Privacy Policy

It is written to align with India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, the Information Technology Act, 2000 and its SPDI Rules, 2011, and — for visitors in the European Economic Area and the United Kingdom — the General Data Protection Regulation (GDPR). For the purposes of these laws, we act as the data fiduciary / data controller for the information you provide through this website.

1. Information we collect

We only collect what we need, and most of it is information you choose to give us.

• Information you provide — when you submit our “Get in touch” form or contact us by email, phone or WhatsApp: your name, mobile number, email address, enquiry type and the message you send us.
• Technical information — basic, non-identifying data your browser sends automatically (such as device and browser type, and your IP address), used only to operate the site, keep it secure, and prevent abuse.
• Your preferences — this site does not store anything on your device. We do not use advertising cookies or third-party tracking.

We do not knowingly collect special-category / sensitive personal data (such as Aadhaar, health or biometric data, or card, UPI or bank credentials) through this website, and ask that you do not send it to us via the enquiry form. When you pay us for a service, we receive only the limited payment details described in section 4 (Payments); your card, UPI and bank credentials are handled by the payment gateway, never by us.

Cookies: we do not use advertising, analytics or third-party tracking cookies, and this site stores nothing on your device — so no cookie-consent banner is required.

2. Why we use your information, and our legal basis

We use the information above to:

• respond to your enquiry and discuss the services you ask about;
• provide, and where engaged deliver, the services you request;
• keep records of our communications and business relationship; and
• maintain the security, integrity and proper functioning of the website.

Where the GDPR applies, our legal bases are: your consent (which you may withdraw at any time), our taking steps at your request before entering into a contract, and our legitimate interests in responding to enquiries and securing our systems. Where the DPDP Act applies, we process your data on the basis of the consent you give when you submit an enquiry, or for the legitimate uses permitted by that Act.

3. Who we share it with

We do not sell, rent or trade your personal data. We share it only with:

• Trusted service providers (data processors) who help us operate — for example our secure cloud database and hosting providers and our communication tools — and only to the extent needed to serve you, under appropriate confidentiality and data-protection terms;
• Payment gateways (data processors) — Cashfree Payments India Pvt. Ltd. and Razorpay Payments Pvt. Ltd. — which process the payments you make to us (see section 4);
• Authorities, where we are required to do so by law or to protect our legal rights; and
• a successor entity, in the event of a merger, acquisition or reorganisation, subject to this Policy.

4. Payments

Clients pay only David Carealle Digital Services Pvt. Ltd. — never an individual or a third party — either by a payment link or by bank transfer to the company’s bank account.

• Payment gateways: our payment links are provided by Cashfree Payments India Pvt. Ltd., and for some services by Razorpay Payments Pvt. Ltd. They act as our payment processors and handle payment data under their own terms and privacy policies.
• What we receive: the transaction ID, the amount, the payment status, and the payer name and contact details (such as email and mobile number) that you give when paying. For a bank transfer, we see what our bank reports for that transfer: its reference number, amount, date and the sender’s name and account details.
• What we never see or store: your card number, card expiry and CVV, UPI PIN, and net-banking login or other bank credentials. These are entered on the payment gateway’s secure page and handled by the gateway alone.
• Why we use it: to confirm your payment, issue your invoice or receipt, and keep the accounting and tax records the law requires.

5. International transfers

We are based in India and our infrastructure is hosted in India. If you contact us from outside India, your information will be transferred to and processed in India and, where our processors operate, in other countries. Where such transfers are subject to the GDPR, we rely on appropriate safeguards (such as standard contractual clauses) to protect your data.

6. How long we keep it

We keep your enquiry data only for as long as needed to respond to you and to maintain our business records, after which it is deleted or anonymised. You may ask us to delete it sooner (see your rights below).

7. How we protect it, and data breaches

As a cybersecurity company, data protection is core to how we work. We apply encryption in transit and at rest, strict access controls, and audit trails, in line with the reasonable security practices expected under the IT Act, 2000 and the SPDI Rules, 2011 and recognised information-security standards, and limit access to your data to authorised personnel only.

In the unlikely event of a personal-data breach, we will notify affected individuals and the Data Protection Board of India without undue delay, in clear language explaining what happened, the likely impact, and the steps we are taking.

8. Your rights

Subject to the applicable law, you have the right to:

• access the personal data we hold about you and obtain a summary of how it is processed;
• correct or complete inaccurate or incomplete data;
• erase your data, and withdraw consent at any time;
• restrict or object to certain processing, and request data portability (GDPR); and
• nominate another person to exercise your rights in the event of death or incapacity (DPDP Act).

To exercise any of these rights, email info@careall.org. We will respond within the timeframes required by law. If you are in the EEA/UK you also have the right to complain to your local data-protection supervisory authority; in India, to the Data Protection Board.

9. Children

This website and our services are intended for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Third-party links

Our site may link to other websites (for example WhatsApp, or our other projects). We are not responsible for their privacy practices; please review their policies.

11. Grievance Officer & contact

If you have any question, request or complaint about your personal data, you may contact our Grievance Officer:

• Email: info@careall.org
• Phone / WhatsApp: +91 98421 10180
• Entity: David Carealle Digital Services Pvt. Ltd.
• Office (additional place of business): No. 51/72-74, First Floor, K.A.P. Complex, Trivandrum Road, Palayamkottai, Tirunelveli 627002, Tamil Nadu, India

We will acknowledge and resolve grievances within the period required by law (up to 90 days under the DPDP Rules, 2025). This Policy is published in English; if you would prefer it in another official Indian language, contact us and we will provide it.

12. Changes to this policy

We may update this Policy from time to time. Material changes will be reflected on this page.