Yourinformation,
keptsimple.

This Privacy Notice is issued by B-Webs (“B-Webs”, “we”, “us”), a website designing and development studio based in Kunnamkulam, Thrissur, Kerala, India. We are the “Data Fiduciary” under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”).

This notice explains what personal data we collect, why, the legal basis for processing, your rights as a “Data Principal”, and how to contact our Grievance Officer. Notice version: 2026.10.29. Last updated: 29 October 2026.

We collect only the personal data necessary to respond to your enquiries, prepare quotes, deliver services to our clients, and meet legal obligations. This typically includes your name, contact details (email, phone, WhatsApp number), and any project details you choose to share.

When you message us through WhatsApp, email or phone, you share what you choose to share — Meta's privacy policy applies to the WhatsApp conversation itself.

Our hosting provider (Vercel) automatically records standard technical data — IP address, browser type, pages visited — for security and performance only. We do not run analytics trackers, advertising tags or marketing pixels on this site.

We process personal data for these purposes: (a) responding to your enquiry or preparing a quote — based on your consent; (b) fulfilling a contract with a client — based on the contract; (c) maintaining invoices and tax records — based on our legal obligation under the Income Tax Act, 1961; (d) protecting against fraud, security incidents and abuse — based on our legitimate interests.

Where processing is based on your consent, you may withdraw it any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal (DPDP Sec 7).

www.b-webs.com itself serves no first-party cookies. The Instagram embed on our blog page may load resources from Meta and may set cookies on your device; you can clear or block them in your browser settings at any time.

Where any non-essential cookie or tracker is introduced in future, it will only load after explicit, opt-in consent given through our consent banner. You can withdraw consent as easily as you gave it — see our Data Rights page.

WhatsApp — when you contact us there, Meta's privacy policy applies to that conversation.

Vercel — our hosting provider stores standard server logs; their privacy policy covers that storage.

Instagram — the blog page embeds Instagram content, which may load resources from Meta and set cookies on your device.

We retain personal data only for as long as necessary for the purpose it was collected (DPDP Rule 10). Enquiries: 2 years after last meaningful contact. Invoices: 7 years (Income Tax Act, 1961). Consent logs: 3 years after consent is withdrawn or purpose ceases. Grievance records: 3 years after resolution.

After the retention period ends, we delete or anonymise the personal data unless a longer period is required by law.

Under the DPDP Act you have the right to: (a) Access — request information about the personal data we hold and who it has been shared with (Sec 11); (b) Correction & erasure — correct inaccurate data or have data we no longer need erased, subject to legal retention obligations (Sec 12); (c) Grievance redressal — raise a grievance with our Grievance Officer and escalate to the Data Protection Board if unresolved (Sec 13); (d) Nomination — nominate another person to exercise your rights on your behalf (Sec 14); (e) Withdrawal of consent — withdraw consent given for processing at any time, as easily as it was given (Sec 7).

To exercise any of these rights, use our Data Rights page or write to the Grievance Officer. We will acknowledge and respond within the period prescribed under the DPDP Rules.

Our services are aimed at businesses and adults. We do not knowingly collect personal data from children (under 18). If we ever process personal data of a child, we will obtain verifiable consent from a parent or lawful guardian before processing, in line with DPDP Sec 9.

Parents or guardians who believe we may hold data about their child may raise an access or erasure request through the Data Rights page, selecting the “parent / guardian” option.

Under DPDP Rule 11 we have designated a Grievance Officer. If you have a concern about how your personal data is processed, contact:

B-Webs Grievance Officer — Grievance Officer (Data Protection). Email: grievance@b-webs.com. Phone: +91 94978 29338. Response window: within 30 days.

If the Grievance Officer does not respond within the SLA or you are unsatisfied with the resolution, you may escalate to the Data Protection Board of India under DPDP Sec 13(4) / Rule 13.

In the event of a personal data breach, we will notify the Data Protection Board of India and each affected Data Principal within 72 hours of becoming aware of the breach, in line with DPDP Sec 8(6). The notification will describe the nature of the breach, the personal data involved, the likely consequences, and the measures we are taking or propose to take.

We may transfer personal data outside India only to countries or organisations notified by the Central Government under DPDP Sec 16, and only subject to the conditions prescribed. At present, our hosting provider (Vercel) may store server logs in such notified jurisdictions; otherwise we do not transfer personal data outside India except as permitted under the DPDP Act.

If this policy changes in a meaningful way, we will update the version number and the “last updated” date at the top of this page. Continued use of the site after a change means you accept the updated policy.