Privacy Policy

This policy covers anyone who visits Exolavario, opens an account, gets in touch, sends us a project brief or purchases a service. It has been prepared with reference to the Digital Personal Data Protection Act, 2023 (DPDP Act) and the reasonable security practices rules made under the Information Technology Act, 2000.

Two DPDP Act terms appear throughout. As the person the data is about, you are the Data Principal. As the organisation that determines why and how your data is processed, and that is accountable for safeguarding it, we are the Data Fiduciary.

It does not extend to websites we link to, third-party platforms you log in to on your own, or systems you own that we work within while delivering a service. That final case is covered in section 6.

The Data Fiduciary is EXOLAVARIO TECH PRIVATE LIMITED, C-25, OLD PLOT NO-14, GALI NO-5, Guru Nanak Pura, Lakshmi Nagar, New Delhi, East Delhi, Delhi, 110092., which operates Exolavario.

The Grievance Officer set out in section 16 deals with formal requests and complaints. Every request is allocated to a named individual as soon as it is received.

We gather five categories of data and nothing more than a technology services business requires.

• Account data — your name, email address, mobile number, company name if you give one, and a one-way hash of your password. Your password is never held in readable form, so it cannot be read by us or by anyone who got hold of the database.
• Billing data — billing name, address, city, state, PIN code and your GSTIN if you provide it. These are needed to raise a compliant tax invoice.
• Order data — the services purchased, amounts, order numbers, payment status, gateway transaction references, invoices and refund records.
• Project brief content — the information you give us so the work can go ahead: product and repository URLs, objectives, the people involved, access notes and anything else you include. It is largely commercial in nature, though it may contain names and work email addresses.
• Site and device data — IP address, browser and device type, pages visited, referring source and approximate location, gathered through analytics and server logs.

We do not gather or retain card numbers, CVV codes, UPI PINs or net-banking credentials. Identifiers such as Aadhaar or PAN are requested only if a particular legal requirement makes them necessary, and in that case we would explain the reason when asking.

Every purpose listed here is specific. Data gathered for one purpose is never repurposed for something unrelated.

We build no advertising profiles, carry out no behavioural retargeting, and never sell, rent or trade personal data.

Our processing rests on two grounds recognised by the DPDP Act.

• Consent — freely given, specific, informed and unambiguous, which you provide when you send a form, open an account, submit a brief or sign up for updates. Every request tells you what the data will be used for before you hand it over.
• Legitimate uses — processing necessary to deliver the service you paid for, and processing the law obliges us to carry out, such as keeping tax records.

You can withdraw consent whenever you choose, with the same ease as giving it, by writing to the Grievance Officer. Withdrawing does not undo processing already lawfully completed, nor does it erase records we are legally bound to keep, but it ends any further processing that relies on consent. Should withdrawal stop us from finishing a service you have paid for, we will let you know before we act on it.

Consent to marketing is always requested separately. Saying no never affects an order, and each marketing email carries an unsubscribe link that we act on promptly.

There are two distinct roles we may play, and the difference is important.

• Your data, in our keeping. Account, billing, order and brief data sits in our systems, and we act as its Data Fiduciary. That processing is what the remainder of this policy describes.
• Data about your users, in your systems. When a service needs us to work within your repositories, databases or cloud accounts, you stay the Data Fiduciary and we act solely on your documented instructions. If that work involves personal data, we put a data processing agreement in place with you before it begins, covering purpose limitation, security, sub-processing, breach notification and deletion.

Our default request is for anonymised, masked or synthetic data. If access to live personal data is unavoidable, it should be named, restricted to what the work requires, limited in time and revoked at handover.

Personal data is shared only with processors that help us operate the business, only for the purpose stated, and only under contracts obliging them to protect it. We describe them by category, since an individual supplier can change while the category and its safeguards stay the same.

Outside these categories, data is shared with the people assigned to your service (restricted to the brief and the access the work requires); with our accountants and auditors for statutory filings; and with a government authority, court or law enforcement agency when a valid legal process demands it. In that final case we require the demand in writing, disclose only what the law requires, and notify you unless we are barred from doing so.

No processor is permitted to use your data for its own ends.

Certain processors, such as our email delivery, hosting and analytics providers, may run infrastructure outside India, which means some personal data may be processed overseas.

In those cases we transfer data only to countries that the Central Government has not restricted under section 16 of the DPDP Act, confine the transfer to what the purpose requires, and oblige the processor to protect the data to the standard set by this policy. If a restriction is notified, we will relocate the processing it affects.

Data is held only as long as its purpose requires or the law mandates, after which it is deleted or irreversibly anonymised.

When you ask for erasure, we delete all data not subject to one of the statutory retention periods above, and explain what had to be retained and the reason.

We follow reasonable security practices suited to the data we hold. These include:

• serving the site over HTTPS, so that data in transit is encrypted;
• storing passwords solely as salted one-way hashes, which no one, including us, can reverse;
• guarding account forms against cross-site request forgery;
• keeping payment credentials off our servers altogether, as the payment gateway processes them;
• restricting access to customer data to those whose role requires it;
• asking clients not to share passwords or keys via the brief form, email or chat, and collecting sensitive credentials over a secure channel instead;
• placing everyone who handles client data under confidentiality obligations.

No system can be perfectly secure. If you think you have found a security weakness on this site, please let us know using the contact details in section 16 and we will look into it promptly.

We use a limited number of cookies and similar browser storage, which fall into two groups.

• Strictly necessary — session and security cookies that keep you signed in, hold your selection together as you move between pages, and protect forms from cross-site request forgery. The site cannot function without them, so consent is not required for them.
• Analytics — used when analytics is switched on, to count page views and spot broken journeys. They are pseudonymous and, where the law requires consent, they run only once you have given it.

Services you choose before checkout are kept in your own browser storage, not on our servers, so clearing site data deletes them. You can block or clear cookies through your browser settings whenever you like.

The DPDP Act gives you the right to:

• Access — obtain a summary of the personal data we hold on you, how we use it, and the categories of processor it has been shared with;
• Correction and completion — have inaccurate data put right, incomplete data completed and out-of-date data updated;
• Erasure — have data deleted once its purpose no longer requires it, subject to the statutory retention periods in section 9;
• Withdraw consent — for any processing that relies on consent, as easily as you gave it;
• Nominate — name another person to exercise these rights for you in the event of your death or incapacity;
• Grievance redressal — a readily accessible way to raise a complaint with us, answered within a published timeline, before you go to the Data Protection Board.

The Act also sets out duties for Data Principals: give authentic information, do not impersonate anyone, and do not lodge false or frivolous complaints.

Exercising a right. Write to our Grievance Officer, Rahul and Sabhajit, at info@exolavarioo.com from your account email address, saying which right you want to exercise. Before acting we may ask a few questions to confirm your identity. We reply within 30 days; if a request will take longer, we will let you know within those 30 days, giving the reason and an expected date.

Exercising these rights costs you nothing.

We sell our services to businesses, and this site is not aimed at children. We do not knowingly collect personal data from anyone below the age of 18, and we do not track or profile children or direct advertising at them.

If you think a child has shared personal data with us, let us know and we will delete it promptly. Where an account has to be run on behalf of a child, or of a person with a disability who has a lawful guardian, verifiable consent from that parent or guardian must be obtained first, as the DPDP Act requires.

In the event of a personal data breach, we will investigate and contain it, and inform the Data Protection Board of India and every affected Data Principal in the form and within the timeframe set by the DPDP Act and its rules.

The notice we send you will set out, in plain language, what happened, the data involved, the likely consequences, the measures we have taken and the steps we suggest you take.

This policy is revised whenever our processing or the law changes. The date shown at the top always reflects the current version. Material changes are flagged on this page, and if a change calls for fresh consent we will request it. Previous versions can be provided on request.

For any question about privacy, any data request or any complaint:

• Grievance Officer — Rahul and Sabhajit: info@exolavarioo.com · 8130926360
• General support: info@exolavarioo.com
• By post: C-25, OLD PLOT NO-14, GALI NO-5, Guru Nanak Pura, Lakshmi Nagar, New Delhi, East Delhi, Delhi, 110092.

We acknowledge complaints within 48 hours and give a substantive reply within 15 days. The complete escalation path, including the external bodies open to you, is set out on the Grievance Redressal page.

If our response does not satisfy you, you may take your complaint to the Data Protection Board of India, once you have first raised it with our Grievance Officer. The laws of India govern this policy.