Privacy Policy

Alberoz Group Private Limited (“we”, “us”, or “our”) is an Indian company that builds custom software, subscription SaaS products, AI and automation solutions, and technology training programs. We act as the data fiduciary / data controller for the personal data described in this Policy.

This Policy is designed to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 in India, and reflects the requirements of the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended (CCPA/CPRA) where they apply to you — see the regional supplements in sections 17 and 18.

• Entity: Alberoz Group Private Limited (CIN: U72900UP2021PTC152033)
• Privacy contact / Grievance Officer: Business@alberotechnologies.com
• Registered office: H No. 1582, Naubasta, Rajendra Nagar Road, Kanpur, Uttar Pradesh 208021, India

This Policy covers our public website, our client portal, our SaaS products, and the services we deliver under a proposal, quotation, statement of work, or order form (“Service Agreement”).

Where we build or operate a system for a client and process personal data on that client’s instructions, the client is the data fiduciary / controller and we act as a data processor. In those cases our client’s privacy notice governs the processing, and our obligations are set out in the Service Agreement or an accompanying data-processing agreement (DPA), which we make available to clients on request.

To be explicit about the boundaries, we do not:

• Sell, rent, or trade your personal data to anyone;
• Store full payment card or bank account numbers — payments are handled entirely by our payment gateway;
• Collect precise GPS location, biometric data, or government identity documents through this website;
• Access your contacts, address book, or device files;
• Use your personal data or client project data to train artificial-intelligence models (see section 6);
• Set analytics or advertising cookies before you opt in through our cookie banner (see section 7).

Information you provide. Depending on how you interact with us, we may collect:

• Identity and contact details — name, email address, phone number, company/organisation name, and role;
• Enquiry and project details — the content of forms, messages, proposals, and correspondence you send us;
• Account credentials — username and password for our client portal or SaaS products (passwords are stored in hashed form, never in plain text);
• Billing information — billing name, address, GST details, and transaction records (full card/bank details are handled by our payment gateway, not stored by us);
• Complaint details and any optional attachments you submit through our Complaint Forum.

Information collected automatically. When you visit our website or use our products, we may collect:

• Device and browser information — IP address, device type, operating system, and browser type;
• Usage data — pages visited, referring URLs, actions taken, timestamps, and session activity;
• Log and diagnostic data used to maintain security, prevent fraud, and diagnose faults;
• Your cookie-consent choices, stored locally in your browser as described in section 7.

Information from third parties. We may receive limited data from our analytics, advertising-measurement, and payment providers — for example, aggregate campaign performance, or the success or failure of a transaction. We do not receive your card details from the payment gateway.

We use personal data for the following purposes, on the legal bases indicated:

We build AI and automation systems for clients, and we use AI-assisted tooling internally. Our commitments about your data are:

• We do not use your personal data, enquiry content, or client project data to train, fine-tune, or improve any artificial-intelligence model, whether our own or a third party’s;
• Where an engagement requires a third-party AI service (for example, a hosted model API), the specific providers, data flows, and safeguards are identified in the Service Agreement before any data is shared, and are covered by the applicable data-processing terms;
• AI output is probabilistic. Systems we deliver may produce results that are inaccurate or incomplete, and we design them so that a human remains responsible for decisions that affect people;
• We do not use your personal data to make solely automated decisions that produce legal effects concerning you or similarly significantly affect you.

No analytics or advertising cookie is set on your device until you opt in. Until you make a choice in our cookie banner, only strictly necessary browser storage is used and no third-party tag is loaded. You can change or withdraw your choice at any time from the Cookie settings link in the footer of every page, or by clearing site data in your browser.

We use three categories of cookie: strictly necessary storage that records your cookie choice and interface preferences; analytics cookies (Google Analytics 4 and Tag Manager) that show us how the site is used in aggregate; and marketing cookies (Meta Pixel and Google AdSense) that measure whether our advertising works. We also use the Meta Conversions API, which sends conversion events from our server with identifiers hashed before transmission, and which runs only where you have accepted marketing cookies.

Our Cookie Policy lists every cookie by name, with its purpose, duration, and specific opt-out instructions, along with how to manage cookies in your browser and our position on “Do Not Track” signals.

We share personal data with a small number of vetted providers who process it on our behalf, under contractual confidentiality and data-protection obligations:

Beyond these processors, we disclose personal data only where required by law, court order, or a lawful request from a competent authority; where necessary to establish, exercise, or defend legal claims, or to protect the rights and safety of our users and the public; or in connection with a merger, acquisition, or restructuring, in which case this Policy continues to apply. We do not sell personal data.

With your consent, or where otherwise permitted by law, we may send you marketing communications about our products, offers, and content. You can opt out at any time using the unsubscribe link in our emails or by contacting us. Opting out of marketing does not affect service-related or transactional communications, which we must send to operate your account or engagement.

Your personal data is stored on secure servers managed by the hosting providers named above. We apply technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), hashed credentials, encrypted storage of sensitive configuration values, role-based access restricted to staff who need it, and monitoring of access and errors.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a personal data breach that is likely to affect you, we will notify you and the relevant authority as required by law — including the 72-hour notification requirement under GDPR, and notification to the Data Protection Board and affected users under the DPDP Act.

We keep personal data only for as long as necessary for the purpose it was collected for, or as required by law. Our standard periods are:

When data is no longer required, we securely delete or irreversibly anonymise it. Backups are purged on a rolling cycle.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you and request a copy;
• Request correction of inaccurate, misleading, or incomplete data;
• Request erasure of your data where it is no longer required or where you withdraw consent;
• Withdraw consent at any time, without affecting processing carried out before the withdrawal;
• Nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act;
• Object to or restrict processing, and request portability of your data, as described in the regional supplements below.

To exercise any right, email us at Business@alberotechnologies.com. We acknowledge requests within 2 business days and respond within 30 days. We may need to verify your identity first, and we will tell you if a request is one we are legally required to decline. Exercising these rights is free; we may charge a reasonable fee only for manifestly unfounded or excessive repeat requests.

If you are not satisfied with our response, you may escalate through our Escalation Policy or complain to the Data Protection Board of India or your local supervisory authority.

We are based in India and our primary infrastructure serves users worldwide. Some of our processors — notably Google and Meta — operate globally, so personal data may be processed outside your country.

Where personal data is transferred out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with the transfer terms in each provider’s data processing agreement. Transfers out of India are made in accordance with the DPDP Act and are not made to any country restricted by the Central Government. Data also transits third-party networks in the ordinary course of internet routing.

Our website and commercial services are intended for businesses and for individuals aged 18 and above, and are not directed at children. We do not knowingly collect personal data directly from a child through this website.

Where we deliver education programs involving minors (such as AI labs for schools), personal data of children is processed only through the school or institution acting as our client, on the basis of verifiable parental or guardian consent obtained by that institution as required under the DPDP Act. We do not use children’s data for tracking, behavioural monitoring, or targeted advertising. If you believe a child has provided us personal data directly, contact us and we will delete it.

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. The updated version will be posted on this page with a revised “Last updated” date. Where a change is material, we will give additional notice — by email or an on-site notice — and, where the change affects cookies, we will ask for your consent choices again.

For any privacy question, to exercise your rights, or to reach the Grievance Officer appointed under the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, contact us:

• Grievance Officer / Data Protection contact: Business@alberotechnologies.com
• Phone: +91 91707 80671
• Registered office: H No. 1582, Naubasta, Rajendra Nagar Road, Kanpur, Uttar Pradesh 208021, India
• Response times: acknowledgement within 2 business days; resolution of a grievance within 30 days

See also our Cookie Policy, Terms & Conditions, Refund & Cancellation Policy, and Complaint Forum.

If you are in the European Economic Area or the United Kingdom, this section applies in addition to the rest of this Policy.Alberoz Group Private Limited is the controller of your personal data.

Legal bases (Article 6). We process personal data on the bases set out in the table in section 5: performance of a contract or steps prior to it, compliance with a legal obligation, our legitimate interests in operating and securing our business, and your consent for marketing and non-essential cookies. Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights, and you may object as described below.

Your rights (Articles 15–22). You have the right of access, rectification, erasure, restriction of processing, data portability, and objection — including an absolute right to object to processing for direct marketing — and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out such automated decision-making.

Transfers. Transfers of personal data outside the EEA or the UK are made under the European Commission’s Standard Contractual Clauses, or the UK Addendum, as described in section 13. You may request a copy of the safeguards we rely on.

Complaints. You may lodge a complaint with your local data protection authority — for UK residents, the Information Commissioner’s Office (ico.org.uk) — though we ask that you contact us first so we can try to resolve the matter.

If you are a California resident, the CCPA as amended by the CPRA gives you the rights below. In the preceding twelve months we collected the following categories of personal information, as defined by the CCPA:

Do Not Sell or Share My Personal Information. We do not sell personal information, and we do not share it for cross-context behavioural advertising within the meaning of the CPRA except through the advertising cookies described in section 7 — which are set only if you opt in. Declining marketing cookies in our banner is an effective opt-out, and we honour Global Privacy Control signals where our advertising partners support them. We do not knowingly sell or share the personal information of consumers under 16.

Your rights. You have the right to know what personal information we collect and how we use and disclose it, to request deletion or correction, to opt out of sale or sharing, to limit the use of sensitive personal information (we collect none), and not to receive discriminatory treatment for exercising any of these rights. You may use an authorised agent, with written permission and identity verification. Submit requests to Business@alberotechnologies.com — we respond within 45 days, extendable once by a further 45 days where necessary.