Privacy Policy

01Who we are

Potentiaa (“Potentiaa”, “we”, “us”, “our”) designs, builds and maintains custom business software, including billing, inventory, workflow and management systems, and websites, for businesses in India and elsewhere. Our principal place of business is at Building No. 23, Shikhupur, Devpura, Haridwar, Uttarakhand 249401.

For personal data collected through this website, we are the “Data Fiduciary” within the meaning of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), meaning we decide why and how that data is processed.

02Scope of this policy

This policy covers personal data we collect when you visit www.potentiaa.com, submit our enquiry form, or contact us by email, phone, WhatsApp or Instagram.

It does not cover data that our clients put into the software we build or host for them. For that data, the client is the Data Fiduciary and we act only as their “Data Processor”. We process it on their instructions and under our written agreement with them. If you are a client’s customer or employee, please contact that business about your data.

03Personal data we collect

Information you give us

• Enquiry form: your name and business name, phone or WhatsApp number, email address (optional), and the message you write.
• Direct contact: whatever you choose to share when you email, call, WhatsApp or message us, such as your contact details and information about your business and its processes.
• Prospective and existing clients: business contact details, billing and GST details, and the correspondence needed to quote for, deliver and invoice a project.

Information collected automatically

Like any website, our hosting infrastructure may record standard technical data when you visit: your IP address, browser and device type, the pages you request, and the date and time. We use this only to keep the site secure and working, and it is kept for a limited period.

Cookies and tracking

This website does not currently use advertising cookies, analytics trackers or third-party tracking pixels, and we do not build profiles of visitors. If we add analytics in future, we will update this policy and, where the law requires, ask for your consent first.

The only thing the site stores on your device is the time you last sent an enquiry, kept in your browser’s local storage so the form can stop an accidental repeat submission within a minute. It never leaves your device, and you can clear it at any time by clearing your browser’s site data.

We do not knowingly collect sensitive personal data such as passwords, financial account or card details, health or biometric data through this website. Please do not send such information in the enquiry form.

04How we use your data

We use personal data only for the following purposes:

• to reply to your enquiry and arrange the call or workflow audit you asked for;
• to prepare proposals and quotes, and to enter into and perform a contract with you;
• to provide implementation, training and ongoing support to clients;
• to issue invoices and keep the business and tax records the law requires;
• to keep the website and our systems secure and to prevent misuse;
• to comply with legal obligations and lawful requests from authorities.

We do not sell, rent or trade your personal data. We will not send you marketing messages unless you have asked for them, and you can opt out of any such messages at any time.

05Why we are allowed to process it

When you submit the enquiry form or contact us, you give us your consent to use the details you provide for the purpose of responding to you. Where you are a client, we also process data for “legitimate uses” permitted under Section 7 of the DPDP Act, such as data you voluntarily provide for a specified purpose, and compliance with law.

You may withdraw your consent at any time by writing to contact@potentiaa.com. This does not affect processing that took place before you withdrew it, or records we must keep by law.

06Who we share it with

We share personal data only with service providers who help us run our business, and only as much as they need:

• EmailJS (emailjs.com), which delivers enquiry-form submissions to our inbox;
• Vercel, which hosts this website and processes the technical data described above;
• our email and cloud infrastructure providers;
• WhatsApp and Instagram (Meta Platforms), when you choose to contact us through them. Their own privacy policies apply to data you share on those platforms;
• professional advisers such as accountants, auditors and lawyers, under confidentiality;
• government, regulatory or law-enforcement authorities, where required by law or a valid legal order.

If Potentiaa is involved in a merger, acquisition or sale of assets, personal data may pass to the new owner, who will be bound by this policy.

07Transfers outside India

Some of our service providers, including EmailJS, Vercel and our email and cloud providers, may store or process data on servers outside India. Where this happens, we transfer data only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and we rely on providers with recognised security practices.

08How long we keep it

• Enquiries that do not become projects: up to 24 months from our last contact with you, then deleted.
• Client records, contracts and invoices: for the duration of our relationship and afterwards for as long as tax, accounting and other laws require (generally up to 8 years).
• Technical logs: for a short, limited period for security purposes.

09How we protect it

We use reasonable security practices and procedures, as required by Section 43A of the Information Technology Act, 2000 and the rules made under it, and Section 8(5) of the DPDP Act. These include encrypted (HTTPS) connections, access limited to people who need it, and trusted service providers. No method of transmission or storage is completely secure, but if a personal data breach affecting you occurs, we will notify you and the Data Protection Board of India as the law requires.

10Your rights

Under applicable Indian law, you have the right to:

• access a summary of the personal data we hold about you and how it is processed;
• correct, complete or update inaccurate or incomplete data;
• erase your data where it is no longer needed for the purpose it was collected for, unless the law requires us to keep it;
• withdraw consent at any time;
• nominate another person to exercise these rights if you die or become incapacitated;
• have your grievances redressed by us, and then by the Data Protection Board of India if you are not satisfied.

To exercise any of these rights, email contact@potentiaa.com. We may need to verify your identity before acting on a request.

11Children

This website and our services are meant for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us their data, please contact us and we will delete it.

12Changes to this policy

We may update this policy as our services or the law change. The “Last updated” date at the top shows when it was last revised. If we make significant changes, we will highlight them on this website.

13Grievance Officer and contact

In accordance with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, our Grievance Officer is:

We will acknowledge your complaint promptly and resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.