Privacy Policy

1. About Padmalaya Group

Padmalaya Group is a real estate development enterprise headquartered in Kolkata, in operation since 1982. We develop residential and mixed-use projects and maintain the Website to showcase our portfolio, communicate project information, and enable prospective customers to express interest in our offerings.

Our registered correspondence address is Kolkata, West Bengal.

2. Scope and Applicability

This Policy applies to all personal data processed by Padmalaya through the Website, including but not limited to data submitted via the general enquiry form, the project-specific pop-up callback form, communications initiated through the WhatsApp or email channels referenced on the Website, and data generated automatically when you browse the Website.

This Policy does not apply to personal data collected offline, through social media platforms we may operate, or through any third-party platform that is not part of the Website. It also does not apply to information collected by third parties whose sites you may reach by following links from the Website; such third parties maintain their own privacy policies, and we encourage you to review them before interacting with those sites.

3. Definitions

For the purposes of this Policy, the following terms carry the meanings set out against them:

• DPDP Act means the Digital Personal Data Protection Act, 2023, and any rules, regulations, or notifications issued under it.
• IT Act means the Information Technology Act, 2000, together with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”).
• Personal Data means any data about an individual who is identifiable by, or in relation to, such data, as defined under the DPDP Act, and includes Sensitive Personal Data or Information as defined under the SPDI Rules.
• Processing includes any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, retrieval, use, disclosure, dissemination, erasure, and destruction.
• Data Principal means the natural person to whom the Personal Data relates (that is, you).
• Data Fiduciary means the person who, alone or in conjunction with others, determines the purpose and means of Processing of Personal Data (that is, Padmalaya).
• Data Processor means a person who processes Personal Data on behalf of a Data Fiduciary.

4. Information We Collect

4.1 Information you provide to us

When you submit the general enquiry form on the Contact page, or the project-specific pop-up callback form on any project page, we collect the information you choose to provide. Depending on the form in use, the information collected may include:

• Your full name
• Telephone or mobile number
• Email address
• The project, property category, or type of enquiry you have selected
• Your preferred time for us to contact you
• The source through which you learnt about Padmalaya (optional)
• Any free-text message or query you choose to include

Submission of personal information through the forms is voluntary. However, if you do not provide the minimum information required for us to respond to your enquiry (such as your name together with a telephone number or email address), we may be unable to attend to your request.

4.2 Information collected automatically

When you submit an enquiry, our servers record the Internet Protocol (IP) address from which the submission was received, together with technical metadata such as the user agent string transmitted by your browser. We use this information strictly to apply short-duration rate limits, to detect and prevent automated abuse of the Website, and to maintain operational logs. If you arrive at the Website from an online advertisement, the destination URL may carry campaign-identification tags (commonly known as UTM parameters) which, when present, we record alongside your enquiry so that we may assess which advertising campaigns are generating authentic interest.

4.3 Information stored in your browser

Upon successful submission of the pop-up callback form on a project page, we record a short indicator in your browser's local storage area so that the same pop-up is not presented to you again on repeat visits to that project. The indicator is scoped to the specific project and contains no information other than the fact that a prior submission occurred from the same browser. You may delete this indicator at any time through the storage-clearing options of your browser.

4.4 Information we do not collect

The Website does not collect financial information, including credit or debit card numbers, bank account particulars, or payment credentials, as no commercial transactions are concluded through the Website. The Website does not require account creation and does not solicit passwords from Users. We do not knowingly collect biometric data, health information, or any other category classified as sensitive personal data unless such information is voluntarily included by you in the free-text field of an enquiry form.

5. Purpose of Collection and Use

Personal Data collected through the Website is used for the following purposes:

• To respond to your enquiry, share information about the projects or properties you have expressed interest in, and arrange follow-up communication at a time convenient to you;
• To coordinate site visits, consultations, and sales-related interactions when you request them;
• To maintain internal records of enquiries received, so that our sales and customer-relations teams may track and manage prospect communication;
• To attribute enquiries to the specific advertising campaign or referral channel through which you reached the Website, so that we may measure the effectiveness of those channels;
• To protect the Website against spam, automated submissions, and other forms of abuse by applying rate limits and bot-detection techniques;
• To comply with applicable law, respond to lawful requests from governmental or regulatory authorities, and to establish, exercise, or defend legal claims;
• To send you administrative communications relating directly to the enquiry you have submitted.

We do not sell, trade, rent, or otherwise commercialise Personal Data. We do not use Personal Data for behavioural advertising, profiling for marketing purposes, or automated decision-making that would produce legal or similarly significant effects on you.

6. Legal Basis for Processing

We process Personal Data on the following legal bases recognised under the DPDP Act and under the SPDI Rules framed under the IT Act:

• Consent. When you voluntarily submit information through the enquiry or pop-up callback forms, you are deemed to have provided consent for us to process that information for the purposes stated in this Policy. The consent you provide is free, specific, informed, unconditional, and unambiguous within the meaning of the DPDP Act, and is signified by a clear affirmative action — namely, your submission of the form after reviewing the fields.
• Certain legitimate uses. We rely on the legitimate-use grounds set out in Section 7 of the DPDP Act for a limited set of activities — chiefly the short-duration logging of IP addresses to enforce rate limits, bot detection, security monitoring, maintenance of the Grievance Officer workflow, and compliance with any obligation imposed on us by law or by a court or tribunal of competent jurisdiction.
• Compliance with law. Where Processing is required for compliance with any obligation imposed by law in force in India, we may process Personal Data on that basis without the need for separate consent.

7. Consent and Withdrawal of Consent

You may withdraw the consent you have given to us at any time, with effect for the future. To withdraw consent, please send a written request to the Grievance Officer at the contact details provided in Section 19. On receipt of a valid withdrawal request, we will cease Processing your Personal Data for consent-based purposes within a reasonable period and will take steps to erase such Personal Data from our active records, subject to retention obligations imposed by law.

Withdrawal of consent will not affect the lawfulness of any Processing carried out on the basis of your consent before the withdrawal, and does not require us to erase Personal Data that we are permitted or required to retain under a legitimate use or under any law in force.

8. Disclosure and Sharing of Personal Data

We treat the Personal Data collected through the Website as confidential and share it only in the limited circumstances set out below:

• With our Data Processors, who process Personal Data strictly on our instructions and under contractual obligations of confidentiality and security, as described in Section 9;
• With our internal sales, customer-relations, and administrative personnel, each of whom is bound by confidentiality obligations and is permitted access only to the extent necessary to perform their function;
• With professional advisers — such as lawyers, auditors, and consultants — where disclosure is reasonably necessary for us to obtain their advice or service and subject to their own professional confidentiality obligations;
• With governmental authorities, courts, tribunals, or regulators where disclosure is required by applicable law, by a validly issued order, or to establish, exercise, or defend legal rights;
• With a successor in interest in the event of a merger, acquisition, reorganisation, or sale of business assets, subject to the successor undertaking to treat your Personal Data in accordance with this Policy.

We do not disclose Personal Data to any third party for independent marketing, direct advertising, or profiling, except with your separate and specific consent.

9. Data Processors Engaged by Us

In the ordinary course of operating the Website, we rely on a limited number of third-party service providers to perform specific technical functions on our behalf. Each such provider acts as a Data Processor and is contractually bound to Process Personal Data only in accordance with our instructions and the requirements of applicable law.

• Supabase Inc. provides managed database infrastructure in which the Website's enquiry records and operational data are stored. Data at rest is encrypted and access is governed by row-level security policies configured by us.
• Cloudflare, Inc. operates the Cloudflare Turnstile service used by the Website to verify that form submissions originate from genuine human visitors. Turnstile receives a session token together with technical signals including the IP address of the requesting browser.
• Resend, Inc. delivers the internal transactional email notifications that alert our team to new enquiries. Resend processes the content of the notification email on our behalf for the sole purpose of transmission.
• Vercel Inc. hosts and serves the Website and maintains operational logs necessary for the delivery of hosting services.
• Google LLC delivers typefaces used across the Website through its Google Fonts service. When you load a page, your browser requests the font files directly from Google's servers.

The list of Data Processors identified above is current as of the effective date of this Policy. If we engage additional Data Processors, or discontinue the use of any listed above, we will update this Section at the next revision of this Policy.

10. Transfer of Personal Data Outside India

Certain of the Data Processors identified in Section 9 operate infrastructure located outside India, primarily in the United States of America and other jurisdictions. In the course of Processing, your Personal Data may therefore be transmitted to or stored in a country outside India.

Where such a transfer takes place, we rely on the contractual commitments made to us by the Data Processor, including commitments relating to confidentiality, access control, encryption in transit and at rest, and security incident response. We will cease to use any Data Processor whose practices are shown to be materially inconsistent with the standards expected under the DPDP Act or the SPDI Rules.

The Central Government is empowered under Section 16 of the DPDP Act to restrict the transfer of Personal Data to specific countries or territories by notification. We will comply with any such restriction promptly on its coming into force.

11. Cookies and Similar Technologies

The Website makes limited use of cookies and client-side storage. The technologies used fall into the following categories:

Strictly necessary storage

This category includes any item of storage required for the Website to function as intended, such as the local-storage indicator that records your prior submission of a project-specific pop-up callback form, and any transient cookies that Cloudflare Turnstile may set as part of its bot-verification challenge. Strictly necessary storage is not subject to a prior opt-in, since the Website would not function correctly without it.

Analytics and performance cookies

As of the effective date of this Policy, the Website does not deploy third-party analytics or performance-measurement cookies. If we later introduce such tools, we will update this Section accordingly and, where required by law, obtain your consent before activating them.

Advertising and tracking cookies

We do not deploy advertising cookies, retargeting pixels, or cross-site tracking technologies on the Website. We do not permit third parties to deploy such technologies through the Website.

Controlling browser storage

You may clear cookies and local storage, and reconfigure your browser to accept or reject them, through your browser's settings. Clearing the storage used by the Website will cause the project-specific pop-up callback form to be shown again on subsequent visits.

12. Retention of Personal Data

We retain Personal Data only for as long as is reasonably necessary for the purpose for which it was collected, or for a longer period where retention is required or permitted by applicable law. The following retention practices apply:

• Enquiry records. Personal Data submitted through the enquiry and pop-up callback forms is retained while the enquiry is active, through the sales cycle, and for a reasonable period thereafter to permit follow-up communication, warranty administration, dispute resolution, and the maintenance of business records. You may at any time request earlier erasure of your record by writing to the Grievance Officer.
• Operational logs. IP addresses recorded for the purpose of rate limiting are consulted only within a rolling one-hour window; records older than that window are not referenced in further rate-limit decisions and are retained only to the extent needed for security monitoring and audit.
• Browser storage. The pop-up suppression indicator stored in your browser remains until you clear your browser storage. We have no ability to retain or extend it beyond that.

Following expiry of the applicable retention period, Personal Data is deleted, anonymised, or placed beyond the reach of ordinary business processes in a manner consistent with the DPDP Act and good industry practice.

13. Security Practices

We have adopted and maintain reasonable security practices and procedures, consistent with the requirements of the SPDI Rules and the DPDP Act, to protect Personal Data from unauthorised access, disclosure, alteration, loss, or destruction. These include, without limitation:

• Transmission of all data between your browser and the Website exclusively over the HTTPS protocol with TLS encryption;
• Storage of enquiry records in a managed database protected by row-level access control policies, with encryption at rest provided by the hosting infrastructure;
• Restriction of access to the internal administrative interface of the Website to authorised personnel who are required to authenticate using multi-factor authentication;
• Application of CAPTCHA verification and per-IP rate limiting on all form submissions, in order to detect and deter automated attacks;
• Maintenance of audit logs capturing administrative actions taken on enquiry records;
• Periodic review of access rights of personnel and of the Processors identified in Section 9.

Notwithstanding these measures, you acknowledge that no electronic transmission or electronic storage of information can be guaranteed to be fully secure. In the event of a personal data breach that is likely to result in a significant harm to you, we will notify you and the Data Protection Board of India in accordance with the requirements of the DPDP Act.

14. Rights of Data Principals

As a Data Principal, you are entitled to exercise the following rights in respect of your Personal Data, subject to the conditions and exceptions contained in the DPDP Act and the SPDI Rules. All such requests should be addressed to the Grievance Officer at the contact details set out in Section 19.

• Right to information and access. You may request a summary of the Personal Data we hold about you, the Processing activities we conduct, and the identity of the Data Processors with whom the information is shared.
• Right to correction and completion. You may request the correction of inaccurate or misleading Personal Data and the completion of incomplete Personal Data held by us.
• Right to erasure. You may request the erasure of Personal Data that is no longer necessary for the purpose for which it was collected or for which you have withdrawn consent, subject to retention requirements imposed by law.
• Right to withdraw consent. You may withdraw the consent given by you at any time, in the manner described in Section 7 above.
• Right to nominate. You may nominate any other individual to exercise these rights on your behalf in the event of your death or incapacity, in such form and manner as may be prescribed under the DPDP Act.
• Right to grievance redressal. You may raise a grievance with our Grievance Officer in relation to the exercise of any of the rights mentioned above or in relation to any other matter covered by this Policy. If you remain dissatisfied with the response of the Grievance Officer, you may make a complaint to the Data Protection Board of India once the Board is operational.

Before acting on a rights request, we may ask you to verify your identity in a reasonable manner so as to prevent inadvertent disclosure of Personal Data to a person other than the Data Principal.

15. Children's Data

The Website is intended for use by individuals who have attained the age of majority under the laws of India. We do not knowingly solicit or collect Personal Data from any child, defined under the DPDP Act as an individual below the age of eighteen years, without the verifiable consent of a parent or lawful guardian in the manner prescribed by the Act. If you are a parent or guardian and you believe that a child has provided Personal Data through the Website, please contact the Grievance Officer so that we may take steps to delete the information.

16. Links to External Websites

The Website may contain hyperlinks to third-party websites, including the West Bengal Real Estate Regulatory Authority portal, map and mapping-service providers, and resources operated by project collaborators or regulatory bodies. We do not control the collection or processing of Personal Data by such third parties. The presence of a hyperlink does not constitute an endorsement by us of the linked site or of the privacy practices followed by its operator. We encourage you to review the privacy policy of each external site before providing any Personal Data to it.

17. Changes to this Policy

We may revise this Policy from time to time in order to reflect changes in our Processing activities, in the Data Processors we rely upon, in applicable law, or in industry practice. The current version of this Policy, together with its effective date, will at all times be available at this URL. Where a revision materially alters the manner in which we handle Personal Data you have already shared with us, we will take reasonable steps to bring the revision to your attention, including, where we hold a current email address for you, by sending a notice to that address.

18. Disclaimer

The information presented on the Website — including project renderings, specifications, dimensions, amenities, pricing indications, and timelines — is provided for general informational purposes and does not constitute an offer, invitation to offer, or binding contract. All project details are subject to revision at the discretion of the developer and to approvals from the competent authorities.

Nothing in this Policy, nor the fact that you have submitted an enquiry through the Website, shall be construed as creating any contractual relationship between you and Padmalaya in respect of any specific property, project, or transaction.

19. Grievance Officer

In accordance with the requirements of the Information Technology Act, 2000, the SPDI Rules framed thereunder, and the Digital Personal Data Protection Act, 2023, we have designated a Grievance Officer to receive and address complaints, requests, and communications relating to Personal Data processed through the Website.

We endeavour to acknowledge grievances and rights requests within such reasonable period as may be prescribed under applicable law, and in any event to issue a substantive response within thirty days of receipt of a valid request. You may also reach us through the general Contact page of the Website, marking your communication for the attention of the Grievance Officer.

20. Governing Law

This Policy, and the Processing of Personal Data in accordance with it, is governed by and shall be construed in accordance with the laws of India. Without limitation, the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 (together with the rules and regulations framed under them) apply to the collection and Processing of Personal Data through the Website.

21. Jurisdiction

Subject to the exclusive jurisdiction conferred on any adjudicating authority or tribunal established under the DPDP Act, any dispute, controversy, or claim arising out of or relating to this Policy, or the Processing of Personal Data under it, shall be subject to the exclusive jurisdiction of the courts at Kolkata. By using the Website and submitting Personal Data through it, you consent to this choice of forum and waive any objection to proceedings instituted in that forum on grounds of jurisdiction, venue, or inconvenient forum.