[ 01 ]

Who we are

Keliyo ("we", "us", "our", "the Company") is a technology company with its headquarters at Kesho Nagar, Sari, Samastipur, Bihar – 848101, India, and additional offices at KPC Layout, Kasavanhalli, Bangalore – 560035, and Prabhatam Plaza, Patel Nagar, Bhopal – 462022.

We provide website development, mobile app development, CRM, ERP, AI automation, game development, and SEO services, along with academic engineering project services and a community donation programme.

For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), Keliyo is the Data Fiduciary. For visitors from the European Economic Area, the UK, or Switzerland, Keliyo is the Data Controller under the EU General Data Protection Regulation ("GDPR") and the UK GDPR.

In one line: we only collect what we need to answer you, serve you, or keep the site running — nothing more, and never sold to anyone.

[ 02 ]

Definitions

For clarity, the following terms are used throughout this policy:

• Personal Data — any information that identifies you or can reasonably be used to identify you, directly or indirectly.
• Processing — anything we do with your data: collecting, storing, using, sharing, deleting.
• Data Principal / Data Subject — you, the individual whose data we process.
• Data Fiduciary / Controller — Keliyo, the entity that decides why and how your data is processed.
• Data Processor — a third party that processes data on our behalf (e.g. a hosting or email provider).
• Sensitive Personal Data — data such as health, biometric, financial, caste, or religious information. Keliyo does not intentionally collect this.
• Cookies — small text files stored on your device when you visit a website.

[ 03 ]

What we collect

We collect only the minimum necessary to answer you and run our business. This section lists every category.

3.1 Information you give us

• Contact form — full name, email address, phone number (optional), company name (optional), services of interest, budget range, timeline, city, NDA preference, and the message you write.
• Careers application form — full name, email, phone, role applied for, years of experience, location, portfolio or LinkedIn/GitHub URL, and the note you write.
• Engineering projects form — full name, email, phone, college name, branch, project type, topic, submission deadline, city, and the message you write.
• Newsletter & Vault early access — email address only.
• Donation form — full name, email, phone (optional), PAN (only if you provide it for a tax receipt), donation amount, frequency (one-time/monthly), and cause preference. Payment card, UPI, or bank details are collected directly by our payment gateway and never touch our servers.
• Privacy request form — full name, email, phone, request type, and any details you provide.

3.2 Information collected automatically

• IP address and approximate location (country and city level — not precise GPS).
• Browser type and version, device type, operating system.
• Pages visited, links clicked, time spent on pages.
• Referring URL or campaign source (how you found us).
• Language preference from your browser headers.
• Timestamps of every submission and server log entry.

3.3 What we do NOT collect

• No full card numbers, CVVs, UPI PINs, or net-banking credentials.
• No biometric data (fingerprints, face scans, iris).
• No health, medical, caste, religious, or political information.
• No precise GPS location.
• No data from children under 13 (see Section 12).
• No data from background checks or credit bureaus.

[ 04 ]

How we collect it

• Directly from you — when you fill in any form on our site, email us, call us, or message us on WhatsApp.
• Automatically — when your browser loads our pages, cookies and server logs record technical data.
• From third parties — if you arrive via a referral, the referring site may pass us campaign parameters (never your personal data).
• From our payment gateway — after a donation, we receive a transaction confirmation (amount, date, last-4 digits). We do not receive full card details.

[ 05 ]

Why we collect it

• Respond to you — to reply to your enquiry, application, or project request.
• Deliver services — to scope, quote, build, and support the work you engage us for.
• Send requested emails — the newsletter, Vault early-access notices, and donation transparency reports you opted into.
• Process donations — confirm payments, issue receipts, and publish anonymised impact reports.
• Improve our site — understand which pages and content are useful.
• Keep the site safe — detect spam, abuse, malware, and unauthorised access attempts.
• Meet legal obligations — accounting records, tax filings, and responding to lawful requests.

We never use your data for unrelated purposes, and we never sell it to anyone.

[ 06 ]

Legal basis

Under the DPDP Act and GDPR, we rely on the following legal grounds:

• Consent — when you submit a form, subscribe, or donate, you consent to the processing described here. You may withdraw consent at any time.
• Contract — when we are delivering a paid service, we process your data to fulfil the contract.
• Legal obligation — accounting, tax, and statutory records we are required to keep.
• Legitimate interests — site security, spam prevention, aggregated analytics, and service improvement. We balance these against your rights and never process for reasons that override your interests.

[ 07 ]

Cookies & tracking

Keliyo uses a minimal set of cookies and privacy-respecting analytics. We do not run advertising or retargeting cookies.

• Essential cookies — required for the site to work (e.g. keeping a form session alive, CSRF protection). These cannot be turned off.
• Preference cookies — remember choices you make (e.g. dismissed banners).
• Analytics cookies — anonymised data on page visits and traffic sources. We use aggregated data only and take reasonable steps to prevent identifying you personally.
• No advertising cookies — we do not serve targeted ads, and we do not embed social trackers on this site.

You can block or delete cookies any time from your browser settings. Doing so may affect how some parts of the site work. Under the DPDP Act and GDPR, you can also write to us to object to analytics processing.

[ 08 ]

Who we share with

We share data only with service providers who help us operate Keliyo. They act as Data Processors under written agreements, may process data only on our documented instructions, and are contractually bound to confidentiality.

• Hosting & infrastructure provider — hosts keliyo.com and stores form submissions.
• Email delivery provider — sends our replies, newsletters, and receipts.
• Payment gateway (Razorpay / Stripe) — processes donations and invoices. Card data is handled directly by them; we receive only a transaction summary.
• Analytics provider — collects aggregated, non-identifying site analytics.
• Cloud storage provider — stores project files and backups in encrypted form.
• Legal and regulatory authorities — only when we are legally required, or to protect our legal rights, in response to a valid court order or government request.
• Successor entity — if Keliyo is ever acquired or merged, data may transfer to the successor, subject to the same protections described here.

We do not sell, rent, or trade your personal data with anyone.

[ 09 ]

How long we keep it

• Contact & project enquiries — up to 24 months from last contact, or until you ask us to delete.
• Client project records (contracts, invoices) — for the duration of the engagement plus 7 years, as required by Indian tax and accounting law.
• Careers applications — up to 12 months from receipt, unless you consent to longer retention.
• Newsletter & Vault subscriptions — until you unsubscribe, then deleted within 30 days.
• Donation records — 7 years (statutory accounting requirement). Receipts kept in anonymised form thereafter.
• Privacy requests — 3 years from resolution, to demonstrate compliance.
• Server logs — 90 days, then deleted or anonymised.
• Analytics data — aggregated and non-identifying; retained indefinitely.

[ 10 ]

How we protect it

• All traffic to keliyo.com is encrypted using HTTPS / TLS 1.2 or higher.
• Form submissions are protected by anti-spam measures (honeypot fields, submission timestamps) and validated on the server.
• Access to personal data is role-based and limited to team members who need it to do their job.
• Passwords, API keys, and secrets are stored in encrypted vaults — never hard-coded in the site.
• Payment data is handled entirely by licensed payment gateways, which hold PCI-DSS certification.
• Backups are encrypted at rest and stored in geographically separate locations.
• We monitor for unauthorised access and conduct periodic security reviews.

No system is 100% secure. If we ever discover a breach affecting your personal data, we will notify you and the relevant authorities within the timelines required by law (see Section 15).

[ 11 ]

Your rights

Under the DPDP Act, GDPR, and other applicable laws, you have the following rights:

• Right to access — request a summary of the personal data we hold about you and how we process it.
• Right to correction — ask us to correct inaccurate or incomplete data.
• Right to erasure — ask us to delete your data, subject to legal retention obligations.
• Right to withdraw consent — unsubscribe at any time or ask us to stop processing based on consent.
• Right to object — object to processing based on legitimate interest.
• Right to data portability — request your data in a machine-readable format (JSON or CSV).
• Right to nominate (DPDP Act) — nominate someone to exercise your rights in the event of death or incapacity.
• Right to grievance redressal — complain to our Grievance Officer, and if unresolved, to the Data Protection Board of India (or your local supervisory authority).

To exercise any of these rights, use the form in Section 18 or email hello@keliyo.com with the subject line "Privacy request". We respond within 30 days. Requests are free of charge.

[ 12 ]

Children's privacy

Our website and services are intended for users aged 13 years and above. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please write to hello@keliyo.com and we will delete it promptly.

Where we engage with students (for example, through our engineering projects service), users under 18 should have a parent or guardian's consent before submitting personal data. We do not process children's data for behavioural tracking or targeted advertising.

[ 13 ]

International transfers

Keliyo is based in India, and our servers are primarily located in India and other jurisdictions where our cloud providers operate. If you contact us from the EU, UK, US, UAE, or elsewhere, your data will be transferred to and processed in India.

Where required, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms, to ensure your data receives an adequate level of protection.

By using our site or contacting us, you acknowledge that your data may be processed in India for the purposes described in this policy.

[ 14 ]

Third-party links

Our site may contain links to external websites (for example, our social media profiles on LinkedIn, Instagram, and Facebook, or client websites). This privacy policy does not apply to those external sites. We recommend reading the privacy policy of any site you visit.

We are not responsible for the content, security, or privacy practices of third-party sites.

[ 15 ]

Breach notification

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Data Protection Board of India (and, where applicable, relevant EU/UK supervisory authorities) without undue delay, and in any case within the statutory timelines.
• Notify affected individuals without undue delay, describing the nature of the breach and the steps we are taking.
• Investigate the cause, contain the breach, and take measures to prevent recurrence.

Notifications will be sent to the email address you provided. If you suspect a breach involving your data, please write to hello@keliyo.com with the subject "Suspected breach".

[ 16 ]

Changes to this policy

We may update this policy as our services evolve or as the law changes. The "Last updated" date at the top of this page always reflects the latest version.

For material changes — for example, a new category of data collected, or a new type of third-party sharing — we will:

• Post the updated policy on this page at least 30 days before it takes effect.
• Notify newsletter subscribers and active clients by email.
• Where required, seek fresh consent.

Continued use of our site after an update constitutes acceptance of the revised policy.

[ 17 ]

Contact & grievance officer

For any privacy question, request, or complaint, contact our Grievance Officer:

[ 18 ]

Make a privacy request

Use this form to formally exercise any of your rights — access, correction, deletion, portability, objection, or a complaint. All fields marked * are required so we can verify your identity and respond.