Privacy Policy

1. Data Fiduciary / Operator Identity

The entity responsible for processing your personal information (the "Data Fiduciary" or "Data Controller") is:

2. Personal Data We Actually Collect

We strictly collect only the personal information necessary to deliver our IT consulting services, respond to inquiries, evaluate job applications, and improve website functionality. We collect data across three channels:

A. Data You Provide Directly

• Contact & Inquiry Forms (e.g., contact.php): Full Name, Email Address, Phone Number, Company / Organization Name, Selected Service Required, Estimated Budget Range, and Project Description / Requirements.
• Newsletter Subscription Forms (e.g., footer.php): Email Address provided voluntarily for technical articles and product updates.
• Blog Discussion & Comments (e.g., blog-single.php): Full Name, Email Address, and the text content of your comment.
• Job Applications & Career Inquiries (e.g., careers.php): Candidate Name, Contact Email, Phone, Resume / CV, Portfolio links, and career history submitted via email or contact forms.
• Chat Inquiries: Messages, email addresses, or phone numbers shared during interactive customer service conversations.

B. Data Collected Automatically (Technical & Device Data)

When you navigate our website, our web servers and standard browser interactions may record:

• Internet Protocol (IP) address.
• Browser type, version, and operating system.
• Referring URL, pages visited, time spent per page, and date/time stamps.
• Local storage state (e.g., cookie consent preferences saved as bb-cookies).

C. Sensitive Personal Data Notice

Our public website does NOT collect passwords, biometric information, government ID numbers (Aadhaar, PAN, SSN), or payment card PINs. If you engage us for custom software requiring payment, transactions are processed directly through certified third-party payment gateways; BleuByte does not store raw credit card numbers or banking passwords on its servers.

3. Legal Grounds and Purposes for Processing

We process your personal information strictly for legitimate business purposes, under the following grounds:

4. Cookies and Local Storage

We use local storage (such as localStorage.getItem('bb-cookies')) to record whether you have accepted or declined our non-essential cookie banner. For comprehensive information on how cookies function and how you can manage your browser preferences, please review our dedicated Cookie Policy.

5. Data Sharing and Third-Party Disclosures

We do NOT sell, rent, or trade your personal data to data brokers or advertising networks.

We may share information with trusted third-party service providers ("Data Processors") solely to operate our infrastructure:

• Hosting & Infrastructure Providers: Secure data centers and cloud servers (e.g., Apache/WAMP web server environments, cloud hosting providers).
• Communication & Email Deliverability Services: Transactional email servers used to deliver inquiries submitted via our forms.
• Content Delivery Networks & Fonts: Google Fonts, Cloudflare CDN, and jsDelivr for delivering CSS, JavaScript, and typography assets.
• Statutory Authorities: If required by a valid court order, government agency, law enforcement warrant, or statutory compliance under Indian laws.

6. International Data Transfers

BleuByte operates primarily from India. If you access our website from outside India, please note that your information may be processed and stored on servers located in India or our cloud service partner regions. We take reasonable contractual and technical steps to ensure that your personal information is protected in accordance with this Privacy Policy and applicable data protection standards.

7. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:

• Contact Form Inquiries: Retained for the duration of the commercial dialogue, plus up to 24 months for business audit and reference, unless earlier deletion is requested.
• Newsletter Subscriptions: Retained until the subscriber requests unsubscription or the email becomes consistently non-deliverable.
• Client Contracts & Invoices: Retained for a minimum of 7 years in accordance with Indian statutory tax and accounting retention requirements.
• Server Security Logs: Retained for 90 to 180 days for security auditing and then automatically purged.

8. Data Security Practices

In accordance with Rule 8 of the SPDI Rules, BleuByte implements reasonable security practices and procedures, including:

• Input sanitization and server-side validation against SQL injection, cross-site scripting (XSS), and automated form abuse.
• Transport Layer Security (HTTPS/TLS) encryption for data in transit across modern browser connections.
• Restricted administrative access on a need-to-know basis protected by authentication credentials.

While we apply industry-standard protections, no method of transmission over the Internet or electronic storage is 100% immune from security threats. Users are encouraged to maintain security hygiene when sharing confidential project specifications.

9. Your Rights as a Data Principal

Under the DPDP Act 2023 and relevant data protection laws, you possess specific rights regarding your personal information:

• Right to Access: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Updating: You may request the correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request the deletion of your personal data, subject to statutory retention obligations (e.g., tax records).
• Right to Withdraw Consent: Where processing is based on consent (such as newsletters), you may withdraw your consent at any time by emailing us or using the unsubscribe link.
• Right to Nominate: You may nominate an individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, please write to our Grievance Officer using the contact details provided in Section 11 below. We will respond within the statutory timeframe (typically within 15 to 30 days).

10. Children's Data

Our website and enterprise IT software services are directed exclusively at business professionals, enterprises, and individuals aged 18 and older. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us immediately for prompt deletion.

11. Grievance Officer & Contact Information

In compliance with the Information Technology Act, 2000, the SPDI Rules, and the Digital Personal Data Protection Act, 2023, the details of our designated Grievance Officer are set out below:

12. Updates to This Privacy Policy

We may periodically revise this Privacy Policy to accommodate new services, updated legal mandates, or changes in data processing technologies. All updates become effective upon publication on this page. We encourage you to review this page periodically for the latest information on our privacy practices.