Privacy Policy

1. Who We Are

This Privacy Policy explains how AsmaWebs Private Limited(“AsmaWebs”, “we”, “us”, or “our”), a software development company based in New Delhi, India, collects, uses, shares, stores, and protects your personal data when you visit asmawebs.com (the “Website”), submit a form, create an account, or otherwise contact us.

For the personal data described in this policy, AsmaWebs is the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 and the rules made under it (the “DPDP Act”), and the “controller” under the EU and UK General Data Protection Regulation (“GDPR”) where that law applies. This policy is also published in accordance with the Information Technology Act, 2000 and the rules made under it.

This policy does not cover personal data we process on behalf of our clients inside the software we build or manage for them, such as our School ERP. See Section 9 for how that data is handled.

2. Personal Data We Collect

Information you give us

• Contact form: your name, email address, phone number, and message.
• Service request form: your name, email address, phone number, address, and message.
• School ERP demo request: the school’s name and city, the contact person’s name, email address, and mobile number, the approximate number of students, and any message you add.
• Stay In Touch form: your name, email address, and message.
• Account registration: your first and last name, email address, mobile number (optional), password, and a profile image if you add one.
• Blog activity: comments you post and posts you like while signed in. Comments are publicly visible along with your name.
• Emails, calls, and WhatsApp messages you send us directly.

Information collected automatically

• Security data (always): when you submit a form, we record your IP address and basic signals such as how long the form took to fill in. We use this only to block spam, bots, and abuse.
• Analytics data (only with your consent): the pages you visit, the page that referred you, time spent on each page, your browser, operating system and device type, your IP address, and an approximate location (country, state, and city) estimated from your IP address.

We do not ask for financial information (such as bank or card details), health data, biometric data, or government ID numbers through this Website. Please do not include such information in your messages.

3. Why We Use Your Data and Our Legal Basis

• To respond to your enquiry, demo request, or service request and to follow up about it. You give us this data voluntarily for this purpose, which the DPDP Act recognises as a legitimate use. Under the GDPR, our basis is taking steps at your request before entering into a contract, and our legitimate interest in responding to business enquiries.
• To create and run your account, including sending verification and password-reset emails and letting you comment on our blog. Basis: your consent, given when you sign up, and the performance of our agreement with you.
• To measure and improve the Website using analytics data. Basis: your consent, given through our cookie banner. You can withdraw it at any time.
• To keep the Website and our users safe, including preventing spam, fraud, and misuse. Basis: legitimate uses permitted by law, and our legitimate interest in security.
• To comply with the law, including responding to lawful requests from authorities. Basis: legal obligation.

We do not sell your personal data, use it for third-party advertising, or make decisions about you based solely on automated processing.

4. Cookies and Similar Technologies

Cookies are small files stored by your browser. We use only first-party cookies and browser storage. We do not use advertising or cross-site tracking cookies.

Essential (always active)

These are needed for the Website to work and do not require consent.

• token: Keeps you signed in to your account. Set only when you log in. (7 days)
• asmawebs_had_session: Browser storage flag that remembers whether you were signed in. (Until you log out)
• asmawebs_cookie_consent_v1: Browser storage entry that remembers your cookie choice. (Until you change it or clear your browser data)

Analytics (only if you click “Accept”)

• visitorId: A random identifier used to count unique visitors. (1 year)
• sessionId: Groups the pages you view during a single visit. (30 minutes of inactivity)

Google Maps

The map on our Contact page is provided by Google. It loads only if you accept cookies or click “Load map”. Once it loads, Google may collect your IP address and set its own cookies under Google’s Privacy Policy.

Changing your choice

You can change or withdraw your choice at any time using “Cookie Settings” in the Website footer. Once you withdraw consent, we stop collecting analytics data from your browser. You can also delete cookies through your browser settings.

5. Who We Share Your Data With

We share personal data only where necessary, and only with:

• Cloud hosting and infrastructure providers, such as Amazon Web Services (AWS), DigitalOcean, and Cloudflare, which host the Website, store our data and images, and protect the Website from attacks.
• Google, which delivers our emails and provides Google Maps.
• WhatsApp (Meta), only if you choose to contact us through WhatsApp. That conversation is also subject to WhatsApp’s own privacy policy.
• Professional advisers, such as lawyers and auditors, where needed, under a duty of confidentiality.
• Government, regulatory, or law enforcement authorities, when required by law or a valid legal order, or to protect the rights, safety, and property of AsmaWebs, our users, or others.
• A successor business, if AsmaWebs is involved in a merger, acquisition, or sale of assets. This policy will continue to apply to your data.

Our service providers process personal data only on our instructions and are bound by their own security and data protection commitments.

6. International Data Transfers

Our hosting and service providers may store or process data on servers located outside India. We transfer personal data abroad only as permitted by the DPDP Act, including any restrictions notified by the Government of India. Where the GDPR applies, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses offered by our providers.

7. How Long We Keep Your Data

• Enquiry and form data (contact, service request, School ERP demo, and Stay In Touch forms) is deleted automatically 24 months after you submit it.
• Analytics data is deleted automatically 24 months after it is collected.
• Account data is kept while your account is active. When you ask us to delete your account, we delete your profile, comments, and likes.

We may keep some data for longer only where the law requires it, or to resolve a dispute or enforce our rights, and only for as long as that need lasts.

8. How We Protect Your Data

• All data sent between your browser and the Website is encrypted using HTTPS.
• Passwords are stored only as a one-way cryptographic hash (bcrypt). No one at AsmaWebs, including our administrators, can see your password.
• Email verification and password-reset links use single-use tokens that expire and are stored only in hashed form.
• Login cookies are HttpOnly and Secure, so scripts on the page cannot read them.
• Access to personal data is limited to authorised team members who need it for their work, using role-based permissions.
• We use rate limiting and spam protection to block automated abuse.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

If a personal data breach occurs, we will inform affected users and the Data Protection Board of India, and any other authority, as required by law.

9. Data We Process for Our Clients (Including School ERP)

When we build, host, or manage software for schools and businesses, including our School ERP, the data stored in that software (such as student, parent, staff, or customer records) belongs to our client. We process it only on our client’s instructions and under our agreement with them. We do not use it for our own purposes.

For this data, our client is the Data Fiduciary (or controller) and is responsible for giving notice and obtaining any required consent. This includes verifiable parental or guardian consent for students under 18. AsmaWebs acts as a Data Processor.

If you are a student, parent, or staff member, please send requests about your data to your school or organisation. We will help them respond. Read the School ERP Privacy Notice for details.

10. Your Rights

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and how we process it, and the identities of those we have shared it with.
• Correct, complete, or update inaccurate or incomplete data.
• Erase your personal data or your account.
• Withdraw consent at any time, as easily as you gave it. This does not affect processing that happened before you withdrew.
• Raise a grievance with our Grievance Officer (see Section 11).
• Nominate another person to exercise your rights if you die or become incapacitated.

If you are in the European Union, the United Kingdom, or another region with similar laws, you may also have the right to object to or restrict certain processing, to receive your data in a portable format, and to complain to your local data protection authority.

To exercise any of these rights, email support@asmawebs.com. We may need to verify your identity before acting on your request, and we will respond within 30 days.

11. Grievance Officer

If you have any concern or complaint about how we handle your personal data, please contact our Grievance Officer:

• Name: Taufik Alam
• Designation: Grievance Officer
• Email: support@asmawebs.com
• Phone: +91 8340664726 (Mon to Sat, 10:00 AM to 7:00 PM IST)
• Address: AsmaWebs Private Limited, Okhla Phase-2, New Delhi, India - 110025

We will acknowledge your grievance promptly and resolve it within 30 days of receiving it.

If you are not satisfied with our response, you may complain to the Data Protection Board of India in the manner set out under the DPDP Act.

12. Links to Other Websites

The Website links to other websites and services, such as LinkedIn, Instagram, and WhatsApp. We are not responsible for their privacy practices. Please read their privacy policies before sharing information with them.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. If the changes are significant, we will also show a notice on the Website and, where required, ask for your consent again.

14. Governing Law

This Privacy Policy is governed by the laws of India. This does not take away any rights you have under the data protection laws of the country where you live.

15. Contact Us

For any questions about this Privacy Policy, email us at support@asmawebs.com, call +91 8340664726, or use our contact form.