Privacy Policy

1. Commitment to Privacy & Data Controller

INNISHA Digital Studio (“INNISHA”, “we”, “us”, or “our”) operates the digital presence at https://innisha.in along with our associated bespoke web applications, digital QR ordering systems, and workflow integrations.

We act as the Data Fiduciary / Data Controller for all data submitted directly through our website inquiries. For hospitality tenant menus and client applications deployed by INNISHA, we act as a Data Processor on behalf of our enterprise clients.

We practice strict data minimization: we collect solely the information essential to deliver engineering solutions, evaluate project viability, and execute commercial contracts.

2. Information We Collect

We collect information only when voluntarily provided or generated through authenticated interaction with our services:

• Project Inquiries & Consultation: Name, business name, work email address, phone / WhatsApp number, project specifications, architectural preferences, and timeline requirements.
• Authentication & Client Access: Encrypted credentials, multi-factor session tokens, and business profile metadata for client portal administrators.
• Hospitality & QR Ordering Operations: Guest phone number and table identifiers solely when an end-customer chooses to receive live order dispatch updates or OTP-authenticated checkout.
• Diagnostic & Security Telemetry: Standard non-personally identifiable server logs (IP address, browser agent, request timestamp, and HTTP error codes) strictly used for DDoS mitigation, rate limiting, and uptime monitoring.

3. Lawful Basis & Purpose of Processing

In accordance with the Digital Personal Data Protection (DPDP) Act 2023 and the General Data Protection Regulation (GDPR), we process your data based on:

• Performance of Contract: Scoping project deliverables, developing software architectures, and fulfilling milestone agreements.
• Legitimate Interests: Securing our infrastructure against fraudulent activity and responding to inbound commercial inquiries.
• Explicit Consent: Delivering direct communications, scheduling technical consultations, or sharing project proposals upon your explicit request.
• Legal Compliance: Retaining mandatory tax invoices and commercial records required by statutory auditing authorities.

4. Trusted Third-Party Infrastructure

We do not utilize unauthorized third-party trackers or ad exchanges. We only interface with SOC 2 Type II and ISO 27001 certified technology providers:

5. Data Security, Retention & Cryptography

We implement defense-in-depth security engineering including parameterized database queries (preventing SQL injection), strict Content Security Policies (CSP), HTTP-only secure cookie sessions, and role-based access controls.

Inquiry data is retained only for the duration required to manage active client relationships or statutory audit windows (typically 7 years for financial records). Inactive lead inquiries are purged periodically.

6. Your Statutory Rights

You maintain full control over your personal data under global data protection frameworks:

• Right to Access: Request a complete machine-readable copy of any personal data we store regarding your account.
• Right to Rectification: Promptly correct outdated or inaccurate business contact details.
• Right to Erasure (“Right to be Forgotten”): Demand permanent deletion of your inquiry and account data, subject to statutory accounting requirements.
• Right to Grievance Redressal: Submit a complaint directly to our designated Grievance Officer for resolution within 48 business hours.

7. Cookies & Tracking Technologies

Our website uses strictly necessary functional cookies required for session authentication, security token validation, and interface preference retention. We do not use cross-site tracking pixels or sell ad-targeting identifiers. For detailed guidance, please review our Cookie Policy.