Sarayan Infra LLP
1.1 Sarayan Infra LLP (“Company”, “we”, “us”, “our”), a limited liability partnership having its registered office at 807, 808, 9 Rajgir, Plot No. 766, Main S.V. Road, Diagonally Opposite Mc. Donald’s, Borivali – West, Mumbai – 400092, India, provides Workspace Strategy, Design, and Design & Build services for corporate, commercial, and residential interiors (collectively, the “Services”).
1.2 This Privacy Policy (“Policy”) describes how we collect, use, process, store, disclose, and dispose of personal data (“Data”) of individuals and entities (“Data Principals”, “you”, “your”) who engage with us through our website(s), client and vendor onboarding, project execution, site visits, or any other digital or physical touchpoint, in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the DPDP Rules, 2025.
1.3 This Policy applies across all three of our service lines — Workspace Strategy (space planning, feasibility, and consulting engagements), Design (concept design, detailing, and specification services), and Design & Build (turnkey execution, project management, and site delivery) — and to our website(s), client and vendor portals, and physical interactions at our offices, client premises, and project sites.
2.1 Where processing is based on consent, you provide such consent through a clear, affirmative action — clicking “I Accept,” digitally signing, or physically signing a consent or engagement form. Where processing is based on the performance of a contract or a legal obligation under DPDP Act, such processing does not require separate consent and may continue notwithstanding withdrawal of any consent-based processing running in parallel.
2.2 You may withdraw consent at any time through the mechanisms described in Clause 10.3. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not affect data processed on a legal-obligation or contract-performance basis, including project records, invoices, and statutory filings.
3.1 Terms used in this Policy have the meaning given to them under the DPDP Act, including “Personal Data,” “Processing,” “Data Fiduciary” (the Company), “Data Processor,” and “Consent Manager.”
3.2 In addition, for purposes of this Policy:
The specific retention period applicable to each category below is addressed on a consolidated basis according to DPDP Act.
| Data Elements | Purpose |
|---|---|
| Name, address, email, mobile number, GSTIN, PAN, and, for corporate clients, company incorporation and authorised signatory details | Client onboarding, quotation and proposal preparation, contractual documentation, project execution, invoicing, and statutory compliance |
| Bank account details, IFSC code, cancelled cheque, credit account and payment-term information | Payment processing, refund issuance, and settlement of accounts |
| Project Data (drawings, BOQs, specifications, site photographs, approvals, project correspondence) | Delivery of Workspace Strategy, Design, and Design & Build Services; project administration; warranty and dispute defence; quality assurance |
| Vendor/contractor KYC, business registration, MSME status, and statutory eligibility documents | Vendor and subcontractor onboarding for Design & Build execution, statutory and regulatory compliance |
| Data Elements | Purpose |
|---|---|
| IP address, browser and device information, session data | Website security, fraud prevention, service functionality |
| Enquiry form submissions, pages visited, referral source | Enquiry management, service communication, website improvement |
| Login credentials (hashed), client/vendor portal access logs, project tracking IDs | Account security, access control, project status tracking |
5.1 The Company retains Personal Data only for as long as reasonably necessary to fulfil the purpose for which it was collected, in accordance with the purpose-limitation principle under the DPDP Act — that is, until the purpose is served, consent is withdrawn (where applicable), or the Data Principal does not approach the Company for the performance of the relevant purpose, whichever is applicable, subject to Clause 5.2 below.
5.2 Notwithstanding Clause 5.1, the Company shall retain the following categories of Data for the specific statutory periods indicated, being periods independently mandated by applicable law and not a matter of the Company's discretion:
5.3 Save as set out in Clause 5.2, the Company does not commit to fixed retention periods for other categories of Data, as the appropriate period necessarily depends on the nature of the specific engagement, the risk of a warranty or professional-liability claim (which under Indian law may be brought within the applicable limitation period after project handover), and ongoing business necessity. Data Principals may request details of the retention approach applicable to their specific Data by writing to the Grievance Officer under Clause 11.
5.4 Upon expiry of the applicable retention period, Data is securely deleted in accordance with the Company's internal data disposal procedures, save where the Company is required by the Data Principal's own request, by law, or by a pending proceeding to retain it further.
6.1 In the course of delivering Workspace Strategy, Design, and Design & Build Services, the Company may photograph, document, and record completed and in-progress projects. Unless a client expressly opts out in writing at the time of project sign-off, the Company shall be entitled to use such project photographs, floor plans, renders, and general project descriptions (excluding confidential commercial terms and unpublished personal data of individuals) for its portfolio, marketing materials, website, social media, award submissions, and case studies.
6.2 A client may request exclusion of a specific project from such use by written notice to the Grievance Officer, which the Company shall action within thirty (30) days, without affecting any use that has already occurred prior to such request.
The Company uses different categories of cookies to enhance the functionality, security, and performance of its website and services. Strictly Necessary Cookies are essential for the operation of the website, including enabling core functionalities such as user authentication, login sessions, secure portal access, and system administration. These cookies are deployed on the basis of the Company's legitimate interest and do not require user consent.
Functional Cookies are used to remember user preferences, such as language and regional settings, to provide a more personalized browsing experience. These cookies are placed only with the user's consent.
Analytical Cookies are used to understand how visitors interact with the website by collecting aggregated and, where possible, anonymized information relating to user journeys, website traffic, and overall website performance. These cookies are deployed only after obtaining the user's consent.
Marketing Cookies are used to measure the effectiveness of advertising campaigns, deliver relevant advertisements, and facilitate marketing and retargeting activities. These cookies are used only with the user's prior consent.
Security Cookies are used to protect the website, its users, and the Company's systems from fraudulent activities, unauthorized access, malicious traffic, bots, and other cybersecurity threats. These cookies are deployed on the basis of the Company's legitimate interest in maintaining the security, integrity, and reliability of its website and services.
The consent banner offers “Reject All” and “Accept All” in equal prominence, with a “Customize” option for granular control. All non-essential cookies default to OFF. Withdrawal via the “Cookie Preferences” link in the website footer takes effect within 24 hours and does not affect core website functionality.
Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party’s site. We strongly advise You to review the Privacy Policy of every site You visit.
We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.
Your information, including Personal Data, is processed at the Company’s operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.
Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.
The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.
A Data Principal may request a copy of their Data, its processing purposes, and recipient categories, by submitting a request to admin@sarayan.in with identity verification via OTP or digital signature. The Company shall respond within 15 business days. The first request in a calendar year is free; subsequent requests may attract a nominal fee of Rs. 500 to prevent frivolous or repetitive requests.
Correction requests, supported by appropriate documentation, are actioned within 10 business days and propagated to relevant Processors within a further 5 days. Erasure requests are actioned within the timeline prescribed under the DPDP Rules, save where the Data is required to be retained under Clause 5.2 (statutory retention) or is the subject of pending litigation.
Consent may be withdrawn via the unsubscribe link in marketing communications, the “Cookie Preferences” control on the website, the client/vendor portal's consent settings, or written request to the Grievance Officer. Withdrawal of consent for marketing communications takes effect immediately; withdrawal of consent necessary for an active project engagement may affect the Company's ability to continue that engagement, which shall be clearly communicated at the point of withdrawal.
A Data Principal may nominate an individual to exercise their rights under this Policy in the event of death or incapacity, by submitting the prescribed nomination form together with supporting documentation.
Upon becoming aware of a personal data breach, the Company shall notify the Data Protection Board within 72 hours in the prescribed form, and shall notify affected Data Principals without undue delay, describing the nature of the breach, the categories and approximate volume of Data affected, likely consequences, and mitigation measures taken.
The Company does not knowingly collect or process Personal Data of individuals below 18 years of age, and its Services are not directed at or marketed to children. Where such data is inadvertently discovered, the Company shall suspend processing immediately, delete the data within 48 hours.
The Company periodically self-assesses whether it meets the threshold for designation as a Significant Data Fiduciary under the DPDP Act, having regard to the volume and sensitivity of Personal Data processed and the potential impact of its processing activities, and shall implement the enhanced obligations applicable under the DPDP Act if and when so designated or notified.
14.1 This Policy is reviewed periodically and updated as necessary. Material changes shall be notified to registered clients and vendors by email and by a prominent notice on the Company's website for a period of 30 days, together with an updated effective date and version number.
14.2 This Policy is governed by the laws of India. Subject to Clause 14.3, the courts at Mumbai, Maharashtra shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.
14.3 Disputes arising in connection with commercial engagements shall, in the first instance, be referred to arbitration before a sole arbitrator appointed by the Company, seated at Mumbai, in accordance with the Arbitration and Conciliation Act, 1996.
14.4 If any provision of this Policy is held invalid or unenforceable, the remaining provisions shall continue in full force and effect.
Data Protection Officer / Grievance Officer: admin@sarayan.in, +91-8976160893 (Mon–Fri, 11:00 AM–5:00 PM IST)
Registered Office: Sarayan Infra LLP, 807, 808, 9 Rajgir, Plot No. 766, Main S.V. Road, Diagonally Opposite Mc. Donald’s, Borivali – West, Mumbai – 400092, India.
By clicking “I Accept” on our digital platforms, executing an engagement letter or Statement of Work referencing this Policy, or otherwise voluntarily providing your Personal Data, you confirm that you have read and understood this Policy, provide explicit consent for each processing purpose that requires consent, acknowledge your rights as set out in Clause 10, and agree to receive electronic communication regarding updates to this Policy.
