Data Protection and Security Policy

Why this matters to us

When you work with GrowNagar, you may share your customer phone numbers, enquiry details, invoices, student records or patient appointment lists. That information belongs to you and to the people it describes. We treat it with care, because a business that loses its customers' trust loses everything it built.

This policy is operated by GrowNagar ("we", "us"), based in Ahilyanagar, Maharashtra, India. It sits alongside our Privacy Policy, which explains what personal data we collect and why.

Note: This page describes our practices and intentions. It is not a certification or a guarantee. No system connected to the internet can be made completely secure, but we work to reduce risk at every step.

Scope

This policy covers data we handle through our websites, the software and integrations we build, the products we may offer, and the services we deliver, such as WhatsApp solutions, CRM setup, marketing and cloud work.

The Digital Personal Data Protection Act, 2023

We aim to follow the principles of India's Digital Personal Data Protection Act, 2023 (DPDP Act) and its rules as they come into force. In simple terms, this means:

We collect personal data only for a clear, lawful purpose.
We collect only what is needed for that purpose.
We keep data accurate and up to date where we can.
We keep it only as long as it is needed, or as the law requires.
We take reasonable security steps to prevent data breaches.
We respect the rights of people whose data we hold, such as the right to access, correct or erase their data and to raise a grievance.

When we build or run a system for your business, you usually decide why and how your customers' data is used (under the DPDP Act, you are the "Data Fiduciary"). We process that data on your behalf and on your instructions (as a "Data Processor"). Our project agreement or proposal sets out these roles in more detail.

How we protect data

Secure connections

Our websites and the web applications we build use HTTPS, so data moving between a browser and the server is encrypted in transit.
We prefer encrypted connections (such as TLS) when systems talk to each other, for example when your CRM connects to the WhatsApp Business Platform or a payment partner.
Where the hosting or database service supports it, we turn on encryption at rest.

Access on a need-to-know basis

We follow the principle of least privilege: each person or system gets only the access it needs to do its job, and nothing more.
Access to client systems is given to the team members working on that project and removed when the work ends or a person leaves.
We encourage strong, unique passwords and two-factor authentication on the accounts we use and the systems we set up for you.
Where possible, you keep owner-level access to your own accounts (such as your Meta Business account, domain or cloud account), and we work with delegated access.

Keeping secrets out of sight

API keys, passwords, access tokens and other secrets are never placed in frontend code (the part of a website or app that runs in a visitor's browser).
Secrets are kept in server-side environment settings or a secrets manager, not in shared documents or chat messages.
If we suspect a key has been exposed, we rotate (replace) it.

Backups and recovery

For systems we host or manage, we set up regular backups based on the service plan agreed with you.
We aim to test that backups can actually be restored, so a backup is not just a file sitting somewhere.
Backup frequency and how long backups are kept are set out in your agreement: daily backups kept for 30 days.

Secure development

We review code before it goes live and keep software libraries updated to fix known security issues.
We validate user input to reduce common risks such as injection attacks.
We use separate environments for testing and live systems where the project allows, and avoid using real customer data for testing.

Our people

Team members and contractors who may see client data are bound by confidentiality obligations.
We guide our team on safe data handling: no copying client data to personal devices, no sharing over personal chat apps, and reporting anything unusual straight away.
Access is reviewed and removed promptly when someone changes role or leaves.

Vendors and third-party services

We use trusted third-party services to deliver our work, such as cloud hosting providers, the official WhatsApp Business Platform by Meta, email services, analytics tools and authorised payment partners. Before using a vendor, we look at its security and privacy practices and choose established providers with clear terms.

Each of these providers runs under its own terms and privacy policy. We do not control their systems, and we are not responsible for their independent actions, but we choose them carefully and limit the data we share with them to what is needed.

Data location and transfers

Some cloud and platform providers store or process data on servers outside India. Where this happens, we rely on providers with recognised safeguards and follow any restrictions the Government of India notifies under the DPDP Act. If your business has a requirement to keep data in India, tell us at the start of the project and we will plan around it where the chosen services allow.

Retention and deletion

We keep client data only for as long as needed to deliver the service, meet legal and tax obligations, or resolve disputes. When a project or subscription ends, we will return or delete your data as agreed, unless the law requires us to keep it. Deletion from backups may take some extra time as old backups expire: 30 days.

If something goes wrong

If we become aware of a security incident that affects your data, we will:

Act quickly to contain it, for example by blocking access or rotating keys.
Look into what happened and which data may be affected.
Inform affected clients without undue delay, with the facts we know and the steps we are taking: 72 hours.
Support you in meeting your own obligations, including any notice to the Data Protection Board of India and to affected people, as required by the DPDP Act and its rules.
Learn from it and improve our safeguards.

Your part in keeping data safe

Security works best as a team effort. We ask our clients to:

Keep login details private and turn on two-factor authentication.
Give system access only to staff who need it, and remove it when they leave.
Collect customer data with proper consent, especially for WhatsApp and marketing messages (see our WhatsApp Messaging Policy).
Tell us straight away if you notice anything unusual.

Reporting a security concern

If you think you have found a security weakness in our website or systems, or suspect your data has been misused, please write to hello@grownagar.in. Please share enough detail for us to understand and check the issue, and give us reasonable time to fix it before sharing it publicly. For technical problems with a system we manage for you, write to support@grownagar.in.

For complaints about how your personal data is handled, see our Grievance Redressal page.

Changes to this policy

We may update this policy as our services, technology or the law change. The date at the top shows when it was last updated. Important changes will be highlighted on this page.