DPDP Act 2023 Compliant • Edge-AI Biometric Privacy

Privacy & Data Protection Policy

Kirtika Infotech (OPC) Private Limited is strictly committed to safeguarding client confidentiality, intellectual property, proprietary business logic, and user personal data under the Digital Personal Data Protection (DPDP) Act, 2023 and the Information Technology Act, 2000.

Last Revised: October 2026 • Effective for All Commercial Licenses & Cloud Subscriptions

Document Contents

1. Scope & Application
2. Information We Collect
3. Source Code & Intellectual Property Confidentiality
4. Enterprise Infrastructure & Cryptographic Security
5. Data Retention & Erasure Rights
6. Cookies & Analytical Telemetry
7. Grievance Officer & Statutory Contact
Frequently Asked Questions

Need legal clarifications?
privacy@kirtikainfotech.com

1. Scope & Application

This Privacy Policy governs all interactions, data collection, API processing, and cloud services provided by Kirtika Infotech across our official web portal, turnkey SaaS platforms (eStore 7 Themes, BharatHR Cloud Suite), custom mobile applications, and enterprise client portals. By using our platforms or engaging our engineering services, you consent to the data collection and security practices described herein.

2. Information We Collect

We only collect information strictly required to engineer, deploy, license, and maintain your software systems: • Contact & Business Identifiers: Authorized representative name, official email address, corporate phone number/WhatsApp ID, company legal name, and GSTIN for invoicing. • Technical & System Parameters: Server IP addresses, domain names, SSL configurations, webhook endpoints, and API callback telemetry required for uptime monitoring. • Payment & Invoicing Records: Transaction reference IDs, milestone billing records, and tax receipts. We do not store raw credit card numbers or UPI PINs; all payments are processed through RBI-authorized payment aggregators.

3. Source Code & Intellectual Property Confidentiality

• Complete NDA Protection: All client source repositories, architectural flowcharts, database structures, business algorithms, and custom features are treated under strict Non-Disclosure Agreement (NDA) standards. • Isolated Engineering Environments: Client development branches and staging databases are fully segregated. No proprietary logic or client dataset is ever shared with third parties, advertisers, or competitors. • Zero Data Monetization: We never sell, rent, monetize, or broker client data under any circumstances.

4. Enterprise Infrastructure & Cryptographic Security

• End-to-End Encryption: All data in transit is protected via TLS 1.3 encryption with modern cipher suites. Passwords and sensitive tokens are cryptographically hashed using Argon2/Bcrypt algorithms. • Database Protection: Production databases enforce least-privilege role-based access control (RBAC), automated daily encrypted off-site backups, and firewall-level brute force mitigation. • Incident Response: In the unlikely event of a security anomaly, our 24/7 Security Operations Center initiates containment within 60 minutes and notifies affected stakeholders per statutory guidelines.

5. Data Retention & Erasure Rights

Clients retain full rights to request access, rectification, or complete permanent erasure of their stored development data and backups following final project handover and SLA conclusion. Statutory tax and billing invoices are archived as mandated by Indian taxation laws.

6. Cookies & Analytical Telemetry

Our public web portals utilize essential functional cookies to remember theme preferences (Light/Dark Mode) and authenticated session tokens. We do not employ intrusive cross-site tracking pixels.

7. Grievance Officer & Statutory Contact

In accordance with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, for inquiries or data rights requests, contact: • Legal Officer: Compliance Desk, Kirtika Infotech (OPC) Private Limited • Address: 59, First Floor, Industrial Area, Near Kirti Nagar Metro Station, Delhi - 110015, India • Email: privacy@kirtikainfotech.com / info@kirtikainfotech.com • Direct Helpline: +91 8874445088

On-Device Private Biometric Guarantee (SmartFace Pro & Campus ERP)

For our SmartFace Pro AI and campus attendance solutions, all facial embeddings are computed on the client device using edge AI models (Face-API.js). Raw face images are never uploaded to our central servers or third-party cloud aggregators. Biometric templates remain encrypted locally inside your self-hosted SQLite/MySQL database under your exclusive institutional custody.

Privacy Frequently Asked Questions

Grievance & Compliance Officer: Legal & Data Security Desk, Kirtika Infotech (GSTIN: 09CMAPK1181L2ZW), 1070, Shantinagar, Durga Mandir, Orai, Jalaun, Uttar Pradesh - 285001. Direct Email: privacy@kirtikainfotech.com | Corporate Helpline: +91 8874445088.