Draft — review with a professional before publishing.
This document sets out the structure of a privacy notice under India's Digital Personal Data Protection Act, 2023 (DPDP Act). It has not been reviewed by a lawyer. Every highlighted blank below must be completed with real, verified details before this page is treated as a published policy. Nothing here should be relied on as legal advice.
-
Who we are
INFIWORKS TECHNOLOGIES PRIVATE LIMITED (CIN U62090ME2026PTC476551), with its registered office at At 438, Shidod, Shidode, Bid, Beed – 431122, Maharashtra, India, is the Data Fiduciary responsible for the personal data described in this notice.
In this notice, "we" and "us" mean InfiWorks Technologies Private Limited, and "you" means the Data Principal — the individual the personal data relates to.
-
What this website collects
This website is a set of static pages. It sets no cookies, runs no analytics, carries no advertising, and makes no third-party network requests. Fonts and images are served from this site's own domain, so visiting these pages does not disclose your visit to any other company for advertising or measurement purposes.
The site is hosted on a third-party hosting platform. As our hosting and content-delivery provider, it necessarily processes technical request data — such as your IP address, the page requested, and your browser's user-agent string — in order to deliver the page and to protect the site from attack and abuse. Retention and handling of that data by the hosting provider: it is processed by that provider under its own data-processing terms, only to deliver and protect the site; we do not use it for any other purpose or to identify you personally.
-
Personal data you give us directly
If you contact us by email or telephone using the details on this site, we receive whatever you choose to send — typically your name, your email address or phone number, and the content of your message.
We use that information only to read, respond to and keep a record of your enquiry. We do not use it for marketing unless you separately ask us to.
-
Personal data in our products
Our product CloudMess is used by mess and tiffin operators to run their own businesses, and it handles personal data about their members. That processing is governed by a separate product privacy notice and the agreement between us and the operator, not by this page.
Product privacy notice and the division of responsibility between us and the operator: the CloudMess privacy policy is available inside the CloudMess apps and at cloudmess.in/privacy. [ Legal review: confirm and state the DPDP Data Fiduciary / Data Processor roles for this member data between InfiWorks and the mess operator. ]
-
Why we process personal data
We process the personal data described above for these purposes only:
- to deliver this website to your browser and keep it available and secure;
- to respond to enquiries you send us;
- to meet obligations that apply to us under Indian law, including company, tax and accounting requirements.
Any further purpose we later rely on: none. We do not currently rely on any purpose beyond those listed above.
-
The basis on which we process it
Under the DPDP Act we may process personal data with your consent, or for certain legitimate uses the Act permits. Where we rely on consent, we ask for it in clear terms, we tell you what it covers, and you may withdraw it at any time — withdrawing consent does not affect processing already carried out while the consent was valid.
The specific basis we rely on for each purpose above: [ map each purpose in section 5 to consent or to the specific legitimate use relied on ].
-
Who we share it with
We do not sell personal data, and we do not share it for third-party advertising.
We share personal data only with service providers who process it on our instructions in order to run our business, and with government or regulatory bodies where the law requires it.
Our current processors and what each one receives: Our website hosting and content-delivery provider, which receives technical request data (such as your IP address, the page requested, and your browser's user-agent) in order to serve and protect the site. Our email provider, which receives your email address and the contents of any message you send us. We use no payment processor, because this website does not take payments.
Whether any personal data is transferred outside India, and to where: yes — our hosting and email providers operate internationally and may process the technical and email data described above on servers outside India, including in the United States. We rely on the contractual data-protection commitments these providers give us.
-
How long we keep it
We keep personal data only for as long as the purpose it was collected for still requires, or for as long as the law requires us to keep it. When neither applies any more, we delete it.
Our retention periods, by category of data: enquiries you send us (your name, email or phone number and your message) are kept for as long as we need them to deal with your enquiry, and for a reasonable period afterwards for our records, after which they are deleted. Website technical logs are held only briefly by our hosting provider, as described in section 2. We do not keep personal data for longer than the purpose requires, or longer than the law requires.
-
How we protect it
We take reasonable security safeguards to prevent personal data breaches, as the DPDP Act requires. No system can be guaranteed completely secure, and we do not claim otherwise.
The safeguards we actually have in place: this is a static website with no user accounts, no database and no scripts of its own, which limits the personal data it can hold or expose. It is served only over an encrypted (HTTPS) connection. Enquiries you send by email are kept in our email provider's system, protected by access controls and that provider's security measures, and access to that correspondence is limited to those who need it.
If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal in the manner and within the timelines the DPDP Act and its rules require.
-
Your rights
As a Data Principal under the DPDP Act you have the right to:
- Access — obtain a summary of the personal data we hold about you and how we process it, together with the identities of others it has been shared with;
- Correction and erasure — have inaccurate or misleading data corrected or completed, and have data erased where it is no longer needed for the purpose it was collected for;
- Withdraw consent — at any time, as easily as it was given;
- Grievance redressal — raise a complaint with us about how we handle your data, and receive a response;
- Nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
To exercise any of these, write to us at contact@infiworks.co.in. We will respond within 30 days. We may need to verify your identity before acting on a request.
-
Your duties
The DPDP Act also places duties on Data Principals — in particular, not to impersonate another person when providing personal data, not to suppress material information where the law requires disclosure, and not to file false or frivolous grievances.
-
Children
Where we knowingly process the personal data of a child under 18, or of a person with a disability who has a lawful guardian, the DPDP Act requires verifiable consent from the parent or lawful guardian. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
Whether our services are offered to, or knowingly used by, anyone under 18, and how verifiable parental consent is obtained if so: this website is a company-information site and is not directed at children. We do not knowingly collect personal data from anyone under 18 through it. Our product CloudMess is intended only for people aged 18 and above; that is dealt with in the CloudMess privacy policy.
-
Grievance redressal
If you have a complaint about how we handle personal data, contact our grievance contact point:
- Name and designation: Grievance Officer
- Email: contact@infiworks.co.in
- Postal address: At 438, Shidod, Shidode, Bid, Beed – 431122, Maharashtra, India
- Response time: we will acknowledge within 7 days and respond within 30 days
If we do not resolve your complaint to your satisfaction, you may bring it to the Data Protection Board of India in the manner provided under the DPDP Act.
-
Changes to this notice
If we change this notice we will update the date below, and where the change is significant we will take reasonable steps to bring it to your attention.
Draft prepared 20 September 2026. Effective date: [ set on publication ]. Version: [ e.g. 1.0 ].