Privacy Policy

1. Data we collect

We collect the following categories of personal data:

• Contact details: your name, email address, phone number, company name and postal address when you fill in a form, email us, sign a quotation or create an account.
• Account and service data: the details needed to deliver a project or run your subscription, such as login credentials (stored in hashed form), plan details, the content and files you upload, and the settings you choose.
• WhatsApp numbers and conversation data: where a service involves WhatsApp automation, the business WhatsApp number you connect and the messages that flow through the automation, so that the service can function.
• Payment data: the amount, date, currency, payment method type and transaction reference. Card numbers, CVV, UPI PIN, net-banking credentials and other payment instrument data are entered directly with the payment gateway (Razorpay or another RBI-authorised, PCI DSS compliant gateway). We never hold, store or copy payment instrument data on our systems.
• Usage data: pages visited, approximate location derived from IP address, device and browser type, referring page and interactions with our websites and products, collected through server logs and analytics.
• Communications: emails, chat messages and call notes exchanged with us for support or sales.

We do not knowingly collect sensitive personal data such as health, religious or biometric information, and we ask that you do not send it to us.

2. Why we use your data

We use personal data for the following purposes and on the following lawful bases under the DPDP Act:

• To respond to enquiries and provide quotations (with your consent, given when you contact us).
• To deliver the services and products you have purchased, including running automations, hosting websites and providing subscription access (performance of our agreement with you).
• To issue GST invoices, process payments and refunds, and keep accounting records (legal obligation and performance of our agreement).
• To send service messages such as invoices, renewal notices, security alerts and changes to our terms (performance of our agreement and legitimate use).
• To send occasional updates about our products where you have agreed to receive them. You can opt out at any time using the unsubscribe link or by emailing us.
• To understand how our websites and products are used so we can improve them (consent for analytics cookies, as described below).
• To detect fraud, abuse and security incidents, and to comply with law and lawful requests from authorities.

Where we rely on your consent, you can withdraw it at any time by contacting us. Withdrawal does not affect processing that happened before withdrawal.

3. Cookies and analytics

Our websites use a small number of cookies and similar technologies:

• Strictly necessary cookies: used to keep you logged in to a product, remember your preferences and protect forms against abuse. These cannot be switched off.
• Analytics: we use Google Analytics 4 to measure traffic and understand which pages are useful. Google Analytics sets cookies and collects usage data as described in section 1. IP addresses are truncated by Google before storage. You can opt out using the Google Analytics opt-out browser add-on or by blocking cookies in your browser.
• Advertising and conversion measurement: where a brand runs advertising on Meta or Google, those platforms may set cookies or pixels on the brand’s website to measure conversions. These are only loaded on the brand site concerned and are described on that site.

The corporate website at argroupventures.com loads no third-party scripts other than Google Analytics.

4. Who we share data with

We do not sell personal data. We share it only with service providers (data processors) that help us run the business, and only to the extent needed for the purpose:

• Razorpay Software Private Limited and other RBI-authorised payment gateways, together with their partner banks, card networks and the National Payments Corporation of India, to process payments and refunds, track transactions, prevent fraud and meet Reserve Bank of India requirements. By making a payment you consent to this sharing.
• Meta Platforms (WhatsApp Business Platform, Facebook and Instagram), where a service uses WhatsApp automation or Meta advertising.
• Google (Google Analytics, Google Workspace for email, Google Maps and Google Ads), for analytics, email and advertising measurement.
• Hosting and infrastructure providers such as Vercel and cloud providers that store our websites, products and backups.
• Email and automation tools used to send invoices and service messages.
• Professional advisers such as accountants and lawyers, under confidentiality obligations.

Some of these providers store data outside India, including in the United States and the European Union. We transfer data only to countries not restricted by the Central Government under the DPDP Act, and we use providers that commit to appropriate security safeguards.

We may also disclose personal data when required by law, court order or a lawful request from a government authority, regulator or law enforcement agency, to investigate suspected fraud or illegal activity, to enforce our terms and policies, or to protect our rights, safety or property and those of our users.

If AR Group Ventures or one of its brands is transferred to a successor entity, personal data may be transferred to that entity, which will be bound by this policy.

5. How long we keep data

• Enquiries that do not lead to a purchase: 12 months from the last contact.
• Client and project records, including contracts and deliverables: for the duration of the engagement and 3 years after it ends, to handle warranty and support requests.
• Invoices, payment and transaction records and tax documents: 10 years from the date of the transaction, as required by our payment gateway agreements and Indian tax law.
• Subscription account data: for as long as the account is active and 90 days after closure, after which it is deleted or anonymised unless a longer period is required by law.
• WhatsApp conversation data processed through automations: as configured by the client, and in any case no longer than needed to deliver the service.
• Analytics data: Google Analytics retains event data for 14 months.

When data is no longer needed for the purpose it was collected for, we delete it or anonymise it so it no longer identifies you.

6. Your rights under the DPDP Act

As a data principal under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access: obtain a summary of the personal data we hold about you and how it is being processed.
• Correction and updating: have inaccurate or incomplete personal data corrected or completed.
• Erasure: have your personal data deleted when it is no longer needed for the purpose it was collected for, unless we must keep it by law.
• Withdraw consent: withdraw any consent you have given, as easily as you gave it.
• Grievance redressal: have your complaint about our handling of your data heard and resolved.
• Nominate: nominate another person to exercise your rights if you die or become incapacitated.

To exercise any of these rights, email office@argroupventures.com with the subject line “Data request”. We will verify your identity and respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is operational.

7. Third-party websites and services

Our websites may link to third-party websites and services, such as payment pages, WhatsApp, Google or social media. These links are provided for convenience and do not mean we endorse them. Their privacy practices are governed by their own policies, which we encourage you to read. We are not responsible for the content or privacy practices of third-party websites.

8. Enforcement

We may use the information we hold about you, including personal data, to investigate, enforce and apply our Terms of Service and this Privacy Policy, and to prevent fraud and abuse of our services.

9. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS) for all websites and products, encrypted storage at our hosting providers, hashed passwords, access limited to people who need it, two-factor authentication on our business accounts, and regular review of the third-party services we use.

No system is completely secure. If we become aware of a personal data breach that is likely to affect you, we will notify you and the Data Protection Board of India as required by the DPDP Act.

10. Children

Our websites, products and services are intended for businesses and for adults aged 18 and over. We do not knowingly collect personal data from children under 18 without verifiable parental consent. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy as our services or the law change. The date at the top of the page shows the latest revision. For significant changes we will notify account holders by email or through a notice on the relevant website.

12. Contact and grievance officer

Any complaint or concern about your personal data, the content of our websites, a breach of confidentiality or the use of our services should be sent to our grievance officer, designated under the DPDP Act, the Information Technology Act, 2000 and the Reserve Bank of India's guidelines for payment aggregators. Complaints can be made by email, phone or post:

• Grievance officer: Ankit Raj, Proprietor
• Email: office@argroupventures.com
• Phone: +91 62074 64174
• Post: AR Group Ventures, O-809, New Defence Colony Phase 1, Paragpur, Jalandhar Cantt, Jalandhar, Punjab 144005, India

Complaints are acknowledged within 48 hours and responded to within 5 business days of receipt. If a complaint needs longer to resolve fully, we will tell you why and when to expect a resolution.