Privacy Policy

Castles Architects and Kysna Construction (collectively, “we”, “us”, or “the Company”) are entities registered in India, engaged in architectural design, bank property valuation, land acquisition, and field workforce coordination. Our registered address is in Lucknow, Uttar Pradesh, India.

We operate this ERP platform (“the System”) to manage valuation assignments, client communications, employee operations, and financial records across our offices in Lucknow, Noida, Delhi, and Mumbai.

We collect the following categories of data, depending on your relationship with us:

A. Client & Property Owner Data (Sensitive Personal Data)

• Full name, address, mobile number, and email address
• Aadhaar number (last 4 digits only; full number is never stored), PAN card number
• Property ownership documents: sale deeds, khatauni, registry, mutation records
• Loan-linked KYC documents submitted to us by the commissioning bank
• Site photographs captured during field inspection (including embedded GPS EXIF metadata)
• GPS coordinates of the inspected property

B. Employee & Field Agent Data

• Name, designation, department, city of posting
• Attendance records including GPS punch-in and punch-out coordinates
• Payroll data: salary components, bank account number for salary credit (encrypted)
• Device identifiers used for photo EXIF verification

C. Job Applicant Data

• Name, phone number, email address and education level
• Answers confirming the practical requirements of the role, including civil qualifications and experience where relevant
• Optional introduction and uploaded PDF resume

D. Usage & Technical Data

• IP address and browser/device type (server logs, retained for 90 days)
• Actions performed within the System, recorded in tamper-proof audit logs
• Session tokens (stored in memory; never written to localStorage or third-party cookies)

We process your data strictly for the following purposes:

• Valuation Services: Generating bank-mandated property valuation reports for home loan, mortgage, and collateral purposes.
• ERP Operations: Managing the assignment lifecycle from lead creation through inspection, QC review, report generation, and payment.
• Regulatory Compliance: Maintaining records required by the Reserve Bank of India (RBI) for empanelled valuers and their clients.
• Employee Management: Processing payroll, attendance, and work allocation for company personnel.
• Recruitment: Reviewing applications and contacting candidates about the role they applied for. Application details and resumes are accessible only to authorised HR staff and Super Admin.
• Anti-Fraud Verification: GPS and timestamp metadata from site photos are cross-checked to verify that inspections occurred on-site and at the reported time.
• Communication: Sending project status updates, inspection notifications, and payment reminders to relevant parties.

Our processing is based on the following legal grounds under Indian law:

• Consent (DPDP Act 2023, Section 6): We obtain your explicit, informed, and revocable consent at the point of data collection for client and property-owner data. Consent records are stored with a timestamp and form version.
• Contractual Necessity: Processing employee payroll and attendance data is necessary to fulfil our employment contracts.
• Legitimate Interests / Legal Obligation: Maintaining audit logs and valuation records is required by RBI empanelment guidelines and standard accounting regulations (7-year retention). This overrides the right to erasure for completed project records.
• IT Act 2000, Section 43A: We maintain reasonable security practices as prescribed by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

We share your data only in the following circumstances:

• Commissioning Bank: The completed valuation report (PDF) is delivered to the bank or housing finance company that commissioned the valuation. Property owner KYC already held by the bank is not re-transmitted to them.
• Cloud Infrastructure (Supabase / Vercel / AWS): Our technical infrastructure partners store and process data on our behalf. We have Data Processing Agreements (DPAs) in place. These providers are SOC 2 Type II and ISO 27001 certified. Data stored on Supabase PostgreSQL servers is located in ap-south-1 (Mumbai) region.
• Payment Gateway (Razorpay): Client invoice amounts and order IDs are shared with Razorpay to initiate payment. We receive only a payment confirmation; card and bank details are never visible to us.
• Legal Requirement: We may disclose data if compelled by a court order, law enforcement demand, or any other statutory obligation under Indian law.

We apply the following retention periods:

Right to Erasure: You may request deletion of your personal data by writing to our Grievance Officer. We will act on valid erasure requests within 30 days. Erasure cannot be performed for data we are legally required to retain (e.g., completed valuation records under RBI guidelines).

We implement the following controls in accordance with IT Act Section 43A and IS/ISO 27001 principles:

• TLS 1.3 encryption for all data in transit between your browser and our servers
• AES-256 encryption at rest for all database records and file storage
• Role-Based Access Control (RBAC): each user role can access only the data required for their function
• Tamper-proof audit logs: every data access, state change, and user action is logged with actor identity, timestamp, and before/after values
• EXIF anti-fraud: site photos are verified for GPS coordinates and original timestamp to prevent back-dated or location-spoofed submissions
• Session management: authentication tokens are short-lived and rotate on each session; no persistent tokens in browser storage
• No production data in development or staging environments

In accordance with RBI guidelines on data localisation and the DPDP Act framework, we have taken the following steps:

• Our primary database (Supabase PostgreSQL) is hosted in the ap-south-1 (Mumbai, India) AWS region
• Property valuation data, KYC documents, and site photos are stored within India by default
• Frontend infrastructure on Vercel uses edge caching; no personal data is stored at edge nodes — only compiled static assets are distributed globally
• Backups are retained within Indian AWS regions

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access (Section 11): Request a summary of the personal data we hold about you and the processing activities carried out on it.
• Right to Correction & Erasure (Section 12): Request correction of inaccurate or incomplete data, or erasure of data no longer necessary for the stated purpose (subject to legal retention requirements).
• Right to Grievance Redressal (Section 13): File a complaint with our Grievance Officer; we must respond within 30 days.
• Right to Nominate (Section 14): Nominate an individual to exercise your rights on your behalf in the event of your death or incapacity.
• Right to Withdraw Consent (Section 6): Withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing done before withdrawal. Note that withdrawal from an active valuation project may affect our ability to complete the assignment.
• Right to Complain to the Data Protection Board: If your grievance is not resolved satisfactorily, you may approach the Data Protection Board of India.

To exercise any of the above rights, write to our Grievance Officer (details in Section 13). We will respond within 30 calendar days.

When we receive a valuation assignment from a bank or housing finance company (HFC), the bank is also a Data Fiduciary for its customer's data and must:

• Obtain its customer's consent to share KYC and property documents with us for valuation purposes
• Execute a Data Processing Agreement (DPA) with us before transmitting any customer data
• Notify us of any data subject rights requests relating to their customers within 5 business days

This System uses strictly necessary cookies only:

• Authentication session cookie (httpOnly, Secure, SameSite=Strict) — expires on browser close or after 8 hours of inactivity
• CSRF token — per-session, not persistent

We do not use advertising cookies, third-party analytics trackers, or fingerprinting scripts. Server access logs (IP address, request path, response time) are retained for 90 days for security monitoring and are not used for any commercial purpose.

We may update this Privacy Policy to reflect changes in law, our services, or our practices. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Display a notice on the login page for 30 days following the change
• For material changes affecting consent, request fresh consent from existing users before they can continue using the System

Continued use of the System after the notice period constitutes acknowledgement (but not consent for new processing activities — fresh consent will be obtained separately for those).

If you are dissatisfied with our response, you may escalate your complaint to the Data Protection Board of India once it is operationally established under the DPDP Act 2023.

For general enquiries about your valuation project or our services, contact us at hello@castlesarchitects.com.