Privacy Policy

G-6, Bypass Road, Langre ki Chowki, Water Works, Agra, Uttar Pradesh 282003, India

Where required by applicable law, we have appointed a Data Protection Officer. Contact:

• Email: alunika@alunikasystems.com
• Postal: Data Protection Officer, G-6, Bypass Road, Langre ki Chowki, Water Works, Agra, Uttar Pradesh 282003, India
• Response time: We aim to respond within 30 calendar days (GDPR), 30 days (UAE PDPL), 30 days (DPDP Act).

As Alunika Systems is established outside the EU/UK but processes data of EU/UK data subjects, we are in the process of designating an EU and UK representative pursuant to Article 27 GDPR. Until a representative is formally appointed, all enquiries should be directed to alunika@alunikasystems.com.

• Identity Data: Full name, title, professional designation, company/organisation name.
• Contact Data: Business email address, telephone number, postal address, country of residence.
• Enquiry & Project Data: Project specifications, quantities, technical requirements, and any content submitted through contact, lead, or specification request forms.
• Correspondence Data: Records of emails, messages, and other communications exchanged with us.
• Career Data: Curriculum vitae, cover letters, educational and employment history, professional references (submitted via Careers page).

• Technical Data: IP address, browser type and version, operating system, device identifiers, screen resolution, time zone.
• Usage Data: Pages viewed, time spent, referral URLs, click-path data, scroll depth, and interaction events.
• Cookie & Tracking Data: Session cookies, persistent cookies, and similar tracking technologies (see Section 8 below).

• Business contact information from publicly available trade directories, architectural professional registers, or industry databases;
• Analytics and audience data from third-party analytics providers (e.g. Google Analytics);
• Technical performance data from content delivery networks and hosting providers.

• Contractual Necessity (Art. 6(1)(b)): Processing necessary for the performance of a contract, or to take pre-contractual steps at your request (e.g. responding to specification enquiries, preparing quotations).
• Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate interests, including: business development and marketing to B2B professionals, website security, fraud prevention, and improving our services — where such interests are not overridden by your rights and freedoms.
• Legal Obligation (Art. 6(1)(c)): Processing required by applicable law, including export control regulations, tax obligations, anti-money laundering laws, and court orders.
• Consent (Art. 6(1)(a)): Where you have given explicit, freely-given, specific, informed, and unambiguous consent (e.g. subscription to marketing communications). You may withdraw consent at any time without detriment.

We process personal data of UAE data subjects under the grounds of consent, contractual necessity, legal obligation, vital interests, or legitimate interests as permitted under the PDPL and its implementing regulations issued by the UAE Data Office.

We process personal data of Indian Data Principals on the basis of consent (obtained in a clear, plain-language notice), or under deemed consent as permitted by Section 7 of the DPDP Act 2023 (e.g. for performance of a contract, legal compliance, medical emergency, employment, or State functions). We maintain records of all consents obtained.

We do not sell personal information as defined under the CCPA. We do not share personal information for cross-context behavioural advertising. California residents have the rights set out in Section 9.4 below.

• Cloud Infrastructure: Supabase Inc. (database hosting — governed by a Data Processing Agreement);
• Website Hosting & CDN: Vercel Inc. (governed by Vercel's Data Processing Addendum);
• Analytics: Google LLC (Google Analytics — with IP anonymisation enabled where required by law);
• Email Communications: Email service providers used to respond to enquiries;
• Professional Advisers: Lawyers, accountants, auditors, and insurers bound by professional confidentiality obligations.

We may disclose personal data to courts, regulatory authorities, law enforcement agencies, or government bodies where required by law, court order, or to protect our legal rights.

In the event of a merger, acquisition, asset sale, or restructuring, personal data may be transferred to the relevant third party, subject to equivalent data protection obligations.

• Strictly Necessary Cookies: Essential for the website to function. Cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with our website (e.g. Google Analytics with anonymised IPs).
• Functional Cookies: Remember your preferences and settings.
• Marketing/Targeting Cookies: Currently not deployed. Will be subject to prior consent if introduced.

Under the EU ePrivacy Directive, UK PECR, and similar laws, you have the right to refuse non-essential cookies. You may manage your preferences through your browser settings or any cookie consent mechanism we deploy. Withdrawing consent does not affect the lawfulness of processing prior to withdrawal.

• Right of Access (Art. 15): Obtain confirmation of and access to your personal data.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data.
• Right to Erasure (Art. 17): Request deletion of personal data in certain circumstances.
• Right to Restriction (Art. 18): Request restriction of processing in certain circumstances.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes.
• Rights re Automated Decisions (Art. 22): Not to be subject to solely automated decisions with significant effects. We do not carry out such processing.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without detriment.
• Right to Lodge a Complaint: Lodge a complaint with your national supervisory authority (e.g. UK: ICO; Ireland: DPC; Germany: relevant Landesbehörde).

UAE data subjects have rights to: access their personal data; correct inaccurate data; withdraw consent; object to processing; request deletion (subject to legal retention requirements); and lodge complaints with the UAE Data Office (ado.gov.ae).

Indian Data Principals have the right to: access information about personal data processed; correct and update personal data; nominate another person to exercise rights on death or incapacity; withdraw consent (without affecting lawfulness of prior processing); obtain information about third parties with whom data has been shared; and lodge complaints with the Data Protection Board of India.

Our Grievance Officer for India can be contacted at: alunika@alunikasystems.com. We will acknowledge complaints within 24 hours and resolve within 30 days.

• Right to Know: Know what personal information is collected, used, shared, or sold.
• Right to Delete: Request deletion of personal information, subject to exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for advertising purposes. No opt-out is therefore required.
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights.
• Right to Limit Sensitive PI Use: Limit the use of sensitive personal information to necessary purposes.

To submit a CCPA request, contact alunika@alunikasystems.com. We will verify your identity and respond within 45 calendar days, with one 45-day extension where reasonably necessary.