Privacy Notice

Projects India is operated by Venturous Advisory Solutions Pvt Ltd ("Projects India", "we", "us"). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

This notice is given under Section 5 of the DPDP Act. It applies to our website, the subscriber platform, our tender and project services, our sales CRM, and the Projects India mobile app used by our sales team.

1. What personal data we collect, and why

We collect data for the specific purposes listed below and nothing else. Where consent is our basis, you give it by ticking an unticked box at the point of collection, and you can withdraw it at any time.

We do not knowingly collect data from children under 18, and the service is meant for business use. We do not collect financial account numbers or card details ourselves — those go directly to our payment gateway.

2. Cookies and tracking

Three categories, and only the first is on by default:

• Essential — your sign-in session, the "remember me" cookie, CSRF protection, and the cookie that stores your choice on this very banner. These cannot be switched off; the site does not work without them.
• Analytics — Google Analytics 4 and Google Tag Manager. These are not loaded at all until you allow them. If you have not accepted, your browser never contacts Google's tag servers on our pages.
• Marketing — advertising measurement. None are active today; the category exists so that if we ever add one, it starts switched off.

You can change your choice at any time — use the Cookie Preferences link (also in the footer of every page), which clears your saved choice and brings the banner back.

Separately, our pages load fonts and stylesheets from Google Fonts, cdnjs (Cloudflare) and jsDelivr. Those requests reveal your IP address to those providers. [LEGAL REVIEW — whether these should also sit behind the consent banner, or be self-hosted to remove the transfer entirely, is an open item.]

3. Call recording — please read this

Calls from our AI agent. We sometimes call people with an automated AI voice agent — for example to follow up an enquiry or a subscription renewal. These calls are placed only between 9 AM and 9 PM, and are not placed to numbers on our do-not-call list or refused by telecom operators under the TRAI National Customer Preference Register. Where switched on, the agent says at the start that it is an AI assistant and that the call may be recorded. If you tell the agent you do not want to be called again, your number is added to our do-not-call list automatically. You can also ask the Grievance Officer to erase the recording, transcript and notes of an AI call; your number is then kept only on the do-not-call list, so that we do not call you again. [LEGAL REVIEW — confirm the disclosure wording and whether it must be mandatory rather than a setting.]

4. Who we share your data with

We do not sell personal data. We share it with the processors below, each only for the purpose listed, and each bound to use it only on our instructions. Several are outside India, which means your data is transferred abroad. [LEGAL REVIEW — Section 16 permits transfer except to countries the Central Government restricts; the current list of restricted countries must be checked, and written data-processing terms must be confirmed to exist with each processor below.]

We may also disclose data to legal or regulatory authorities where the law requires it, and to a successor entity in a merger or sale of the business, with notice to you where required.

5. How long we keep it

[LEGAL REVIEW — the periods below are engineering proposals. Section 8(7) requires erasure once the purpose is served and no law requires retention. None of these periods is automatically enforced yet; see section 9.]

6. Your rights under the DPDP Act

As a Data Principal you have the right to:

• Access — a summary of the personal data we hold about you, what we do with it, and which processors we have shared it with (Section 11).
• Correction and completion — have inaccurate or incomplete data corrected or completed (Section 12).
• Erasure — have your data deleted, unless we are required by law to keep it (Section 12).
• Withdraw consent — as easily as you gave it. Withdrawal does not undo processing that already lawfully happened, and we may not be able to keep providing a service that depended on it (Section 6(6)).
• Grievance redressal — complain to our Grievance Officer, who must answer you. You must use this route before approaching the Board (Section 13).
• Nominate — name someone to exercise these rights on your behalf if you die or become incapacitated (Section 14).
• Complain to the Data Protection Board of India if our response does not satisfy you (Section 13(4)).

You also have duties under Section 15 — most practically, not to give us false particulars or impersonate someone else when making one of these requests.

Make a data-rights request →

We aim to respond within 30 days. We will verify that the request is genuinely yours before we act on it — particularly for erasure, because acting on an unverified request would mean deleting someone else's data for them.

7. Grievance Officer

[LEGAL REVIEW — a named individual must be appointed and published here. Section 13(3) requires the Officer's contact details to be published, and a role-only mailbox may not satisfy that.]

8. Data we hold about people who are not our customers

Our project and tender intelligence includes the names, designations and business contact details of people at project-owning organisations, compiled from public records, tender portals and our own research. Those people did not give us that data directly.

[LEGAL REVIEW — this is the single most significant open question in this notice. The DPDP Act has a narrow "publicly available data" carve-out in Section 3(c)(ii), and it turns on whether the individual themselves made the data public. Whether our sourcing falls inside it, and what notice we owe these individuals if it does not, needs counsel's view before this paragraph is finalised.]

If you are one of these individuals and want your details corrected or removed, use the data-rights form — you do not need an account with us.

9. Security

Section 8(5) requires us to take reasonable security safeguards. We use role-based access control, hashed passwords, two-factor authentication for staff accounts, session hardening, per-user data scoping, and monitoring for bulk-export abuse.

We are also candid that our security work is ongoing: a hardening programme covering transport security headers, site-wide CSRF enforcement, login rate limiting and encryption of sensitive stored fields is in progress and not complete. No system is perfectly secure, and we do not claim ours is.

If we suffer a personal data breach we will notify the Data Protection Board of India and every affected Data Principal, as Section 8(6) requires.

10. Changes to this notice

We will update this notice when what we do changes. The version number and date at the top change with it, and consent records store the version you were shown, so we can always tell which notice applied to you. Material changes will be brought to your attention in the product.

11. Contact

General queries: info@projectsinindia.ai. Privacy and data-rights queries go to the Grievance Officer in section 7. Postal address: Venturous Advisory Solutions Pvt Ltd, A/309, Centrum Business Square, Road No 16, Wagle Industrial Estate, Thane (W) – 400604, Maharashtra, India.