Key points at a glance
- We collect only what you send us and what we need to work with you: contact details, project information and billing details.
- Our website uses Google Analytics cookies only if you allow them. We use no advertising or other tracking tools.
- We do not sell your personal data or use it for advertising.
- We send marketing emails only with your consent, and every one includes an unsubscribe link.
- You can access, correct or delete your data, or withdraw consent, by emailing hello@piicode.com.
- Our Grievance Officer acknowledges complaints within 24 hours and resolves them within 15 days.
This is a plain-language summary for convenience. It does not replace the full Privacy Policy below, which is what applies.
01Introduction and scope
This Privacy Policy explains how Piicode Technologies Private Limited ("Piicode", "we", "us" or "our") collects, uses, shares and protects personal data. "Personal data" means any information about an identified or identifiable person.
It covers personal data about:
- visitors to our website at https://piicode.com (the "Website");
- people who contact us or enquire about our services;
- our clients, and the people at our clients we work with;
- people who receive our marketing communications; and
- our business contacts, suppliers and partners.
We are based in India. This policy is written to meet the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the SPDI Rules), and the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 (together, the DPDP Act). Where they apply to us, it also meets the EU General Data Protection Regulation and UK GDPR (together, the GDPR) and the California Consumer Privacy Act as amended by the CPRA (the CCPA).
Our Terms & Conditions govern your use of the Website and our Services.
02Our role
- Data Fiduciary and controller. For Website visitors, enquiries, our clients' staff, marketing contacts and business contacts, we decide why and how personal data is used. We are a Data Fiduciary under the DPDP Act and a controller under the GDPR.
- Data Processor. When we build, host or support systems that handle personal data of our clients' customers, users or employees, we process that data on the client's behalf and only on its instructions. The client is the Data Fiduciary (controller), and its own privacy policy governs that data. Please send requests about it to the client. If you contact us instead, we will pass your request on.
03Information we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | Name, work email address, phone number, company and job title | You, through enquiries, emails, calls and meetings |
| Business and project data | Project details, services of interest, budget and timeline, requirements, and documents and files you share | You and your colleagues |
| Billing and payment data | Billing name and address, GSTIN or tax ID, bank or payment reference details, and invoice and payment history | You, your bank and our payment providers |
| Communications | Emails, messages, meeting notes, and call recordings if you agree to them | You |
| Technical and device data | IP address, browser type, device and operating system, pages requested and timestamps, in standard server logs | Collected automatically by our hosting provider when you visit the Website |
| Cookies and usage data | Pages visited, how you reached the Website (such as a search engine or link), approximate location, device and browser type, and a random identifier stored in a cookie | Google Analytics, only if you allow analytics cookies (see our Cookie Policy) |
| Data from third parties | Business contact details and professional information | LinkedIn, referrals and introductions, public business directories and company websites |
Our enquiry form
The enquiry form on our Contact page does not send your details to our servers. It prepares an email in your browser, which you then send from Gmail, Outlook or your own mail app, or copy and send yourself. We receive it like any other email to hello@piicode.com. Until you send it, what you type stays in your browser.
Payment card details
When you pay by card or through an online payment provider such as Razorpay, Stripe or PayPal, that provider processes the payment. We do not receive or store your full card details.
Sensitive personal data
Apart from the financial information we need for billing, which the SPDI Rules treat as sensitive personal data and which we collect only with your consent and for that purpose, we do not ask for sensitive personal data such as health, biometric or password information. Please do not send it to us unless we ask for it.
04How we use information and our legal bases
We use personal data only for the purposes below. The GDPR requires a legal basis for each purpose. Under the DPDP Act, we rely on your consent or on the legitimate uses permitted by Section 7, such as where you have voluntarily provided data for a specified purpose, or where processing is needed to comply with law or a court order.
| Purpose | Legal basis (GDPR) | Basis under the DPDP Act |
|---|---|---|
| Responding to enquiries and preparing proposals | Steps taken at your request before a contract; legitimate interests in answering business enquiries | Legitimate use: data you voluntarily provided for this purpose; consent |
| Delivering our Services, managing projects and providing support | Performance of a contract; legitimate interests where the contract is with your employer | Consent; legitimate use for the purpose you provided the data for |
| Invoicing, payments, accounting and tax | Performance of a contract; legal obligation | Legitimate use to comply with law; consent |
| Sending marketing communications | Consent, or legitimate interests for existing clients where the law allows, always with an easy opt-out | Consent |
| Measuring how the Website is used (analytics) | Consent | Consent |
| Keeping the Website and our systems secure, preventing abuse and fixing problems | Legitimate interests; legal obligation | Legitimate use to comply with law, including CERT-In directions |
| Complying with the law, enforcing our Terms and defending legal claims | Legal obligation; legitimate interests | Legitimate use to comply with law, a judgment or an order |
| Business transfers, such as a merger or acquisition | Legitimate interests | As permitted by law |
Where we rely on consent, you can withdraw it at any time, as described in section 12. Withdrawing consent does not affect processing that took place before. Where we rely on legitimate interests, we weigh them against your rights, and you can object.
06AI tools and automated processing
- We use AI tools in our work, including third-party large language model providers, for tasks such as summarising meetings, drafting documents, writing and reviewing code, and analysing project materials. Some project and communication data may be processed through these tools, under the providers' data processing terms.
- Where the option is available, we use business or API plans configured so that your data is not used to train the provider's models. We do not use your personal data or our clients' data to train AI models without consent.
- If a client asks us not to process its materials with a particular AI tool, we follow that instruction.
- We do not make decisions about individuals based solely on automated processing that have legal or similarly significant effects on them.
07Email marketing
- We send marketing emails only where you have agreed to receive them, or where the law lets us contact existing clients about similar services. Sending us an enquiry does not sign you up for marketing.
- Every marketing email identifies us, includes our postal address and has an unsubscribe link.
- We act on opt-outs within 10 business days.
- After you opt out, we may still send you emails about an active project, invoices or our contract with you.
- We follow the DPDP Act, CAN-SPAM (United States), CASL (Canada) and the GDPR and PECR (European Union and United Kingdom).
09International data transfers
- Personal data may be stored and processed in India and in other countries where we or our service providers operate.
- When we transfer personal data from the European Economic Area or the United Kingdom to a country without an adequacy decision, including India, we use the European Commission's Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum, with additional safeguards where needed. You can ask us for a copy.
- We comply with any restrictions the Government of India notifies under the DPDP Act on transferring personal data to particular countries.
10Data retention
We keep personal data only for as long as we need it for the purpose we collected it for, plus any period the law requires.
| Data | How long we keep it |
|---|---|
| Enquiries and leads that do not become clients | 24 months after our last contact |
| Client project files and materials | 90 days after the project closes, unless our contract says otherwise or you ask us to keep or delete them sooner |
| Client contact and relationship data | For as long as we work together, then 24 months after our last contact |
| Contracts, invoices, payment and tax records | At least 8 years, as Indian company and tax law requires |
| Marketing preferences and opt-outs | For as long as we send you marketing. We keep opt-out records so we can respect your choice |
| Server logs | Up to 180 days, or longer where needed to investigate a security incident or required by law |
When a retention period ends, we delete or anonymise the data. Under the DPDP Act, we erase personal data once its purpose is no longer being served, unless the law requires us to keep it.
11Data security
We maintain reasonable security practices and procedures, as required by the SPDI Rules, guided by the principles of ISO/IEC 27001. They include:
- encryption in transit (HTTPS/TLS) for the Website;
- access controls based on need to know, and multi-factor authentication on business accounts where available;
- confidentiality obligations for our staff and contractors;
- careful handling of credentials and access that clients share with us; and
- choosing service providers that offer appropriate security commitments.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
If a breach happens
If a personal data breach occurs, we will notify the Data Protection Board of India and the people affected as the DPDP Act requires: without delay, with a detailed report to the Board within 72 hours. We will report cyber security incidents to CERT-In within the time it prescribes. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and the people affected without undue delay where there is a high risk to them.
12Your rights
India (DPDP Act)
- Access a summary of your personal data and how we process it, and the identities of those we have shared it with.
- Correct, complete or update your personal data.
- Have your personal data erased.
- Have your grievances addressed, as described in section 15.
- Nominate another person to exercise your rights if you die or become unable to do so.
- Withdraw your consent at any time, as easily as you gave it.
European Union and United Kingdom (GDPR)
- Access your personal data, and have it rectified or erased.
- Restrict our processing, and receive your data in a portable format.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw your consent at any time.
- Complain to the data protection authority where you live or work, or in the UK to the Information Commissioner's Office.
California (CCPA)
- Know what personal information we collect, use and disclose, and access it.
- Delete and correct your personal information.
- Opt out of the sale or sharing of personal information. We do not sell or share it.
- Not be discriminated against for exercising your rights.
How to exercise your rights
Email hello@piicode.com or our Grievance Officer. We may ask for information to verify your identity, such as details that match our records. We respond within 30 days, and tell you if we need longer where the law allows it. Requests are free, but we may refuse requests that are clearly unfounded or excessive. An authorised agent may make a request for you, with proof of their authority. If we hold the data as a Data Processor for a client, we will forward your request to that client.
13Children's privacy
Our Website and Services are intended for businesses and for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. Because we do not offer services to children, we do not seek the verifiable parental consent the DPDP Act requires for processing children's data. If you believe a child has given us personal data, contact us and we will delete it.
Where a client's product that we build serves children, the client, as Data Fiduciary, is responsible for obtaining verifiable parental consent and meeting the other legal requirements.
14Third-party links
The Website links to other websites and services, such as client websites, social media profiles, and Gmail or Outlook when you choose to send your enquiry through them. Those services handle your data under their own privacy policies, which we encourage you to read. We are not responsible for their practices.
15Grievance Officer
In line with the Information Technology Act, 2000, the SPDI Rules and the DPDP Act, you can raise any concern or complaint about how we handle your personal data with our Grievance Officer by emailing hello@piicode.com.
We acknowledge grievances within 24 hours and aim to resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
16Changes to this policy
We may update this policy from time to time. We will post the new version here with a new “Last updated” date. For significant changes, we will also tell clients and marketing subscribers by email, or show a notice on the Website, before the changes take effect, and ask for your consent where the law requires it.
17Contact us
For questions about this policy or your personal data, contact us:
- Piicode Technologies Private Limited
- Privacy queries: hello@piicode.com
- General enquiries: hello@piicode.com
- Phone: +91 7006130164, +91 9999395491
See also our Terms & Conditions.