RiTiVerse
Statutory Compliance Notice

Privacy Notice & Data Protection Policy

Effective Date: October 2024  |  Statutory Version: v1.0-2024  |  Governed by the Digital Personal Data Protection Act, 2023 (DPDP Act 2023, India)

1. Identity of the Data Fiduciary & Overview

This Privacy Notice is published by RiTiVerse Studio (operating the official digital domain ritiverse.in), hereinafter referred to as the "Data Fiduciary", in compliance with Section 5 of the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, Parliament of India).

At RiTiVerse, we engineer bespoke websites, CRM systems, ERP platforms, and custom software delivered with 100% client source code ownership and zero vendor lock-in. We hold the protection of your personal digital data to the highest standards of integrity, transparency, and legal accountability.

2. Categories of Personal Data We Process

In accordance with the principle of Data Minimization, we only collect digital personal data that is directly necessary to respond to your technical consultation requests, formulate engineering proposals, or fulfill production milestones:

  • Direct Identification Details: Full Name, Business/Personal Email Address, Contact Telephone Number, and Company/Organization Name.
  • Project Specifications: Consultation briefs, technology scope requirements, target milestones, and functional descriptions submitted via our consultation portal.
  • Technical Telemetry & Network Identifiers: Internet Protocol (IP) address, approximate geographic city/region, browser agent, and CSRF authentication tokens.
  • Analytics & Cookie Preferences: Non-essential analytics (Google Analytics gtag.js) and marketing attribution (Meta Pixel) are processed only upon your affirmative consent via our DPDP Cookie Preference Center.

3. Lawful Purposes for Data Processing

Under Section 4 and Section 6 of the DPDP Act 2023, your personal data is processed solely for specified, lawful purposes:

  • To evaluate software architecture specifications and dispatch accurate project estimates and timeline blueprints.
  • To establish direct developer communications regarding custom CRM, ERP, mobile app, or website engineering projects.
  • To ensure cryptographic defense against Cross-Site Request Forgery (CSRF), brute-force bots, and distributed denial-of-service attempts.
  • To comply with statutory legal, taxation (GST / Income Tax Act), and regulatory obligations in the Republic of India.

4. Consent Mechanism & Right of Withdrawal

Under Section 6 of the DPDP Act 2023, your consent is free, specific, informed, unconditional, and unambiguous with clear affirmative action. We never employ pre-ticked checkboxes or deceptive dark patterns.

Right to Withdraw Consent (Section 6(4)): You have the sovereign right to withdraw previously granted consent at any time as easily as it was given. Upon receipt of withdrawal, RiTiVerse will cease processing your personal data within 7 business days, unless retention is strictly required by statutory tax or corporate laws.

5. Sovereign Rights of the Data Principal

As a Data Principal under Chapter III of the DPDP Act 2023, you are entitled to the following statutory rights:

Right to Access Information (Section 11):

You may request a summary of your personal data processed by RiTiVerse and the identities of all third parties or cloud servers where it has been handled.

Right to Correction & Completion (Section 12):

You may request correction of inaccurate data, completion of incomplete records, or updating of changed coordinates.

Right to Erasure / "Right to be Forgotten" (Section 12(3)):

You may request permanent erasure of your personal data once the project consultation or contract period has concluded.

Right of Grievance Redressal (Section 13):

You have the right to accessible grievance redressal provided by our designated Grievance Redressal Officer with an SLA of 30 days.

Right to Nominate (Section 14):

You may designate an individual who shall exercise your data rights in the unfortunate event of death or incapacity.

To exercise any of these rights, visit our dedicated Data Principal Rights Portal.

6. Storage Limitation & Data Retention

Under Section 8(7) of the DPDP Act 2023, RiTiVerse retains personal consultation inquiries only for as long as necessary to fulfill the initial inquiry or contract execution (standard retention: 365 calendar days). Following this window, inactive records are systematically scrubbed or anonymized.

7. Technical & Operational Security Safeguards

Under Section 8(5), RiTiVerse enforces bank-grade technical safeguards to prevent unauthorized access, alteration, disclosure, or personal data breach:

  • Transport Layer Security: 256-bit TLS 1.3 encryption across all incoming and outgoing connections (HSTS enabled).
  • Database Defenses: PDO parameterized queries preventing SQL injection, strict IP rate limiting on APIs, and Bcrypt password hashing for administrative access.
  • PII Masking & Pseudonymization: IP addresses and sensitive identifiers in administrative audit logs are masked.

8. Children's Personal Data (Section 9 Compliance)

RiTiVerse is an enterprise B2B software engineering and custom website studio. We do not provide services directed to individuals under 18 years of age (minors), nor do we track children's behavior or process children's personal data.

9. Grievance Redressal Officer & Statutory Escalation

In accordance with Section 8 and Section 13 of the DPDP Act 2023, RiTiVerse has designated a Grievance Redressal Officer (GRO) to address any concerns regarding data handling:

Officer Name: Grievance Redressal Officer

Designation: Data Protection & Grievance Officer

Statutory Desk Email: privacy@ritiverse.in

Jurisdiction: Gujarat, India

Response SLA: Within 30 calendar days of verified submission.

Escalation to Data Protection Board of India (DPBI): If your grievance is not resolved to your satisfaction within 30 days of submission to our Grievance Redressal Officer, you have the statutory right under Section 13(3) of the DPDP Act 2023 to file a complaint before the Data Protection Board of India.

10. Policy Amendments

RiTiVerse may update this statutory policy periodically to reflect statutory notifications, rules issued under the DPDP Act 2023, or technological upgrades. Any changes will be published here with an updated version stamp.