Privacy Policy

Published by Rajendra Management Pvt. Ltd. (TechRajendra®) · CIN: [Registered CIN] · Plot No. 190, Dwarka, New Delhi – 110075

1. Scope and Application

This Privacy Policy ("Policy") is issued by Rajendra Management Pvt. Ltd., a company incorporated under the Companies Act, 2013, with its registered office at Plot No. 190, 3rd Floor, Pocket A2, Sector 17, Golf Course Road, Dwarka, New Delhi – 110075, India, operating the AravaliStack platform and the TechRajendra® brand (collectively, "Company," "we," "us," or "our").

This Policy applies to all personal data processed by the Company in connection with: (a) use of the AravaliStack software platform and associated services ("Platform"); (b) access to or use of our websites at www.aravalistack.com and www.techrajendra.com; (c) any commercial, contractual, or pre-sales engagement with the Company; and (d) communications directed to or received from the Company by any means.

This Policy is consistent with and governed by the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and, to the extent applicable to data subjects located in the European Economic Area or United Kingdom, the General Data Protection Regulation (EU) 2016/679.

2. Data Fiduciary

For purposes of the DPDP Act, 2023, the Company is the Data Fiduciary in respect of personal data collected through the Platform and our websites. Where the Platform is deployed by an enterprise customer on their own infrastructure (on-premise deployment), the enterprise customer is the Data Fiduciary in respect of their end-users' personal data, and the Company acts solely as a Data Processor to the extent of any data shared with us for support, maintenance, or monitoring purposes.

The Company has designated a Grievance Officer in accordance with the IT Act and DPDP Act. Contact: grievance@aravalistack.com · Rajendra Management Pvt. Ltd., Plot No. 190, Dwarka, New Delhi – 110075.

3. Categories of Personal Data Collected

We collect personal data only to the extent necessary for the purposes set out in this Policy. The categories we may collect include:

Identity Data

Full name, job title, employer name, and professional contact information provided during registration, demo requests, procurement enquiries, or contractual engagement.

Contact Data

Business email address, office telephone number, and mailing address. We do not collect personal mobile numbers unless voluntarily provided for support purposes.

Technical Data

IP address, browser type and version, device identifiers, access timestamps, referring URL, and pages visited on our websites. Collected automatically via server logs and, where consented, analytics tools.

Usage Data

Platform feature usage telemetry, API call patterns, and configuration metadata — collected only in respect of Platform licensees and only where the enterprise customer's agreement permits such telemetry for support and product improvement purposes.

Communications Data

Contents of emails, support tickets, and form submissions directed to us. Retained for the period necessary to resolve the subject matter and for a further period of three (3) years for legal and compliance purposes.

We do not collect sensitive personal data as defined under the SPDI Rules (including financial information, health records, biometric data, or sexual orientation) in the ordinary course of business. If such data is shared with us inadvertently, we will notify you and delete it promptly.

4. Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis to do so. The purposes and corresponding legal bases are as follows:

Purpose	Legal Basis (DPDP Act)
Responding to enquiries and demo requests	Consent / Legitimate use
Performing and administering contracts with enterprise customers	Performance of contract
Providing technical support and maintenance	Performance of contract / Legitimate use
Sending product updates and security advisories	Legitimate use (existing customers) / Consent (prospects)
Security monitoring and fraud prevention	Legal obligation / Legitimate use
Compliance with applicable law and regulatory obligations	Legal obligation

5. Data Localisation and Cross-Border Transfers

AravaliStack is architected as a sovereign, on-premise platform. Personal data of Indian residents processed through customer-deployed instances of AravaliStack remains within the customer's own infrastructure and is not transferred to or stored on Company servers unless the customer initiates a support engagement that requires diagnostic data sharing.

In respect of personal data held by the Company (such as contact details of enterprise customers' representatives), such data is stored on servers located in India. Any cross-border transfer of personal data is conducted only: (a) with the explicit consent of the data principal; (b) pursuant to a contractual necessity; or (c) in compliance with rules notified by the Central Government under Section 16 of the DPDP Act.

We will update this Policy promptly upon notification of any cross-border transfer restrictions issued under the DPDP Act.

6. Retention

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our standard retention periods are:

Enquiry and pre-sales data: 24 months from last interaction, or until you withdraw consent.
Contractual and transactional records: 7 years from expiry of the relevant contract, as required under Indian accounting and tax law.
Security logs and audit trails: 12 months, extendable upon legal hold.
Support correspondence: 3 years from ticket closure.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in a manner that prevents re-identification.

7. Rights of Data Principals

Subject to the provisions of the DPDP Act and applicable regulations, you have the following rights in respect of your personal data held by us:

Right to Access

Obtain a summary of the personal data held about you and the processing activities undertaken.

Right to Correction

Request correction of inaccurate or incomplete personal data.

Right to Erasure

Request deletion of personal data where processing is no longer necessary or where consent has been withdrawn, subject to legal retention requirements.

Right to Grievance Redressal

Lodge a complaint with our Grievance Officer. If unsatisfied, escalate to the Data Protection Board of India.

Right to Nominate

Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

Right to Withdraw Consent

Withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal.

To exercise any right, write to privacy@aravalistack.com. We will respond within 30 days of receiving your request and, where required, within the timelines prescribed by the DPDP Act.

8. Cookies and Tracking Technologies

Our websites use the following categories of cookies and similar technologies:

Strictly necessary cookies: Required for website security and basic functionality. Cannot be disabled.
Analytical cookies: Used to understand how visitors interact with our websites. Deployed only with your consent. No cross-site tracking.
Preference cookies: Store your consent choices and UI preferences.

We do not use advertising or behavioural tracking cookies. AravaliStack products are ad-free. We do not sell, rent, or share personal data with advertising networks or data brokers.

9. Security

We implement and maintain technical and organisational measures appropriate to the risk of processing, including: encryption of data in transit (TLS 1.3) and at rest (AES-256); access controls on a least-privilege basis; regular vulnerability assessments; and incident response procedures in accordance with CERT-In reporting timelines. A summary of our security posture is available at our Security Trust Centre.

10. Changes to this Policy

We may update this Policy from time to time to reflect changes in law, regulatory guidance, or our processing practices. The revised Policy will be published on this page with an updated effective date. Where the change is material, we will notify active customers by email at least 14 days before the change takes effect. Continued use of the Platform or our websites after the effective date constitutes acceptance of the revised Policy.

11. Governing Law and Jurisdiction

This Policy is governed by the laws of India. Any dispute arising out of or relating to this Policy that is not resolved through our grievance mechanism shall be subject to the exclusive jurisdiction of the courts at New Delhi, India.