Effective date: Apr 1, 2021 · Last updated: Oct 6, 2026
1. Who we are
This Privacy Policy is issued by Sreekandakumar Pillai, sole proprietor of Ananthapuri Technologies (GSTIN: 32AHMPS5553M1ZR; Udyam Registration No.: UDYAM-KL-12-0012687), with its office at 5th Floor, Amstor Annex, Technopark, Thiruvananthapuram, Keralam 695581, India (“Ananthapuri”, “we”, “us”). We build and host websites, news portals, e-commerce stores and online-learning platforms, and provide round-the-clock technical support.
For personal data covered by Section 2(a), we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). This Policy is also our privacy policy under Section 43A of the Information Technology Act, 2000 and Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
2. Scope: whose data this Policy covers
(a) Covered. This Policy covers personal data we collect ourselves: from visitors to ananthapuri.com, from people who contact us by form, email, phone or messaging, from prospective and existing clients’ contact persons, and from job applicants.
(b) Not covered: our clients’ websites. We design, host and maintain websites and apps for clients, including news publishers, online stores and course platforms. Personal data of readers, customers, students or subscribers on those sites is controlled by the client concerned. The client is the Data Fiduciary and we act only as its Data Processor, on its written instructions and under our contract with it. Please read that client’s own privacy policy and send any request about that data to the client. If you write to us, we will pass your request on to the client.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, organisation, designation, email, phone number | You, through forms, email, calls or messages |
| Enquiry and service | Services requested, project details, messages, call notes, support tickets | You |
| Client account and billing | Billing name and address, GSTIN, invoices, payment references (we do not store full card or bank account numbers) | You; our payment gateway or bank |
| Technical and usage | IP address, browser and device type, operating system, pages viewed, referring site, time of visit | Automatically, through server logs, cookies and Google Analytics |
| Job applications | CV, qualifications, work history, references | You |
We do not knowingly collect sensitive data such as health, financial account passwords or biometric information through this website. Please do not send it to us.
4. Why we use your data and on what legal basis
| Purpose | Legal basis under the DPDP Act |
|---|---|
| Answering your enquiry and preparing quotations | Your consent (Section 6), given when you submit the form or write to us |
| Providing contracted services, support, invoicing and collecting payment | Data you voluntarily provide for a specified purpose (Section 7(a)) and consent |
| Measuring website traffic with Google Analytics | Your consent, through the cookie banner; you can refuse or withdraw it |
| Keeping our systems secure, preventing fraud and keeping logs | Compliance with law, including the CERT-In Directions (Section 7(d)) and Rule 6 of the DPDP Rules |
| Tax, accounting and legal record-keeping | Compliance with law (Section 7(d)), e.g. the CGST Act, 2017 and the Income-tax Act, 1961 |
| Responding to courts, law enforcement or government authorities | Compliance with law or a court order (Section 7(c), (d)) |
| Recruitment | Your consent |
| Sending you service updates or occasional news about our services | Your consent, which you can withdraw at any time by using the unsubscribe link or writing to us |
We collect only the data needed for these purposes. We do not sell, rent or trade personal data, and we do not use it for automated decisions that affect you legally.
Withdrawing consent. Where we rely on consent, you can withdraw it at any time, as easily as you gave it, by writing to [email protected] or through the cookie settings link in the footer. Withdrawal does not affect processing done before it. We will stop the processing within a reasonable time unless a law requires us to keep the data.
5. Who we share data with
We share personal data only as described below, and only as much as each purpose needs.
(a) Service providers (Data Processors) who help us run our business, under written contracts that require them to keep the data confidential and secure and to use it only on our instructions.
(b) Authorities, when a law, a court order or a lawful direction requires it, including requests under Section 69 or 79 of the IT Act, 2000 or the CERT-In Directions.
(c) Professional advisers such as auditors, chartered accountants and lawyers, under a duty of confidentiality.
(d) A successor business, if we merge, restructure or sell all or part of our business. The successor will be bound by this Policy.
(e) To protect rights and safety, where needed to prevent fraud or a security incident, or to establish or defend a legal claim.
We do not share personal data with advertisers.
6. Our main service providers
| Provider | What they do for us | Where data may be stored |
|---|---|---|
| Google LLC (Google Analytics) | Website traffic statistics | USA and other countries |
| Google LLC (Google Workspace) | Business email and documents | USA and other countries |
| Ovhtech R&D (India) Private Limited | Hosting of our websites and systems | India |
| Hetzner Online GmbH | Hosting of our websites and systems | Germany and Finland |
| Razorpay Software Private Limited | Receiving payments | India |
We will keep this list current. You may ask us for the latest list at any time.
7. Transfers outside India
Some providers store data outside India. We transfer personal data abroad only to countries the Central Government has not restricted under Section 16 of the DPDP Act, and only with safeguards in our contracts. Where a law or government direction requires certain data to stay in India, we keep it in India.
8. How long we keep data
| Data | Retention period |
|---|---|
| Enquiries that do not become a contract | Up to 3 years from the last contact, then deleted |
| Client contract, account and support records | Duration of the contract plus 8 years, for limitation and tax purposes |
| Invoices and accounting records | As required by tax law: at least 72 months under Section 36 of the CGST Act, 2017, and the period required under Section 44AA of the Income-tax Act, 1961 |
| Server, security and access logs | At least 1 year (Rule 6 of the DPDP Rules), and not less than 180 days in India (CERT-In Directions) |
| Records of hosting subscribers (name, contact, address, IP addresses allotted, period of service) | 5 years after the service ends, as required of hosting providers by the CERT-In Directions |
| Google Analytics data | 14 months |
| Job applications | 1 year, unless you join us or agree to a longer period |
At the end of a retention period we delete or anonymise the data, unless a law, court order or pending dispute requires us to keep it longer.
9. How we protect your data
We take reasonable security safeguards, as Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules require. These include encryption in transit (HTTPS/TLS), access controls based on job role, multi-factor authentication for administrative access, firewalls and malware protection, regular backups, security patching, logging and monitoring of access, and confidentiality obligations for staff and contractors.
No method of storage or transmission is completely secure. We cannot guarantee absolute security, but we work to prevent, detect and respond to incidents.
10. If there is a data breach
If a personal data breach affects you, we will tell you without delay, in plain language, what happened, its likely consequences, what we are doing about it, and what you can do to protect yourself. We will report it to the Data Protection Board of India as the DPDP Rules require. We will report cyber security incidents to CERT-In within 6 hours of becoming aware of them.
11. Your rights
Under the DPDP Act you have the right to:
- Access a summary of your personal data we hold, what we do with it, and who we have shared it with (Section 11).
- Correct, complete or update inaccurate or incomplete data (Section 12).
- Erase data we no longer need, unless a law requires us to keep it (Section 12).
- Withdraw consent at any time (Section 6(4)).
- Nominate another person to exercise your rights if you die or become unable to act (Section 14).
- Have your grievance addressed by us, and then, if you are not satisfied, by the Data Protection Board of India (Sections 13 and 27).
To use these rights, write to [email protected] with enough detail for us to find your data. We may ask you to verify your identity. We will respond within 30 days, and in any case within the time the DPDP Rules allow. We do not charge for this.
You also have duties under Section 15 of the DPDP Act: do not give false information, impersonate anyone, or file frivolous complaints.
12. Children
Our website and services are meant for businesses and adults. We do not knowingly collect personal data of anyone under 18. If we learn that we have, we will delete it unless a parent or lawful guardian has given verifiable consent as required by Section 9 of the DPDP Act. Clients whose platforms serve children, such as course sites, are responsible for obtaining that consent on their platforms.
13. Cookies and analytics
Cookies are small files stored in your browser. We use:
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
| Session and security cookies set by our website software | Strictly necessary | Make the site work and keep it secure | Session |
| Cookie-consent cookie | Strictly necessary | Remember your cookie choice | 12 months |
| _ga, ga[ID] (Google Analytics) | Analytics | Count visits and show how the site is used | Up to 2 years |
Strictly necessary cookies are always on. Analytics cookies load only if you accept them in the cookie banner. You can change your choice at any time through “Cookie settings” in the footer, or by blocking cookies in your browser. You can also install Google’s opt-out add-on at https://tools.google.com/dlpage/gaoptout.
14. Links to other websites
Our website links to other sites, including those of our clients. We are not responsible for their privacy practices. Please read their policies.
15. Grievance Officer and contact
If you have a question, complaint or request about your personal data, contact our Grievance Officer:
- Name: Sreekandakumar Pillai
- Designation: Proprietor
- Email: [email protected]
- Phone: +91 94006 63300 (Monday to Friday, 10:00 am to 6:00 pm IST)
- Address: Ananthapuri Technologies, 5th Floor, Amstor Annex, Technopark, Thiruvananthapuram, Keralam 695581, India
We will acknowledge your grievance within 24 hours and try to resolve it within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India under Section 13(3) of the DPDP Act.
16. Changes to this Policy
We may update this Policy when the law or our practices change. We will post the new version on this page with a new “Last updated” date. If a change materially affects how we use your data, we will tell you in advance by email or a notice on our website, and ask for fresh consent where the law requires it.
17. Governing law
This Policy is governed by the laws of India. Subject to Section 15 and the powers of the Data Protection Board, courts at Thiruvananthapuram, Keralam have jurisdiction.
This notice is also available in Malayalam and in other languages listed in the Eighth Schedule to the Constitution of India, on request, as Section 5(3) of the DPDP Act allows.
Our Terms of Service govern the use of our website and services.