Privacy Policy & Data Protection Statement

Effective Date: October 14, 2026 • Version 2.0

1. Dual Operating Roles: Data Fiduciary & Data Processor

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and relevant global frameworks (such as the EU/UK General Data Protection Regulation), Strova Group operates in two distinct legal capacities:

• Data Fiduciary (Data Controller): When you browse our website, request a project quote, communicate with our team via email or WhatsApp, create or access an account on our Client Portal, or contract with us as a direct commercial client, Strova Group determines the purpose and means of processing your personal data.
• Data Processor: When corporate clients contract Strova Group to develop, integrate, maintain, or host bespoke software applications, WhatsApp automations, or SaaS platforms that process personal data belonging to our client's end-customers, the client acts as the Data Fiduciary and Strova Group acts strictly as a Data Processor. In such cases, processing is governed by our formal written Statement of Work and Data Processing Addendum (DPA), which incorporate strict confidentiality, purpose-limitation, and subprocessing controls.

2. Personal Data Inventory

In accordance with the principle of data minimization (Section 6 of the DPDP Act), we collect only the personal data strictly required to deliver our professional services:

3. Cookie-Free Marketing & Essential Storage Only

We do not employ non-essential tracking cookies or invasive third-party ad pixels:

• Public Marketing Site (strovagroups.in): Operates with zero tracking cookies and zero third-party advertising cookies. Our web analytics engine is privacy-preserving and cookieless, capturing aggregated interactions without storing persistent device identifiers.
• Client Portal (portal.strovagroups.in): Uses strictly necessary authentication session cookies protected by the HttpOnly, Secure, and SameSite=Lax security attributes.
• Payment Gateway Modal: When paying an invoice via Razorpay, transient session cookies are set inside the Razorpay secure checkout iframe strictly to process the transaction and prevent payment fraud.

For full technical details, consult our standalone Cookie Policy.

4. Authorized Subprocessors & Cloud Infrastructure

Strova Group engages reputable enterprise cloud infrastructure providers to deliver its services. All subprocessors are bound by written data processing agreements ensuring security standards equivalent to or exceeding the DPDP Act 2023:

• Cloudflare, Inc. (USA / Global CDN): Edge hosting, DNS management, DDoS mitigation, and Turnstile bot protection.
• Supabase, Inc. (AWS Mumbai, India / Global): Managed PostgreSQL database, client authentication, and role-based access control storage.
• Razorpay Software Private Limited (India): RBI-authorized payment aggregator processing domestic (UPI, Netbanking, Cards) and international client payments. Strova Group never stores raw debit/credit card numbers or CVVs.
• Web3Forms / Formspree: Encrypted relay routing for inbound quote and privacy request notifications to our internal operations desk.
• Meta Platforms, Inc. / WhatsApp Business API: Direct client communications initiated at the customer's election.

5. AI Model Training & Automated Processing Safeguards

When delivering automation, custom SaaS, or engineering services:

• Client proprietary business data, source code, confidential databases, and customer communications are never used to train public or foundational third-party artificial intelligence models.
• Any AI or automated workflows developed by Strova Group utilize enterprise APIs with zero-data-retention (ZDR) agreements and strict tenant isolation.

6. International Data Transfers

Under Section 16 of the DPDP Act 2023, personal data may be transferred outside India unless restricted by Central Government notifications. For international clients in the European Economic Area (EEA), United Kingdom, United States, Canada, Australia, and Singapore, Strova Group executes standard contractual clauses and DPDP-compliant processor commitments to guarantee cross-border data protection.

7. Data Principal Rights under DPDP Act 2023

As a Data Principal under Indian law and applicable international regulations, you possess statutory rights regarding your personal information:

• Right to Access & Summary (Section 11): Request confirmation of whether your data is being processed, a summary of personal data held, and identities of Data Fiduciaries/Processors with whom data has been shared.
• Right to Correction & Completion (Section 12): Request correction of inaccurate personal data, completion of incomplete records, or updating of your contact details.
• Right to Erasure (Section 12): Request deletion of personal data when the original processing purpose is complete. Important Statutory Exception: Erasure does not apply to commercial tax invoices, financial ledgers, or audit logs required to be retained under Section 36 of the CGST Act 2017 (7-year mandatory retention).
• Right of Grievance Redressal (Section 13): Register grievances regarding our data protection practices with our designated officer.
• Right to Nominate (Section 14): Nominate an individual to exercise data principal rights in the event of your death or incapacity.
• Right to Withdraw Consent (Section 6): Withdraw processing consent at any time for non-statutory purposes.

8. How to Exercise Your Rights (Self-Service Web Desk)

To submit a formal request for access, correction, erasure, or grievance redressal, please use our dedicated web portal:

9. Data Protection & Grievance Redressal Desk

In accordance with the DPDP Act 2023, the Information Technology (Reasonable Security Practices) Rules 2011, and the Consumer Protection (E-Commerce) Rules 2020, Strova Group has appointed a dedicated Grievance Officer:

10. Regulatory Escalation to Data Protection Board of India

If our Grievance Redressal Desk fails to respond to your submission within 30 calendar days, or if you are unsatisfied with our resolution, you have the legal right under Section 13(3) of the DPDP Act 2023 to submit a formal complaint before the Data Protection Board of India.

11. Policy Amendments & Notifications

We review and update this Privacy Policy periodically to reflect legal amendments, technological enhancements, and regulatory notifications under the DPDP Rules 2025. Material updates will be announced via a prominent notice on our website and client portal.

Strova Group is an independent micro-enterprise operating as a proprietorship of Babita Kumari. Registered MSME: UDYAM-JH-20-0147452. Governing law: Republic of India.