Privacy Notice

1.1RIGS & Roads (operated by Sai Vineeth Kallu, sole proprietor, of Rampally, Hyderabad, Telangana, India) is the Data Fiduciary for personal data processed through the Platform under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).

2.1We collect account and Organisation data (name, role, work email, Organisation name and registration identifiers such as GSTIN, Udyam or CIN) and verification records (the results of checks we run; we do not store copies of identity documents). We also collect booking data and uploaded test documents (test plans, prototype and sample details, results), communications, and technical and usage data (log, device and audit-log data).

3.1We process personal data on the basis of your consent and to provide the services you request. We use it to create and manage accounts; verify users; operate listings, controlled disclosure, bookings, NDAs and Work Orders; maintain the audit log and platform security; communicate with you; and comply with law. We do not sell personal data.

4.1We share personal data only as needed to operate the Platform: with the other party to a booking (on and after identity reveal), and with our data processor Base44 (a Wix.com Ltd. company), which provides application hosting, database, file storage, sign-in and email delivery, under terms requiring it to protect the data. We will update this list before adding a processor. We disclose data where required by law.

5.1We keep personal data only as long as needed for the purposes above or as required by law:

Account and Organisation data: for the life of the account and twelve (12) months after closure.

Booking, Work Order and audit-log records: eight (8) years from the end of the booking. This covers the conversion-fee period, limitation periods and statutory record-keeping.

Verification records: for the life of the account and twelve (12) months after closure.

We then delete or anonymise the data.

6.1Subject to the DPDP Act, you may access and correct your personal data, request erasure, withdraw consent, nominate another person to exercise your rights in the event of death or incapacity, and raise a grievance. To exercise these rights, contact the Grievance Officer.

7.1Grievance Officer: Sai Vineeth Kallu, Proprietor, email contact@rigsandroads.com. We will respond within the timelines required by the DPDP Act and its rules. If you are not satisfied with our response, you may approach the Data Protection Board of India.

8.1We apply reasonable technical and organisational safeguards appropriate to the sensitivity of the data, including access controls, per-booking data segregation and audit logging. No system is perfectly secure; we will notify data breaches as required by law.

9.1The Platform is operated from India. Platform data, including uploaded files, is hosted by our processor Base44 on servers in the United States, so your personal data is transferred to and stored in the United States. We transfer personal data outside India only as permitted by section 16 of the DPDP Act (not to any country the Central Government restricts), and our processor must protect it under its data processing terms.

9.2Users in the United States may exercise the access, correction and deletion rights in Section 6 through the Grievance Officer, and we will honour any additional rights given to them by applicable US state privacy law.

10.1The Platform is for business users and is not directed at children. We do not knowingly process the personal data of a person under 18. Student participants must be arranged through a sponsoring organisation or institution (Terms §3.3); where any processing of a minor's data is necessary, we will obtain verifiable parental or guardian consent as required by the DPDP Act.

11.1This Notice is versioned with an effective date. Material changes require renewed consent where the DPDP Act so requires; other changes take effect on notice.