Privacy Policy

1. Who We Are

NuForge Labs is an AI-first product studio and software development business based in India. For the purposes of applicable data protection law, we are the “data fiduciary” (under Indian law) and the “data controller” (under the EU/UK General Data Protection Regulation, where applicable) in respect of personal data collected through this Site.

Email: hello@nuforgelabs.com
Phone: +91-8954963903

2. Scope of This Policy

This Policy applies only to personal data collected through the Site. It does not apply to:

• data we process on behalf of our clients in the course of software development engagements, which is governed by the written agreements (such as master services agreements, statements of work, and data processing agreements) entered into with those clients; or
• third-party websites or services linked from the Site, which have their own privacy policies.

The Site is a business-to-business informational website. It is intended for use by organisations and professionals evaluating our services, not by consumers or patients.

3. Personal Data We Collect

a. Information you provide to us. When you submit the contact form on the Site, we collect the information you enter, which may include your name, email address, company or organisation, project type, budget range, timeline, and the description of your project. If you contact us directly by email or phone, we collect the information you choose to share in that correspondence.

Please do not include sensitive personal data, patient information, protected health information, or confidential business information in the contact form. The form is intended only for general enquiry details.

b. Information collected automatically. When you visit the Site, we process technical information needed to serve and secure it, such as IP address, browser information, and request timestamps. Optional usage analytics and campaign attribution are enabled only after you allow analytics (see Section 6).

c. Information from other sources. If you engage with us on professional platforms (for example, LinkedIn) or are introduced to us by a business contact, we may hold basic professional contact details from those sources.

d. Testimonials. With their permission, we publish testimonials from client representatives on the Site, which may include the author's name, professional role, and industry. If a testimonial concerns you and you would like it corrected or removed, please contact us using the details in Section 16.

e. Job applications. If you apply for a role with us using the contact details published on the Site, we collect the information you provide, such as your CV, contact details, work history, education, and any other information you choose to include.

4. How We Use Personal Data

We use the personal data described above to:

• respond to your enquiries and schedule and conduct consultations you have requested;
• evaluate potential engagements and communicate with you in relation to your enquiry;
• assess job applications and communicate with applicants about roles with us;
• operate, maintain, secure, and improve the Site;
• analyse Site usage in aggregate to understand how visitors interact with our content;
• comply with applicable laws, respond to lawful requests, and establish, exercise, or defend legal claims; and
• maintain business records.

We do not sell personal data, and we do not use your contact details to send marketing newsletters or promotional mailings. We will contact you only in connection with your enquiry unless you separately ask us to do otherwise. We do not use personal data collected through this Site for automated decision-making that produces legal or similarly significant effects.

5. Legal Bases for Processing

Where the DPDP Act (defined below) applies, we process personal data on the basis of your consent (for example, when you submit the contact form for the purpose stated at the time of collection) and for such other legitimate uses as are permitted by law.

Where the EU/UK GDPR applies, we rely on the following legal bases:

• Consent - when you submit an enquiry or accept non-essential cookies;
• Legitimate interests - to operate and secure the Site, respond to business enquiries, and conduct business-to-business communications, where those interests are not overridden by your rights; and
• Legal obligation - where processing is necessary to comply with law.

7. Who We Share Personal Data With

We share personal data only as described below:

• Service providers who process data on our behalf and under our instructions, such as cloud hosting and infrastructure providers, email and communication tools, scheduling tools, document storage and lead-management tools, and analytics providers;
• Professional advisers, such as lawyers, auditors, and accountants, where reasonably necessary;
• Authorities and other parties where required by law, including to comply with a legal obligation, court order, or lawful request, or to protect our rights, safety, or property; and
• Business transfers - if we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate confidentiality protections.

8. International Transfers

We are based in India. Enquiry data submitted through the Site may be processed in India and stored or processed by service providers, including Google Workspace, in countries where they or their subprocessors maintain facilities, subject to applicable account settings and contractual safeguards. Optional usage data may be processed by the analytics providers enabled on the Site outside your country.

If you are located in the European Economic Area, the United Kingdom, Canada, the United States, or elsewhere outside India, submitting the contact form involves transferring your personal data to India and may involve processing in other countries. India has not been the subject of an adequacy decision under the EU/UK GDPR. Where applicable law requires safeguards for international transfers, those requirements apply to our processing and vendor arrangements. Contact us for information about the destinations and safeguards relevant to your enquiry. Submitting a form does not itself constitute consent to optional analytics or a waiver of your data protection rights.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including responding to your enquiry, maintaining business records, complying with legal and tax obligations, and resolving disputes. Enquiry data that does not lead to an engagement is periodically reviewed and deleted when no longer needed. Job application materials are retained while we evaluate your application; if your application is unsuccessful, we may keep your details for a reasonable period in case a suitable future role arises, unless you ask us to delete them sooner. Once retention is no longer required, we delete or anonymise the data.

10. Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include access controls, encryption in transit, and internal security practices appropriate to the nature of the data we hold. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Rights

Your rights depend on the law that applies to you. To exercise any right described below, contact us using the details in Section 12 or Section 16. We may need to verify your identity before acting on a request.

a. India - Digital Personal Data Protection Act, 2023

If your personal data is governed by the Digital Personal Data Protection Act, 2023 and the rules framed under it, to the extent in force (the “DPDP Act”), you have the right to: access a summary of the personal data we process about you and our processing activities; seek correction, completion, and updating of your personal data; seek erasure of your personal data, subject to legal retention requirements; withdraw consent at any time (which will not affect processing carried out before withdrawal); nominate another individual to exercise your rights in the event of death or incapacity; and have your grievances addressed through the mechanism described in Section 12.

b. European Economic Area and United Kingdom - GDPR

If the EU or UK GDPR applies to our processing of your personal data, you have the right to: request access to your personal data; request rectification of inaccurate data; request erasure; request restriction of processing; object to processing based on legitimate interests; receive your data in a portable format; and withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with a supervisory authority in your place of residence, work, or where an alleged infringement occurred.

c. California residents

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Where the law applies, California residents may request to know, correct, or delete the personal information we hold about them, and will not be discriminated against for exercising those rights.

d. Canada

Where Canadian privacy law (including PIPEDA) applies, you may request access to and correction of your personal information and withdraw consent, subject to legal or contractual restrictions and reasonable notice.

12. Grievance Redressal (India)

In accordance with applicable Indian law, questions, concerns, or grievances regarding the processing of personal data may be addressed to our Grievance Officer:

Grievance Officer: Pranjal Bansal
Email: hello@nuforgelabs.com (Attn: Grievance Officer)
Phone: +91-8954963903

We will acknowledge and respond to grievances within the timelines prescribed by applicable law. If you are not satisfied with our response, you may have the right to approach the Data Protection Board of India or other applicable authority.

13. Children

The Site is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us personal data through the Site, please contact us and we will delete it.

14. Third-Party Links

The Site may contain links to third-party websites and services. We are not responsible for the privacy practices or content of those third parties, and this Policy does not apply to them. We encourage you to review the privacy policies of any third-party sites you visit.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the Site, or applicable law. The “Last updated” date at the top of this Policy indicates when it was most recently revised. Material changes will be communicated by posting the updated Policy on the Site. Where a change requires new consent, we will request it before carrying out that processing.

16. Contact Us

If you have questions about this Policy or our handling of personal data, contact us at:

NuForge Labs
Email: hello@nuforgelabs.com
Phone: +91-8954963903