Privacy Policy

At VrewKriya(“we,” “us,” or “our”), we are deeply committed to protecting the privacy and personal data of our clients, website visitors, and every individual who interacts with our brand. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard your information when you visit our website www.vrewkriya.com (the “Site”), engage our services, interact with our audit and support teams, or communicate with us via any channel.

This policy is designed to comply with the Digital Personal Data Protection Act, 2023 (India), the General Data Protection Regulation (GDPR) (EU), the CAN-SPAM Act (United States), and the privacy requirements of platforms including Amazon Web Services (AWS), Google, and Meta Platforms.

By accessing our Site, using our services, or providing us with your personal information, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree with the terms of this policy, please do not access the Site or use our services.

1. Information We Collect

We collect information in several ways, depending on how you interact with us. The types of data we collect include:

1.1 Information You Provide Voluntarily

• Contact Information: Full name, email address, phone number, business name, and mailing address when you fill out a contact form, request a consultation, or engage our services.
• Account Information: Username, password, and account preferences if you create an account on our platform.
• Billing and Payment Information: Billing address and payment method details. Payment card information is processed securely by our third-party payment processors and is never stored on our servers.
• Audit and Support Data: Information you provide during audit processes, support calls, consultation sessions, and email exchanges, including business data, brand assets, marketing metrics, and any documents you share with our team for the purpose of delivering our services.
• Communication Data: Records of correspondence when you contact us via email, phone, social media, or our website contact forms.
• Newsletter and Marketing Preferences: Your email address and communication preferences when you subscribe to our newsletters or opt in to receive marketing communications.

1.2 Information Collected Automatically

• Device and Browser Information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage Data: Pages viewed, time spent on pages, click patterns, referring URLs, exit pages, and navigation paths through our Site.
• Location Data: Approximate geographic location derived from your IP address.
• Cookie and Tracking Data: Information collected through cookies, web beacons, pixel tags, and similar tracking technologies (see Section 5 below).

1.3 Information from Third Parties

• Social Media Platforms:If you interact with us through Meta (Facebook/Instagram), LinkedIn, YouTube, or other social media platforms, we may receive information such as your profile name, email address, and engagement data in accordance with those platforms' privacy policies.
• Analytics Providers: We receive aggregated and anonymized data from Google Analytics and similar services.
• Business Partners: In some cases, we may receive referral information from business partners or collaborators, always with appropriate consent.

2. Legal Basis for Processing Your Data

We process your personal data only when we have a lawful basis to do so. The legal bases we rely on include:

• Consent: You have given clear consent for us to process your personal data for a specific purpose, such as subscribing to our newsletter or opting in to marketing emails.
• Contractual Necessity: Processing is necessary for the performance of a contract with you, including providing our branding, marketing, audit, and creative services.
• Legitimate Interest: Processing is necessary for our legitimate business interests, such as improving our services, securing our platform, and communicating with clients, provided that such interests are not overridden by your rights.
• Legal Obligation: Processing is necessary to comply with applicable laws, regulations, court orders, or government requests.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To deliver, manage, and improve our services, including branding, marketing campaigns, creative production, audit support, and consultation services.
• To facilitate account creation, authentication, and management of your client portal.
• To process payments and manage billing through secure third-party payment processors.
• To provide dedicated audit support and manage client engagements, including scheduling and conducting support calls with our team.
• To send you service-related communications including project updates, audit reports, invoices, and account notifications.
• To send marketing and promotional communications, but only where you have explicitly opted in to receive them. Every marketing email includes a clear unsubscribe mechanism.
• To respond to your inquiries, feedback, and support requests in a timely and professional manner.
• To analyze website usage and performance using analytics tools to improve user experience, content relevance, and service quality.
• To protect our Site, services, and users from fraud, abuse, and unauthorized access.
• To comply with legal obligations and enforce our terms.

4. Email Communications and Consent

We take email consent extremely seriously. Our email practices adhere to the CAN-SPAM Act, GDPR, India DPDP Act 2023, and Amazon SES Acceptable Use Policy.

• We send emails only to users who have voluntarily submitted their information through our website, requested our services, or explicitly opted in to receive communications from us.
• We never purchase, rent, lease, or scrape email lists. All recipients have a direct, verifiable relationship with VrewKriya.
• Every marketing or promotional email we send contains a clear, functional unsubscribe mechanism. You can opt out of marketing communications at any time by clicking the “Unsubscribe” link in any email or by visiting our Unsubscribe page.
• Unsubscribe requests are processed promptly, typically within 24 hours, and no later than 10 business days.
• Transactional emails — including service confirmations, audit reports, invoices, account notifications, and password reset emails — may still be sent even after you unsubscribe from marketing communications, as these are necessary for the performance of our contract with you.
• By submitting your information through our website, you authorize VrewKriya to send service-related emails, audit reports, account notifications, and other communications necessary to provide the requested services.

5. Cookies and Tracking Technologies

Our Site uses cookies and similar tracking technologies to enhance your experience, analyze usage, and deliver relevant content. Cookies are small data files stored on your device when you visit a website.

Types of Cookies We Use

Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or receive a notification before a cookie is set. Please note that disabling certain cookies may affect the functionality of our Site. For more information on managing cookies, visit www.allaboutcookies.org.

6. Third-Party Services and Data Processors

We use trusted third-party services to operate our business, deliver our services, and improve your experience. These providers process data on our behalf under strict data processing agreements and confidentiality obligations. They include:

• Amazon Web Services (AWS): Cloud infrastructure, hosting, data storage, and computing services.
• Amazon Simple Email Service (SES): Transactional and consent-based email delivery.
• Google Analytics: Website traffic analysis and usage insights (data is anonymized and aggregated).
• Google reCAPTCHA: Bot detection and form security to protect against spam and abuse.
• Google Workspace: Business email, document management, and team collaboration.
• Meta Platforms (Facebook & Instagram): Social media management, advertising, and audience analytics through Meta Pixel and Conversions API.
• Payment Processors (Razorpay / Stripe): Secure payment processing. We do not store your credit card or bank details on our servers.
• Cloudflare: Content delivery, DDoS protection, and website performance optimization.
• Vercel: Website hosting and deployment infrastructure.
• Sanity: Content management system for blog and website content.

Each of these providers has their own privacy policy governing how they handle data. We encourage you to review their respective policies. We only share the minimum data necessary for them to perform their functions.

7. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: With trusted third-party vendors and contractors who perform services for us or on our behalf, under strict confidentiality and data processing agreements.
• Legal Requirements: When required by law, regulation, court order, subpoena, or government request.
• Protection of Rights: To protect the rights, property, or safety of VrewKriya, our clients, or others.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, in which case your data would remain subject to this Privacy Policy.
• With Your Consent: When you have explicitly consented to the sharing of your information for a specified purpose.

8. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Client and Project Data: Retained for the duration of the client relationship and for up to 5 years after the conclusion of services for legal and accounting purposes.
• Audit Reports and Support Records: Retained for up to 3 years after the last engagement to support ongoing quality assurance and dispute resolution.
• Email Marketing Data: Retained until you unsubscribe. Upon unsubscription, your email is moved to a suppression list to ensure we do not contact you again.
• Website Analytics Data: Retained in anonymized and aggregated form, typically for up to 26 months (Google Analytics default retention).
• Billing and Payment Records: Retained for a minimum of 8 years in compliance with Indian tax and financial regulations.

When data is no longer needed for any legitimate purpose, it is securely deleted or anonymized.

9. Data Security

We implement robust technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: All data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS).
• Access Controls: Strict role-based access controls ensuring only authorized team members can access personal data, on a need-to-know basis.
• Infrastructure Security: Our hosting infrastructure on AWS and Vercel provides enterprise-grade security, including firewalls, intrusion detection, and automated threat monitoring.
• Payment Security: Payment processing is handled by PCI DSS-compliant payment processors. We never store your full payment card details.
• Regular Reviews: We conduct periodic security reviews and updates to our practices and systems.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee its absolute security but are committed to continuously improving our safeguards.

10. Your Privacy Rights

Depending on your location and applicable law (including the India DPDP Act 2023 and GDPR), you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request that we correct any inaccurate or incomplete personal data.
• Right to Deletion / Erasure: Request that we delete your personal data, subject to legal retention requirements.
• Right to Withdraw Consent: Withdraw your consent at any time where we are relying on consent to process your data. This will not affect the lawfulness of processing carried out before the withdrawal.
• Right to Data Portability: Request a copy of your data in a structured, commonly used, and machine-readable format.
• Right to Restrict Processing: Request that we restrict the processing of your personal data under certain circumstances.
• Right to Object: Object to the processing of your personal data for direct marketing purposes.
• Right to Lodge a Complaint: File a complaint with the relevant data protection authority (Data Protection Board of India under the DPDP Act, or the relevant EU supervisory authority under GDPR).

To exercise any of these rights, please contact us at support@vrewkriya.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

11. International Data Transfers

VrewKriya is based in India, and our primary data processing occurs within India. However, some of our third-party service providers (including AWS, Google, Meta, Cloudflare, and Vercel) may process and store data in servers located outside of India, including in the United States and the European Union. When your data is transferred internationally, we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs), adequacy decisions, or other legally recognized transfer mechanisms, to protect your data in accordance with applicable law.

12. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect, solicit, or maintain personal data from anyone under the age of 18. If we become aware that we have collected personal data from a child under 18 without parental consent, we will take immediate steps to delete such information from our systems. If you believe that we have inadvertently collected data from a minor, please contact us immediately at support@vrewkriya.com.

13. Do Not Track Signals

Some browsers offer a “Do Not Track” (DNT) setting. There is currently no universally accepted standard for how companies should respond to DNT signals. At this time, we do not respond to DNT signals. However, you can control cookies and tracking technologies through your browser settings as described in Section 5 above.

14. Links to Third-Party Websites

Our Site may contain links to third-party websites, platforms, or services that are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services. We strongly encourage you to review the privacy policy of every site you visit.

15. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the “Last Updated” date at the top of this page and, where appropriate, notify you via email or a prominent notice on our Site. We encourage you to periodically review this page for the latest information on our privacy practices. Your continued use of our Site and services after any changes constitutes acceptance of the updated policy.

16. Grievance Officer (India DPDP Act)

In accordance with the Digital Personal Data Protection Act, 2023 (India), we have appointed a Grievance Officer to address your concerns regarding data processing. If you have any complaints or grievances regarding our handling of your personal data, you may contact our Grievance Officer at the contact details provided below. We will acknowledge your complaint within 48 hours and endeavor to resolve it within 30 days of receipt.

17. Contact Us

If you have questions, comments, or concerns about this Privacy Policy, your personal data, or if you wish to exercise your privacy rights, please contact us: