Privacy Policy & DPDP Act Notice

This Privacy Policy sets out how D&B Digitals (operating as a digital agency based in Siliguri, West Bengal, India, co-founded by Debanjan Amin & Banashree Das) collects, processes, protects, and stores personal data provided by individuals ("Data Principals") when visiting our website (dnbdigitals.in) or submitting inquiries through our contact and consultation forms.

We are committed to respecting your privacy and comply strictly with India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000, and applicable data security regulations.

We only collect personal data that you voluntarily provide when submitting an inquiry:

• Identity Data: Full name and business or brand name.
• Contact Data: Email address and mobile phone number.
• Project Requirements: Project scope, service category, budget estimate, and project description.
• Technical Logs: Minimal anonymous connection parameters (browser type, timestamp) standard for web security and DDoS mitigation.

Note: We do NOT collect sensitive personal financial information such as bank account details or credit card numbers on our public forms.

Under Section 4 and Section 6 of the DPDP Act 2023, data is processed solely on the lawful basis of freely given, specific, informed, and unconditional consent provided by you when checking the consent agreement box prior to form submission.

The explicit purposes include:

• Reviewing and responding to your website design, development, or digital marketing inquiry.
• Delivering customized project proposals, estimates, and technical audit reports.
• Scheduling one-on-one discovery and strategy consultations requested by you.
• Maintaining records for ongoing client communication and contractual engagements.

In accordance with reasonable security standards under Section 8(5) of the DPDP Act, we employ robust technical and organizational measures to safeguard your personal data:

• Transit Encryption: All form transmissions occur over encrypted HTTPS/TLS 1.3 connections.
• Database Protection: Lead records are stored in secure Supabase PostgreSQL instances with Row-Level Security (RLS) and encrypted database backups.
• Access Control: Access to inbound lead inquiries is strictly restricted to verified founders with multi-factor authentication.
• No Third-Party Sale: We never sell, rent, monetize, or trade your personal information to third-party data brokers or marketing firms.

We retain personal data provided via contact submissions for a maximum period of 24 months from the date of submission, allowing sufficient continuity for follow-up inquiries, quote revisions, and project history.

Following the expiration of this retention window (or immediately upon receiving an erasure request), data is permanently removed or irreversibly anonymized.

As a Data Principal residing in India or interacting with our services, you hold unequivocal statutory rights:

To exercise any of your data protection rights, or if you have questions regarding this Privacy Policy, please contact our designated Grievance Officer:

Turnaround Commitment: We acknowledge all data inquiries and erasure requests within 24 hours and resolve them within 7 working days.