Privacy notice
Version 2026-11-b · Effective: 8 November 2026
Who we are
This notice explains how Propwise Systems ("we", "us") handles personal data collected through this website. For this data we act as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
Operated by: Mohd Ashhar (sole proprietor), trading as Propwise Systems. Contact for privacy matters: privacy@propwisesystems.com.
What we collect, and why
We only collect what we need for the purpose you choose.
| Personal data | When | Purpose |
|---|---|---|
| Full name, work email, mobile / WhatsApp number, company name | When you request an audit, a demo or contact us | To respond to your enquiry and deliver what you asked for |
| Business type, approximate monthly enquiry volume, lead sources, current CRM, city, your message | When you request an audit or contact us | To prepare your audit or answer your question |
| Your consent choices, the notice version you saw, the time, a one-way hash of your IP address and your browser type | When you submit a form | To keep a record of your consent and protect the forms from abuse |
| The page you came from and campaign tags (UTM parameters) | When you submit a form | To understand which pages and campaigns lead to enquiries |
| Booking details (name, email, chosen time) | When you book a meeting through our scheduling tool | To schedule and hold the meeting |
Our website analytics are cookieless and aggregated; they do not identify you. We do not sell personal data, and we do not use it to build advertising profiles.
Consent
When you submit a form, you give consent for us to process your details to respond to your enquiry. Marketing is separate: we only send you occasional insights and offers if you tick the optional marketing box, which is never pre-ticked.
How to withdraw consent
You can withdraw your consent at any time, as easily as you gave it — use the form under Your choices on this page, or email privacy@propwisesystems.com. Withdrawing marketing consent stops marketing messages; withdrawing consent to respond means we will stop processing your enquiry and delete your details unless the law requires us to keep them. Withdrawal does not affect processing that happened before it.
Who we share data with
We use a small number of service providers (Data Processors) under written agreements, only to run this website and respond to you:
- Hosting, forms database and security (Cloudflare) — runs this website, stores what you submit through its forms, and checks that submissions come from people (Cloudflare Turnstile).
- Website analytics (Cloudflare Web Analytics) — cookieless, aggregated page statistics that do not identify you.
- Email delivery (Resend) — sends the confirmation you receive and our internal alert about your enquiry.
- Business email (Hostinger) — the mailbox where we receive and answer your messages.
- Scheduling (Cal.com) — only if you book a meeting.
- WhatsApp (Meta) — only if you message us on WhatsApp.
Some providers may process data outside India. Where they do, we rely on the transfer being permitted under Indian law and on their contractual safeguards.
How long we keep data
We keep personal data only as long as we need it for the purpose you gave it for:
| Data | How long we keep it |
|---|---|
| Enquiry and audit-request details (name, email, phone, company, message) | 24 months after you send them. Our systems then anonymise them automatically. Sooner if you withdraw consent or ask us to delete them. |
| Copies of your enquiry in our email | The same 24 months, unless they become part of a client engagement |
| Client records (proposals, contracts, invoices and project correspondence) | For the engagement, then as long as Indian tax and accounting laws require us to keep business records |
| Consent records | As long as the enquiry they belong to. After that we keep only an anonymised record of what was agreed and when, with no hashed IP address or browser details. |
| Privacy requests | 3 years after we close the request, then anonymised |
| The copy of your enquiry queued for our internal alert | 30 days after the alert is sent |
| Abuse-prevention counters (a one-way hash of your IP address) | Up to 2 days |
| Backups | Deleted data can remain in backups for up to 90 days before they are replaced |
If the law requires us to keep something longer, we keep only what it requires, and only for that purpose.
Your rights
You have the right to:
- access a summary of the personal data we hold about you and how we use it;
- correct, complete or update it;
- have it erased when it is no longer needed for the purpose, or when you withdraw consent;
- have a grievance addressed by us; and
- nominate another person to exercise your rights in the event of death or incapacity.
To exercise these rights, use Your choices below or email us. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Security
We protect personal data with access controls, encryption in transit (HTTPS), security headers, rate limits and bot checks on our forms, logging and regular updates. We never store your raw IP address, only a one-way hash used for abuse prevention.
Children
This website is intended for businesses and is not directed at children.
Changes to this notice
If we change this notice, we will publish a new version here with a new version number. Consent records keep the version you saw.
Notice version: 2026-11-b