Privacy Policy
and Data Protection Notice.

1. Introduction

CodeCraft and Click Private Limited ("CodeCraft & Click", "we", "us" or "our") respects your privacy and is committed to handling personal information responsibly.

This Privacy Policy explains how we collect, receive, use, store, disclose and otherwise process personal information when you visit our website, contact us, enquire about our services, engage us for a project or communicate with us through other business channels.

Our services include website design and development, web applications, mobile applications, Progressive Web Apps (PWAs), software architecture, technology consulting, AI solutions, workflow automation, SEO, digital marketing, website optimisation, maintenance and technical support.

We are based in Bengaluru, Karnataka, India, and may provide services to individuals, businesses and organisations in India and other countries.

This Policy is intended to address applicable data protection requirements, including India’s Digital Personal Data Protection Act, 2023 (DPDP Act), the applicable provisions of the Digital Personal Data Protection Rules, 2025, and other relevant privacy laws where applicable.

2. Scope of this Policy

This Policy applies to personal information processed through our website, contact and enquiry forms, emails, proposals, contracts, project discussions, freelance development and consulting services, technical support and other business activities that refer to this Policy.

When we process personal information on behalf of a client, our responsibilities depend on the relevant service arrangement and applicable law. Where a client determines the purposes and means of processing and we act on its instructions, the client may be responsible for providing the relevant privacy notice and determining the lawful basis for processing.

3. Personal information we collect

Information you provide directly may include your name, email address, company or organisation, selected service, enquiry message, project requirements, budget indications, timelines and business objectives. For client engagements, we may also process business contact details, billing information, contractual records and information needed to manage the relationship.

Technical information may include your IP address, browser type and version, operating system, device information, requested pages, referring pages, timestamps, error reports and security logs. The information collected depends on our hosting provider, security configuration and any analytics tools enabled.

We may also receive relevant business contact information from public professional sources, referrals, prospective clients, business partners or service providers, where permitted by applicable law.

Please do not submit passwords, payment card details, confidential client records or sensitive personal information through the general contact form.

4. Purposes for processing personal information

We may use personal information to respond to enquiries; prepare estimates and proposals; understand project requirements; deliver development, consulting, AI, SEO and digital marketing services; manage client relationships; provide technical support; maintain website security; troubleshoot errors; improve website performance; maintain business, accounting and contractual records; comply with legal obligations; and send relevant business communications where permitted.

We will not use personal information for a materially different purpose without providing appropriate information and obtaining consent or identifying another lawful basis where required.

5. Legal grounds for processing

The legal basis for processing depends on the jurisdiction, type of information, purpose and applicable law. Where India’s DPDP Act applies, personal data will be processed in accordance with the provisions in force at the relevant time, including applicable requirements concerning consent, notices and permitted uses.

Where another law applies, processing may rely on an appropriate legal ground recognised by that law, such as consent, taking steps at your request before entering into a contract, performing a contract, complying with legal obligations, legitimate interests where recognised and applicable, or establishing, exercising or defending legal claims where permitted.

Where processing depends on consent, you may withdraw that consent using the available method, subject to applicable law. Withdrawal does not invalidate processing lawfully completed before withdrawal.

6. Contact form, spam prevention and email

When you submit our contact form, your information may be processed by our website server and email delivery provider so that we can receive and respond to your enquiry.

We may use Cloudflare Turnstile to distinguish legitimate submissions from automated spam and abusive requests. When enabled, the widget and verification process may involve technical information being processed by Cloudflare. Our server validates the verification response before accepting the enquiry.

We may use an SMTP service or another email delivery provider to transmit business communications. Your enquiry information may be processed by that provider to deliver your message to our designated business inbox.

Cloudflare and email providers may have their own privacy policies and processing terms.

7. Cookies, analytics and similar technologies

Our website may use cookies, local storage or similar technologies for functionality, security, preferences and analytics.

Essential technologies may support website functionality and service delivery. Security technologies may help detect abuse. Analytics technologies, if enabled, may help us understand website visits and performance. Advertising technologies, if introduced, may support campaign measurement.

Where applicable law requires consent before non-essential cookies or similar technologies are used, we will implement an appropriate consent mechanism. You can also manage cookies through your browser settings, although blocking certain technologies may affect website functionality.

This section will be updated if additional analytics, advertising or tracking services are introduced.

8. Artificial intelligence and automated tools

Our services may include AI-assisted development, document processing, intelligent search, chatbots, workflow automation and other AI-related solutions. We may use AI tools to perform requested tasks, support project delivery or improve workflow efficiency.

We aim to use AI tools for defined purposes, limit information shared with external providers to what is reasonably necessary, avoid submitting unnecessary personal or confidential information, review provider privacy and security terms, and apply human review where appropriate.

We do not intentionally submit confidential client data or sensitive personal information to a third-party AI service unless the processing is appropriately authorised and protected.

AI providers may process information on their own infrastructure under their own terms. The provider, retention arrangements and international transfer arrangements depend on the tools selected for the particular service. Additional transparency, consent or automated decision-making requirements will be addressed where applicable.

9. Sharing and disclosure of information

We do not sell personal information as a business model. We may disclose information where reasonably necessary and permitted by law to hosting and infrastructure providers, email and communications providers, security providers, AI and software providers, analytics providers where enabled, professional advisers, clients and project partners where necessary to deliver services, and public authorities where disclosure is legally required or permitted.

We aim to use appropriate contractual, organisational and technical safeguards when engaging service providers that process personal information on our behalf.

Where we act as a service provider to a client, the relevant contract may impose additional restrictions on data use, disclosure, retention and deletion.

10. International data transfers

Although our business is based in Bengaluru, Karnataka, India, our hosting infrastructure, email systems, AI providers and other service providers may operate in other countries. Personal information may therefore be processed or stored outside India or outside the country in which you reside.

Where an international transfer occurs, we will take the steps required by applicable law. These may include assessing the recipient, implementing appropriate contractual or other safeguards, complying with restrictions on transfers to particular countries or territories, and providing required disclosures or obtaining consent where legally necessary.

For individuals protected by the GDPR or other regional privacy laws, additional transfer requirements may apply. The countries in which information is processed depend on the actual providers and their configurations. We will not represent that information remains exclusively in India unless that is factually established.

11. Data retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, contractual and operational requirements.

General enquiries may be retained for the period needed to respond and follow up. Client and project records may be retained during an engagement and for any additional period needed for support, contractual obligations or dispute resolution. Financial records may be retained for periods required by applicable accounting and tax laws. Security logs may be retained for an appropriate period for monitoring and troubleshooting.

Consent and compliance records may be retained where reasonably necessary to demonstrate compliance.

When information is no longer required, we will take reasonable steps to delete it, anonymise it or otherwise dispose of it securely, subject to applicable law. Information may remain in routine backups for a limited period before being overwritten or removed.

12. Information security

We use reasonable technical and organisational measures appropriate to the nature of the information and the risks associated with its processing. Depending on the service, these may include access controls, restricted permissions, HTTPS where configured, secure credential management, software maintenance, spam protection, security monitoring, backup procedures and appropriate safeguards for service providers.

No website, transmission method or storage system can be guaranteed to be completely secure. If a personal data breach occurs, we will assess it and take the notification, mitigation and other steps required by applicable law.

13. Your privacy rights and choices

Your rights depend on the laws applicable to your personal information and the stage at which the relevant legal provisions are in force.

Where the applicable provisions of India’s DPDP Act are in force and apply, individuals may have rights concerning access to information about personal data being processed, correction and updating, erasure where applicable, withdrawal of consent, grievance redressal and nomination of another individual where provided by law. These rights are subject to statutory conditions, exceptions and retention requirements.

Where the GDPR applies, individuals may have rights relating to access, rectification, erasure, restriction, objection, data portability and withdrawal of consent. Other jurisdictions may provide rights concerning access, correction, deletion, opting out of certain processing or targeted advertising, and complaints to a regulator.

To make a privacy request, contact us using the details in Section 16. Please describe your request and provide sufficient information to help us locate the relevant records. We may request reasonable identity verification before acting.

We will respond within the period required by applicable law. If we cannot comply with a request, we will explain the reason where required. Withdrawal of consent or objection may not affect processing permitted on another lawful basis.

14. Children’s privacy

Our website and professional services are generally intended for businesses, professionals and individuals seeking technology services. We do not knowingly collect children’s personal information through the general contact form for purposes requiring parental consent without obtaining the consent or authorisation required by applicable law.

Where the DPDP Act provisions concerning children apply, we will comply with applicable requirements, including relevant rules on verifiable parental consent and restrictions on certain processing.

If you believe a child has provided personal information to us inappropriately, please contact us so that we can review the matter and take appropriate steps.

15. Third-party websites and services

Our website may contain links to external websites, platforms or services. Those websites and services are governed by their own privacy policies and practices, and we do not control their processing of personal information. We encourage you to review the relevant privacy notices before providing information to third parties.

16. Privacy enquiries and grievance redressal

For privacy questions, requests to exercise applicable rights, complaints or concerns about this Policy, contact CodeCraft and Click using the details below.

Email: hello@codecraftandclick.com

Location: Bengaluru, Karnataka, India.

Website: https://codecraftandclick.com

Please use the subject line “Privacy Request” or “Privacy Complaint” so that your message can be identified and routed appropriately. We will review privacy complaints and respond in accordance with the process and timelines required by applicable law.

Where a specific grievance officer, privacy contact or other designated representative is legally required, the relevant details will be published here. Where individuals have a right to approach a competent privacy regulator or authority, this Policy does not restrict that right.

17. International applicability

This Policy is intended to cover visitors and clients in India and other countries. Not every country’s privacy law necessarily applies to every interaction with our website.

Applicability may depend on where an individual is located, the nature of the services, the location of the business, the type of processing and applicable territorial-scope rules.

Where laws such as the European Union General Data Protection Regulation (GDPR), the United Kingdom GDPR or other national or regional privacy legislation apply to our processing, we will comply with the requirements applicable to that activity.

This Policy does not claim that every international privacy law applies to every visitor or that this notice alone satisfies every jurisdiction’s legal requirements.

18. Changes to this Policy

We may revise this Privacy Policy to reflect changes in our services, technologies, service providers, business practices or legal requirements.

The updated version will be published on this page with a revised “Last updated” date. Where a change requires additional notice, consent or other action under applicable law, we will take the required steps.

We encourage visitors and clients to review this page periodically.

19. Governing law and jurisdiction

This Privacy Policy and our privacy-related practices are governed by the laws of India, subject to any mandatory privacy and data protection laws applicable to the relevant individual or processing activity.

Subject to applicable law, disputes concerning this Policy may be brought before the competent courts in Bengaluru, Karnataka, India.

Nothing in this section is intended to exclude, limit or override mandatory rights, regulatory powers or jurisdictional rules that apply under data protection legislation in India or another relevant jurisdiction.