Privacy Policy

Introduction

Welcome to Arowai Digital ("Company," "we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://arowai.com/ and use our services.

This Privacy Policy is designed to comply with:

The Information Technology Act, 2000 and its amendments
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
The Digital Personal Data Protection Act, 2023 (DPDP Act)
Other applicable Indian privacy and data protection laws

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site.

Compliance with Laws

Information Technology Act, 2000

We comply with the provisions of the IT Act, 2000, and maintain reasonable security practices to protect your personal information.

SPDI Rules, 2011

We follow the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 for handling Sensitive Personal Data or Information (SPDI), which includes:

Passwords and financial information
Physical, physiological, and mental health conditions
Sexual orientation
Medical records and history
Biometric information

Digital Personal Data Protection Act, 2023 (DPDP Act)

We are committed to compliance with the DPDP Act, which provides:

Consent-based processing: We process your data only with your consent
Purpose limitation: Data is used only for specified, lawful purposes
Data minimization: We collect only necessary information
Right to access and correction: You can access and update your data
Right to erasure: You can request deletion of your data (subject to legal obligations)
Right to grievance redressal: You can raise concerns with our Grievance Officer

Data Localization

In accordance with Indian regulations, certain categories of data may be stored and processed within India. We ensure appropriate safeguards when data is transferred internationally.

Information We Collect

Information You Provide to Us

We collect personal information that you voluntarily provide to us when you:

Register on the website
Express an interest in obtaining information about us or our products and services
Participate in activities on the website
Contact us

The personal information we collect may include:

Contact Information: Name, email address, phone number, mailing address
Account Credentials: Username, password, and security questions
Payment Information: Credit card numbers, billing address, and payment details (processed securely through third-party payment processors)
Communication Data: Information you provide when you contact us for support or inquiries
Professional Information: [Customize based on your business - e.g., company name, job title, industry]

Information Automatically Collected

When you visit our website, we automatically collect certain information about your device and browsing actions, including:

Device Information: IP address, browser type, operating system, device identifiers
Usage Data: Pages viewed, time spent on pages, links clicked, referring website addresses
Location Data: General geographic location based on IP address
Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to enhance your experience

How We Use Your Information

We use the information we collect for various purposes, including to:

Provide and Maintain Services: Process transactions, manage accounts, and deliver requested services
Improve User Experience: Understand how you use our website and services to enhance functionality
Communication: Send administrative information, updates, security alerts, and marketing communications (with your consent)
Customer Support: Respond to inquiries and provide technical support
Analytics and Research: Analyze trends, track user behavior, and gather demographic information
Security and Fraud Prevention: Protect against unauthorized access, detect fraudulent activity, and ensure platform security
Legal Compliance: Comply with legal obligations and enforce our terms and conditions
Marketing and Personalization: Send promotional materials and personalize content (you can opt-out at any time)

Consent and Choice

In compliance with the Digital Personal Data Protection Act, 2023, we process your personal data based on your consent. Here's how we obtain and manage your consent:

How We Obtain Consent

Clear and Specific: We provide clear information about what data we collect and why
Freely Given: Consent is voluntary and not a condition for service (except where necessary for service delivery)
Informed: We explain the purpose, duration, and implications of data processing
Verifiable: We maintain records of consent obtained
Easy to Withdraw: You can withdraw consent as easily as you gave it

Types of Consent

Explicit Consent: Required for processing sensitive personal data (SPDI)
Implied Consent: For necessary processing to deliver services you've requested
Parental Consent: Required for processing data of individuals under 18 years

Withdrawing Consent

You can withdraw your consent at any time by:

Emailing us at: connect@arowai.digital
Using the unsubscribe link in our emails
Adjusting your account settings
Contacting our Grievance Officer

Important: Withdrawing consent may limit your ability to use certain features or services. We will inform you of any such consequences before processing your withdrawal request.

Marketing Communications

We will only send marketing communications with your consent
You can opt-out at any time using the unsubscribe link in emails
Opting out of marketing does not affect essential service communications

How We Protect Your Information

We implement robust security measures to protect your personal information:

Technical Safeguards

Encryption: We use SSL/TLS encryption for data transmission
Secure Storage: Personal data is stored on secure servers with restricted access
Access Controls: Limited employee access based on need-to-know principles
Regular Security Audits: Periodic assessment of our security practices and infrastructure
Firewalls and Intrusion Detection: Protection against unauthorized access attempts

Organizational Safeguards

Employee Training: Regular security awareness and data protection training
Confidentiality Agreements: All employees and contractors sign confidentiality agreements
Data Minimization: We collect only the information necessary for our services
Incident Response Plan: Procedures in place for responding to data breaches

Payment Security

PCI DSS Compliance: We adhere to Payment Card Industry Data Security Standards
Third-Party Processors: Payment information is processed by certified payment processors (e.g., Stripe, PayPal)
No Storage of Full Card Details: We do not store complete credit card numbers on our servers

Important Notice: While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

Data Breach Notification

In compliance with Indian data protection laws, we have established procedures for data breach response:

Our Commitment

In the event of a data breach that may compromise your personal information:

Prompt Detection: We maintain systems to detect security incidents quickly
Investigation: We immediately investigate the nature and scope of the breach
Containment: We take immediate steps to contain and remediate the breach
Notification: We notify affected users and relevant authorities as required by law

Notification Timeline

To Affected Users: We will notify you within 72 hours of becoming aware of a breach affecting your personal data
To Authorities: We will report to the Data Protection Board of India and other relevant authorities as required
To CERT-In: We will report cyber security incidents to the Indian Computer Emergency Response Team (CERT-In) as mandated

What We'll Tell You

Our breach notification will include:

Nature of the data breach
Type of personal data affected
Likely consequences of the breach
Measures taken or proposed to address the breach
Contact information for further inquiries

What You Should Do

If we notify you of a data breach:

Change your passwords immediately
Monitor your accounts for suspicious activity
Contact our Grievance Officer for support
Follow any specific recommendations we provide

Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

Service Providers

We may share information with third-party service providers who perform services on our behalf:

Cloud Hosting: [e.g., AWS, Google Cloud, Azure]
Payment Processing: [e.g., Stripe, PayPal, Square]
Email Services: [e.g., SendGrid, Mailchimp]
Analytics: [e.g., Google Analytics, Mixpanel]
Customer Support: [e.g., Zendesk, Intercom]

These providers are contractually obligated to protect your information and use it only for specified purposes.

Business Transfers

If we undergo a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

Legal Requirements

We may disclose your information when required by law or to:

Comply with legal obligations, court orders, or government requests
Protect our rights, property, or safety
Prevent fraud or illegal activity
Enforce our terms and conditions

With Your Consent

We may share your information for other purposes with your explicit consent.

Your Privacy Rights

Depending on your location, you may have the following rights:

General Rights

Access: Request a copy of the personal information we hold about you
Correction: Request correction of inaccurate or incomplete information
Deletion: Request deletion of your personal information (subject to legal obligations)
Data Portability: Request your data in a structured, commonly used format
Opt-Out: Unsubscribe from marketing communications at any time
Object: Object to certain processing activities

Regional Rights

Indian Residents (DPDP Act, 2023 & IT Act, 2000):

Right to access your personal data
Right to correction and updation of inaccurate data
Right to erasure and right to be forgotten (subject to legal retention requirements)
Right to data portability
Right to withdraw consent at any time
Right to nominate another individual to exercise rights in case of death or incapacity
Right to grievance redressal through our Grievance Officer
Right to complain to the Data Protection Board of India

California Residents (CCPA): Additional rights including the right to know what personal information is sold or disclosed and to opt-out.

European Residents (GDPR): Additional rights including the right to restrict processing, the right to object, and the right to lodge a complaint with a supervisory authority.

Exercising Your Rights

To exercise your privacy rights, please contact us at:

Email: connect@arowai.digital
Contact Form: https://arowai.com/contact
Mail: No-579, 3rd Sector, HSR Layout, Bangalore - 560102, Karnataka, India
Phone: +91 90362 11222
Grievance Officer: connect@arowai.digital

We will respond to your request within 30 days (or as required by applicable law).

Cookies and Tracking Technologies

We use cookies and similar technologies to:

Essential Cookies: Enable core website functionality
Performance Cookies: Analyze website usage and performance
Functional Cookies: Remember your preferences and settings
Advertising Cookies: Deliver relevant advertisements (if applicable)

Managing Cookies

You can control cookies through your browser settings. However, disabling cookies may limit website functionality.

For more information, visit our [Cookie Policy] or use our cookie consent tool on the website.

Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to review their privacy policies.

Children's Privacy

As per the Digital Personal Data Protection Act, 2023, our services are not intended for individuals under the age of 18 years without verifiable parental consent. We do not knowingly collect personal information from children under 18 without parental consent.

If we become aware that we have collected personal data from a child under 18 without verification of parental consent, we will take steps to delete that information as soon as possible.

Parents or legal guardians who believe we have collected information from their child can contact our Grievance Officer at connect@arowai.digital.

Data Retention

We retain your personal information for as long as necessary to:

Fulfill the purposes outlined in this privacy policy
Comply with legal, accounting, or reporting requirements
Resolve disputes and enforce our agreements

When your information is no longer needed, we will securely delete or anonymize it.

Data Storage and Security Infrastructure

Data Storage Location

As an Indian company, we prioritize data localization:

Primary Storage: Critical personal data and SPDI are primarily stored on servers located in India
Backup and Redundancy: We maintain secure backup systems to ensure data availability and business continuity
Compliance: We comply with data localization requirements under Indian law for sensitive personal data

Data Center Security

Our data centers and cloud infrastructure providers maintain:

ISO 27001 certification
SOC 2 compliance
24/7 monitoring and surveillance
Physical access controls
Environmental controls (fire suppression, climate control)

International Data Transfers

While we are based in India and primarily store data within India, certain services may require international data transfers (e.g., cloud services, analytics tools).

When transferring data internationally, we ensure:

Legal Basis: Transfers are made only when necessary and with appropriate legal safeguards
Standard Contractual Clauses: Use of standard contractual clauses approved by relevant authorities
Adequacy Decisions: Transfers to countries recognized as providing adequate data protection
Your Consent: We obtain your explicit consent when required by law
Security Measures: Encryption and secure transmission protocols for all international transfers

You have the right to obtain information about the safeguards we have in place for international data transfers by contacting us at connect@arowai.digital.

Updates to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of significant changes by:

Posting the new privacy policy on this page
Updating the "Last Updated" date
Sending an email notification (for material changes)

We encourage you to review this privacy policy periodically.

Contact Us

If you have questions, concerns, or requests regarding this privacy policy or our data practices, please contact us:

Email: connect@arowai.digital
Website: https://arowai.com/contact
Address: No-579, 3rd Sector, HSR Layout, Bangalore - 560102, Karnataka, India
Phone: +91 90362 11222

Grievance Officer (As per IT Act, 2000 and DPDP Act, 2023)

In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer to address your concerns regarding data privacy and security.

Email: connect@arowai.digital
Address: No-579, 3rd Sector, HSR Layout, Bangalore - 560102, Karnataka, India
Phone: +91 90362 11222
Working Days: Monday to Friday (10:00 AM - 6:00 PM IST)
Response Time: We aim to respond to all grievances within 72 hours

If you are not satisfied with the resolution provided by our Grievance Officer, you have the right to approach the Data Protection Board of India (once constituted under the DPDP Act, 2023).