1. Zero-Surveillance Architectural Invariants
Astrake India operates a stateless, privacy-sovereign digital presentation architecture. When you visit this website, we deploy zero tracking cookies, zero marketing beacons, zero fingerprinting scripts, and zero third-party content delivery networks (CDNs). All typography (Manrope, Space Grotesk), vector assets, stylesheets, and JavaScript binaries are self-hosted directly on our primary server infrastructure in Kolkata, India. Your IP address and network headers are never transmitted to third-party ad networks, trackers, or commercial analytics platforms.
2. Data Fiduciary, Controller & Language Accessibility Notice
Under the Digital Personal Data Protection (DPDP) Act 2023 (India) and Regulation (EU) 2016/679 (General Data Protection Regulation), the Data Fiduciary and Controller is:
Astrake India (Proprietorship)
Designated Grievance Officer: Grievance Officer & Principal — Data Protection Compliance
Registered Office: Ground Floor, Shop 3, 13B Bireswar Dhole Lane, Kolkata-700035, West Bengal, India
Statutory Electronic Inquiries: office@astrake.com · /contact/?topic=privacy
Eighth Schedule Language Accessibility (DPDP Act 2023 Section 5(3)): In accordance with Section 5(3) of the DPDP Act 2023, Data Principals may request an official copy of this Privacy Notice, statutory notices, and consent terms in Hindi, Bengali, or any other language specified in the Eighth Schedule to the Constitution of India free of charge. To request a translated notice, contact our Grievance Redressal Office at office@astrake.com with subject [LANGUAGE REQUEST - DPDP].
3. Complete Itemized Data Inventory & Purpose Limitation
We process personal data only when you affirmatively and voluntarily submit an inquiry through our Secure Contact Form. In strict adherence to Section 5(1) of the DPDP Act 2023 and Article 13 of the EU GDPR, the precise categories of data collected and their purposes are:
- Identity & Contact Data: Full Name, Company / Organization name, Work Email Address, and optional Telephone Number (required only when requesting on-site facility assessments). Used exclusively to identify and communicate with you regarding your inquiry.
- Contextual Inquiry Data: Selected Channel/Topic, Subject, and Specification Brief, as well as context-specific fields: Solution Type and Facility Location for client deployments; Engineering Track and Portfolio/Profile URL for career applicants; Media Outlet and Deadlines for press inquiries; and Affected System / Severity for security disclosures.
- Anti-Abuse & Security Metadata: Keyed cryptographic hash of the client IP address (
ip_hashgenerated via HMAC-SHA256; raw IP addresses are never persisted in our database), truncated User-Agent string (maximum 250 characters), and stateless HMAC CSRF verification tokens. This metadata is processed solely to enforce submission rate limits (maximum 5 requests per 15 minutes), prevent automated form-flooding, and satisfy statutory cybersecurity log maintenance.
Zero Third-Party Processors: Submissions are stored locally on our first-party SQLite Write-Ahead Logging (WAL) database in Kolkata, India and dispatched solely via first-party SMTP or self-hosted webhook infrastructure. We do not transmit or sell visitor data to external SaaS CRM, advertising, or data-broker platforms.
4. Statutory Data Retention Schedule & Automated Purge
Inquiry transmissions are protected in transit via Transport Layer Security (TLS 1.3). In accordance with Section 8(7) of the DPDP Act 2023 and the Indian Computer Emergency Response Team (CERT-In) Directions of April 28, 2022 (under Section 70B of the Information Technology Act, 2000), Astrake India operates an automated, tiered data retention and purge lifecycle:
| Data Category | Retention Window | Statutory Authority | Automated Lifecycle Action |
|---|---|---|---|
| Prospective Inquiry Identifiers (Unaccepted contact messages, briefs, context fields) | 90 Calendar Days | DPDP Act 2023 Sec. 8(7) & GDPR Art. 5(1)(e) | All personal identifiers and message bodies are automatically and irreversibly redacted (scrubbed) in SQLite upon expiry of 90 days or immediately upon consent withdrawal. |
| Enterprise Client & Commercial Partner Records | 24 Months from last engagement | Contractual Necessity & DPDP Act 2023 Sec. 8(7) | Retained to service active engineering engagements, warranty commitments, and legal agreements. Purged after 24 months of commercial inactivity unless statutory accounting law mandates archival. |
Anonymized Security Audit Logs (Receipt ID, Channel Code, ip_hash, Delivery Status, Timestamp) |
180 Calendar Days | CERT-In Directions (April 28, 2022) / IT Act 2000 Sec. 70B | Retained securely for statutory ICT audit compliance, then automatically and permanently deleted from storage upon reaching 180 days. |
5. Data Principal Rights, Consent Withdrawal & Grievance Redressal
Data Principals hold enforceable statutory rights under Sections 6(4), 11, 12, 13, and 14 of the DPDP Act 2023 and Articles 15–22 of the EU GDPR:
- Right to Access (Sec. 11): Right to obtain a summary of personal data being processed and the processing activities undertaken.
- Right to Correction & Erasure (Sec. 12): Right to correct inaccurate personal data, complete incomplete records, or request erasure of inquiry records prior to the standard retention window.
- Right to Withdraw Consent (Sec. 6(4)): You may withdraw your consent at any time as easily as it was given. Upon receipt of consent withdrawal, we cease processing and redact your personal inquiry data.
- Right of Grievance Redressal (Sec. 13): Right to have any complaint addressed by our designated Grievance Officer.
- Right to Nominate (Sec. 14): Right to nominate another individual who shall exercise your rights in the event of death or incapacity.
Online Direct Request Portal: You may submit any DPDP rights request, correction, erasure, or consent withdrawal directly via our Data Protection & DPDP Rights Portal for expedited verification and routing.
Direct Electronic Mail Channels: You may alternatively email our Grievance Redressal Office with your reference number (REF-...):
- Submit Access Request:
[DPDP ACCESS REQUEST] Reference: REF-... - Submit Correction or Erasure:
[DPDP CORRECTION / ERASURE] Reference: REF-... - Withdraw Consent:
[DPDP CONSENT WITHDRAWAL] Reference: REF-... - Submit Nomination:
[DPDP NOMINATION] Reference: REF-... - Submit Formal Grievance:
[DPDP GRIEVANCE] Reference: REF-...
Grievance Redressal SLAs & Escalation: Our Grievance Redressal Office acknowledges complaints within 24 hours and provides resolution within 7 business days. If a grievance is not resolved within statutory time limits or you are unsatisfied with the resolution, you have the statutory right under Section 13(3) of the DPDP Act 2023 to file an electronic complaint before the Data Protection Board of India (DPBI).
6. Protection of Children’s Personal Data (DPDP Act 2023 Sec. 9)
Astrake India provides industrial, enterprise, and institutional technology infrastructure. This website and our services are directed exclusively to business professionals and individuals aged 18 years or older. In compliance with Section 9 of the DPDP Act 2023, Astrake India does not knowingly solicit, collect, or process personal data belonging to children (defined as individuals who have not completed 18 years of age). If we learn that personal data of a minor has been inadvertently submitted, we will immediately and permanently erase such data from our systems.