. Each item below is listed with the reason we collect it.

Kept only on your own device, never sent to us:

• Your colour theme choice, and the business name and design you pick in the free preview (see our Cookie Policy).
• The SparrowBot chat. SparrowBot runs inside your browser using pre-written answers. What you type into it is not sent to us or stored by us, and it disappears when you close the page.

Which details are required: on the booking form, your name, email, phone number and type of business are required, because we cannot reply to you without them. The message box is optional. You are never required by law to give us your details; if you choose not to, we simply cannot respond to your request.

What we do not collect: we do not use analytics, advertising or tracking tools on this website, we do not take payments on this website, and we do not ask for sensitive data such as health, financial account or government ID details. Please do not send us such details.

04. Our legal basis

• Your consent (section 6, DPDP Act): when you tick the consent box and send the booking form.
• Data you choose to give us for a specific purpose (section 7(a)): for example when you message us on WhatsApp, we use your details to reply.
• Legal obligations (section 7): for example keeping invoices and tax records, or responding to a lawful request from a government authority or court.
• Keeping the website secure: the short technical logs described above are used only to deliver the website, prevent spam and abuse, and investigate security incidents.

We do not sell your personal data, use it for advertising, build profiles about you, or make automated decisions about you.

05. Withdrawing your consent

You can withdraw your consent at any time, as easily as you gave it: email hello@sparrowgen.in or message us on WhatsApp at +91 62918 45804, saying you want your enquiry withdrawn. We will then stop using your data and delete it within a reasonable time, unless a law requires us to keep part of it (see “How long we keep data”).

Withdrawing consent does not affect anything we lawfully did before you withdrew it. If you withdraw while a project is running, we may not be able to continue the project.

06. Who we share data with

Your data is seen only by our team members who need it to handle your request or project. We also use these kinds of service providers (Data Processors), each bound to use the data only to provide their service to us:

• Website hosting and delivery: Serves this website to you. Like every web host, it keeps short technical logs (IP address, browser, page requested) for security.
• Server and database hosting: Runs the system that receives the booking form and stores enquiries for our team.
• Email, phone and messaging (such as Google mail and WhatsApp): Used when you write to us or we reply to you.
• Image delivery (Unsplash): Supplies the stock photos shown in the free preview. Your browser loads them directly from Unsplash.

We may also share data:

• when the law requires it, for example with a court, regulator or police authority acting under a valid legal order;
• to protect our rights, our clients or the public against fraud or a security threat; and
• with a buyer or successor if our business is merged, sold or restructured, who must protect it under this policy.

We never sell or rent your personal data.

07. Data stored outside India

Some of our service providers store or process data on servers outside India. Section 16 of the DPDP Act allows this, except to countries the Government of India restricts by notification. We do not transfer personal data to any restricted country. We choose providers that protect data with security measures at least as strong as those described here, and that commit by contract (their data processing terms, including standard contractual clauses where the law calls for them) to use it only to provide their service to us.

08. How long we keep data

• Enquiries that do not become projects: up to 12 months after our last conversation, then deleted.
• Client records: for the length of the project and any support period, and after that for as long as tax and accounting laws require us to keep invoices and records (generally up to 8 years).
• Technical logs: at least one year, as the DPDP Rules, 2025 require, and then deleted.
• If you withdraw consent or ask us to delete your data: deleted within a reasonable time, except anything a law requires us to keep.

09. How we protect your data

We use reasonable security safeguards, in line with the DPDP Rules, 2025, including:

• encryption in transit (HTTPS) for every page and form on this website;
• hosting with providers that encrypt stored data and keep backups;
• access limited to team members who need it, with individual logins and passwords stored only in hashed form; and
• logs to detect, investigate and fix any unauthorised access.

No website or system can be made completely secure, but we work to keep the risk as low as reasonably possible.

10. If a data breach happens

If a personal data breach affects you, we will tell you without delay, in plain language: what happened, what it could mean for you, what we are doing about it, and what you can do to protect yourself. We will also report it to the Data Protection Board of India within the time the DPDP Rules, 2025 require (currently 72 hours), and report it to CERT-In, India's national cyber security agency, within the time its directions require (currently 6 hours) where they apply.

11. Your rights

Under the DPDP Act you have the right to:

• Get information about the personal data we hold about you, how we use it, and who we have shared it with (section 11);
• Correct, complete, update or erase your personal data (section 12);
• Get a copy of the personal data you gave us, in a common format such as a PDF or spreadsheet (we offer this to everyone, wherever you live);
• Withdraw consent at any time (section 6);
• Have your complaints resolved by us (section 13); and
• Nominate another person to use these rights for you if you die or become unable to (section 14).

To use any of these rights, email hello@sparrowgen.in or use the button below. We may ask you to confirm your identity so we never give your data to someone else. We acknowledge every request within 48 hours and complete it within 30 days. That is faster than the 90 days the DPDP Rules, 2025 allow.

Make a data request

You do not need an account with us to use these rights: we do not create user accounts on this website, so a request by email or WhatsApp is all it takes. Using your rights is free.

12. Your duties

Section 15 of the DPDP Act also gives you duties: do not pretend to be someone else, do not hide important information when giving us your data, give true information when asking for a correction, and do not file false or frivolous complaints. Breaking these duties can lead to a penalty of up to ₹10,000 under the DPDP Act.

13. Grievance Officer and complaints

If you have a question or complaint about your personal data, contact our Grievance Officer:

We acknowledge complaints within 48 hours and resolve them within 30 days of receiving them (the DPDP Rules, 2025 allow up to 90 days). If you are not satisfied with our response, or we do not respond in time, you can complain to the Data Protection Board of India. Under section 13 of the DPDP Act, you need to contact us first before going to the Board.

We are not required to appoint a Data Protection Officer, because we are not a “Significant Data Fiduciary” under the DPDP Act. Our Grievance Officer handles all privacy questions.

14. Children

Our website and services are meant for adults (18 years or older) and for businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their details, email hello@sparrowgen.in and we will delete them.

15. Visitors and clients outside India

We are based in India and this policy follows Indian law. If you are in another country, these points also apply:

• European Union, UK and similar laws (such as the GDPR): we use your data on the basis of your consent, to take steps you ask for before a contract and to perform our contract with you, to meet legal obligations, and for our legitimate interest in keeping the website secure. You can also ask us to restrict or object to processing, or to give you a copy of your data in a portable format. You may complain to the data protection authority in your country.
• United States (such as California): we do not sell or “share” personal information for advertising, and we do not use it for targeted advertising.
• Other countries (for example Canada, Australia, Singapore, the UAE or Brazil): you can use any privacy right your local law gives you by emailing us, and we will honour it.
• Do Not Track and Global Privacy Control: we do not track visitors across websites, so these browser signals change nothing here: we do not collect that kind of data whether or not they are on.
• Your data may be processed in India and in the countries where our service providers operate.
• We have not appointed a representative in the EU or UK, because we deal with people there only occasionally. If that changes, we will appoint one and name them here.

Email hello@sparrowgen.in to use any of these rights.

16. Cookies

This website does not use advertising, analytics or tracking cookies. It only stores a few small settings in your browser to make the site work, such as your colour theme. Details are in our Cookie Policy.

17. Links to other websites

Our website links to other services and websites, such as WhatsApp, Instagram and websites we have built for clients. When you open them, their own privacy policies apply, and we are not responsible for how they handle your data.

18. This policy in your language

You can ask for this policy in English or in any language listed in the Eighth Schedule to the Constitution of India (for example Bengali or Hindi). Email hello@sparrowgen.in and tell us which language you prefer.

19. Changes to this policy

We may update this policy when our services or the law change. The “Last updated” date at the top shows the latest version. If a change affects how we use data you have already given us, we will tell you and, where the law requires, ask for your consent again.

20. Contact us

Sparrowgen, Kolkata, West Bengal, India
Email: hello@sparrowgen.in · WhatsApp: +91 62918 45804 / +91 80178 12091