Privacy Policy

Last updated: 9 September 2026

This Privacy Policy explains how JPKP Technologies Private Limited (“JPKP Technologies”, “we”, “us”, “our”) collects and uses personal data when you use jpkp.in, submit a form on this website, create an account, or communicate with us about a project or support request. It is written with reference to India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025.

For the personal data described here, JPKP Technologies is the Data Fiduciary (the entity that decides why and how your personal data is processed). If you are an individual whose personal data we process, the DPDP Act refers to you as a Data Principal.

1. Who we are

JPKP Technologies Private Limited
Registered / operational office: C/O Jagpal Kasyap, Hathwala Road, Sita Ram Colony, Old Thana, Samalkha, Panipat, Haryana 132101, India
GSTIN: 06AAECJ4833H1ZM
Email: support@jpkp.in
Phone: +91 7988722672
Website: https://jpkp.in

We have not been notified by the Central Government that we are a Significant Data Fiduciary, and this policy does not treat us as one.

2. Scope

This policy covers personal data processed through:

the jpkp.in website, including the contact / enquiry form, the “book a consultation” form, the project-feedback form and the data-request form;
client and staff accounts on our admin panel (sign-up, login, one-time password and optional two-factor authentication);
email, phone and WhatsApp communication with us about an enquiry, quotation, project or support matter;
invoices, quotations and payment records created in the course of providing our services;
server and security logs generated automatically when you use the site.

It does not cover third-party websites we link to, or the internal data practices of our clients on projects we build for them (on those projects our client is usually the Data Fiduciary and we act on their instructions).

3. The personal data we process

We only ask for what is reasonably necessary for the purpose you are contacting us about.

Category	Examples	Source
Contact details	Name, email address, phone number	You (forms, email, WhatsApp)
Business details	Company / business name, existing website, city, the requirement you describe	You
Appointment details	Preferred date and time, service of interest	You (consultation form)
Account details	Username, phone number (account identifier), email, password (stored only as a secure hash), address / city / state / country, optional two-factor authentication secret	You (sign-up)
Project & communication data	Messages you send us by form, email or WhatsApp; project briefs and feedback; notes our team records about your enquiry or project	You / our team
Transaction data	Amount, payment reference / order ID, payment method name (e.g. “UPI”), invoice and quotation records	You / our payment provider
Technical & security data	IP address, browser and device information (user-agent), pages requested, dates and times, and — if you enable browser notifications — a push subscription endpoint	Collected automatically

Payment card / UPI credentials. We do not collect or store your card number, CVV, UPI PIN or bank credentials. Online payments are processed on a page hosted by our payment provider (Razorpay), and those details are handled by the provider under its own terms and privacy policy. We receive only a payment status, an amount and a transaction reference.

We do not deliberately collect special categories of data such as caste, religion, health or biometric information, and we ask that you do not send such information to us.

4. Why we process your personal data

Responding to enquiries and preparing quotations and proposals.
Scheduling and confirming consultation appointments.
Providing our services — delivering website, application, software, SEO and digital-marketing work, and communicating with you about your project.
Managing your account — sign-up, login, one-time password verification, optional two-factor authentication and account support.
Billing and payment reconciliation — issuing invoices and quotations and recording payments.
Support — answering questions and resolving issues by email, phone or WhatsApp.
Project feedback — where you choose to submit a rating and comment about a completed project.
Website security and abuse prevention — rate-limiting, spam filtering, bot detection (Google reCAPTCHA, where enabled) and keeping an internal audit log of administrative actions.
Meeting legal, tax and accounting obligations and establishing, exercising or defending legal claims.
Handling privacy requests that you submit to us.
Service updates and, where appropriate, marketing — we may send you information about our services. Where the law requires consent for a particular message, we will ask for it, and every marketing message will include an easy way to opt out.

We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects on you.

Where we rely on your consent to process personal data:

your consent is voluntary, specific to the purpose we tell you about, informed and given by a clear affirmative action (for example, ticking an unchecked box before you submit a form);
we ask only for the data reasonably needed for that purpose;
you can withdraw your consent at any time, and doing so is as easy as giving it — email support@jpkp.in or use the data request form. Withdrawing consent does not affect processing already carried out, and we may still need to keep some records for legal reasons.

Agreeing to our Terms & Conditions is kept separate from privacy consent — one is not bundled into the other.

6. Other lawful bases / legitimate uses

Not every activity relies on consent. Under the DPDP Act we may also process personal data for certain legitimate uses, including where you have voluntarily provided your data for a specified purpose and have not objected, to comply with a legal obligation, and to respond to an enquiry you have made. We also process personal data as necessary to perform our contract with you and to protect the security of our systems. We do not claim a lawful basis that does not apply.

We share personal data only with the categories of recipients below, and only as needed. Service providers (Data Processors) act on our instructions under a contract.

Recipient	Purpose
Hosting & email provider (Hostinger)	Website hosting, databases, backups and outgoing email (SMTP)
Payment provider (Razorpay)	Processing online payments; we receive only status, amount and reference
WhatsApp / Meta (WhatsApp Business Platform)	Sending and receiving WhatsApp messages where you contact us or opt into project updates on WhatsApp
Google reCAPTCHA	Bot / spam detection on form pages, where enabled
OpenAI	Only where our WhatsApp assistant is switched on: the text of an inbound WhatsApp message may be sent to OpenAI's API to generate a draft reply. It is not used to train models under our API terms.
Browser push services (e.g. Google, Mozilla, Apple)	Delivering a browser notification, only if you enable notifications
Professional advisers	Accountants and lawyers, where reasonably required
Government / law-enforcement authorities	Where we are legally required to disclose, or to protect rights, property or safety

If our business is ever involved in a merger, acquisition or restructuring, personal data may be transferred as part of that transaction; we would take reasonable steps to ensure it stays protected and used consistently with this policy.

8. Processing outside India

Most processing takes place in India. Some of the providers above may process limited personal data on servers outside India — in particular Google reCAPTCHA and, where the WhatsApp assistant is enabled, OpenAI. Where personal data is processed outside India, we do so in accordance with applicable Indian law and any restrictions notified by the Central Government, and we do not transfer data to a country to which such transfer is restricted.

9. How long we keep your personal data

We keep personal data only for as long as needed for the purpose it was collected, and then delete or anonymise it. In practice:

Enquiry / consultation form data: for as long as needed to respond and to manage any resulting business relationship. Enquiries that do not lead to a project are reviewed periodically and cleared.
Client and project records, invoices and payment records: for the duration of the engagement and for the period required by applicable tax, accounting, contractual and limitation-of-claims requirements after it ends.
Account data: while the account is active; after closure it is deleted or anonymised, keeping only what we must retain for legal reasons.
Data-request records: for as long as needed to process the request and to keep a record that we handled it.
Security and audit logs, one-time-password and login-attempt records: short retention appropriate to security and abuse-prevention needs.
Server access / error logs: retained by our hosting provider for a limited period per its standard configuration.

Deletion may be delayed where retention is required by law, or where data is needed for an ongoing dispute, fraud prevention, security or the enforcement of an agreement.

10. Security

We maintain reasonable technical and organisational measures appropriate to the risk, including: HTTPS across the site; passwords stored only as salted hashes; one-time-password verification and optional two-factor authentication for accounts; CSRF protection and server-side validation on forms; rate-limiting and bot detection; a Content-Security-Policy on public pages; role-based access to the admin panel with an audit log; restricted database access; and regular backups by our hosting provider. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; we do not claim to be “100% secure” or to hold security certifications we have not obtained.

11. Personal data breaches

If a personal data breach occurs, we will take reasonable steps to contain and assess it, remediate the cause, and notify affected Data Principals and the Data Protection Board of India as and to the extent required by the DPDP Act and the rules made under it.

12. Your rights as a Data Principal

Subject to the DPDP Act and its exceptions, you may:

Access information — request a summary of the personal data we process about you and the processing activities, and the identities of other Data Fiduciaries and Processors with whom it has been shared, along with a description of the data shared.
Request correction of inaccurate or misleading personal data, and completion or updating of incomplete data.
Request erasure of personal data that is no longer necessary for the purpose it was collected, unless retention is required by law.
Withdraw consent where processing is based on consent.
Nominate another individual to exercise your rights in the event of your death or incapacity.
Raise a grievance with us about how your personal data has been handled (see below).

You also have a duty under the DPDP Act not to file a false or frivolous complaint and to provide authentic information when asserting these rights.

How to exercise your rights: use the data request form (you choose the request type, we email you a confirmation link, and our team actions it once you confirm), or email support@jpkp.in. We may need to verify your identity before acting, using information already associated with your enquiry or account — we will not ask you to upload Aadhaar, PAN, passport or payment-card images. See the Privacy Rights page for a plain-language summary.

13. Grievance redressal

If you have a concern about how we handle your personal data, contact us first so we can put it right:

Privacy grievance contact — JPKP Technologies Private Limited
Email: support@jpkp.in (please put “Privacy” in the subject line)
Phone: +91 7988722672
Post: C/O Jagpal Kasyap, Hathwala Road, Sita Ram Colony, Old Thana, Samalkha, Panipat, Haryana 132101, India

We will acknowledge your grievance, review it, and respond within the period required under the DPDP Rules. If you are not satisfied with our response, or we do not respond in time, you may make a complaint to the Data Protection Board of India.

14. Children's personal data

Our website and services are intended for businesses and adults, not for children. We do not knowingly collect the personal data of a child (a person under 18) or of a person with a lawful guardian without verifiable consent from the parent or lawful guardian, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided us personal data, contact support@jpkp.in and we will delete it unless the law requires us to keep it.

15. Cookies and local storage

The public website uses an essential session cookie and stores your light/dark theme choice in your browser. It does not run Google Analytics, Google Tag Manager, the Meta Pixel or advertising trackers. Full details, including the conditional use of Google reCAPTCHA on form pages, are in our Cookie Policy.

16. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the “Last updated” date. Where a change is significant we will take reasonable steps to bring it to your attention.

17. Contact

Questions about this policy or your personal data:
Email: support@jpkp.in · Phone: +91 7988722672
JPKP Technologies Private Limited, C/O Jagpal Kasyap, Hathwala Road, Sita Ram Colony, Old Thana, Samalkha, Panipat, Haryana 132101, India

More legal

Privacy Rights · Terms & Conditions · Cookie Policy · Data Request · Data Deletion · Cancellation & Refund · Shipping Policy