Privacy Policy

1. Who we are

NarneTech Software Solutions ("NaWaBiz", "we", "us") operates the NaWaBiz WhatsApp Business Platform at https://nawabiz.com. This policy explains how we handle personal data of visitors to our website, of our business customers, and of the End Users our customers communicate with through the Service.

2. Scope & our roles

Under the DPDP Act, the entity that determines the purpose and means of processing personal data is the Data Fiduciary, and the individual whose data is processed is the Data Principal.

• For our website visitors and customers, NaWaBiz is the Data Fiduciary.
• For End Users' data that our customers process through the Service (their contacts and conversations), our customer is the Data Fiduciary and NaWaBiz acts as a Data Processor processing that data on the customer's documented instructions.

3. Personal data we collect

From website visitors: contact-form details (name, email, phone, company, message), and technical data such as IP address, browser type, and pages viewed.

From customers: account and billing details (name, business name, email, phone, GSTIN, payment references), authentication data, and usage logs.

Processed on behalf of customers (End User data): WhatsApp phone numbers, profile names, message content and media, opt-in/opt-out status, tags and attributes, and knowledge-base content the customer uploads.

We do not intentionally collect special or sensitive categories of data through the website. Please do not submit such data in contact forms.

4. How and why we use it

• To create and manage your account and provide the Service;
• To connect your WhatsApp Business Account via Meta's Embedded Signup and route messages;
• To process payments and wallet top-ups via our payment partner;
• To provide support and respond to enquiries;
• To secure the Service, prevent fraud and abuse, and maintain audit logs;
• To comply with legal obligations and Meta's platform requirements;
• To send service and, with consent, marketing communications (you may opt out anytime).

5. Lawful basis & consent

Where required by the DPDP Act, we process personal data on the basis of your consent, which is free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and for legitimate uses permitted by law. Our notices are available in English and, on request, in the languages specified in the Eighth Schedule to the Constitution of India. You may withdraw consent at any time (see Your rights); withdrawal does not affect prior lawful processing.

When we act as a Data Processor for our customers, the customer is responsible for establishing the lawful basis and obtaining consent from End Users, including valid opt-in for WhatsApp messaging.

6. How we share data

We do not sell personal data. We share it only with:

• Meta Platforms, to deliver WhatsApp messages via the Cloud API;
• Razorpay, our payment processor, to take payments;
• Infrastructure and AI/vector-database providers that host or process data to run the Service, under confidentiality and data-protection obligations;
• Authorities, where required by law or to protect rights and safety.

7. Data retention

We keep personal data only as long as necessary for the purposes above, to provide the Service, and to meet legal, tax and audit obligations, after which it is deleted or anonymised. When we process data on a customer's behalf, we retain it for the customer's subscription term and export/delete it on termination as described in our Terms. As required by the DPDP Act, we will erase personal data when consent is withdrawn or the purpose is no longer served, unless retention is required by law.

8. How we protect data

We apply reasonable security safeguards, including encryption of secrets at rest (AES-256-GCM), encryption in transit (TLS), strict tenant isolation so one business's data is never exposed to another, access controls, audit logging, and signature verification on inbound webhooks. No method of transmission or storage is completely secure; in the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act. See our Data Protection Policy for details.

9. Your rights as a Data Principal

Subject to the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you and the processing activities;
• Correction, completion and updating of your personal data;
• Erasure of your personal data where no longer needed or on withdrawal of consent;
• Withdraw consent at any time, as easily as it was given;
• Grievance redressal from us within the timelines prescribed by law;
• Nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any right, contact our Grievance Officer (below). We may need to verify your identity. If unsatisfied with our response, you may complain to the Data Protection Board of India.

10. Children's data

The Service is intended for businesses and is not directed at children. We do not knowingly process the personal data of children (persons under 18) without verifiable parental consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, consistent with the DPDP Act.

11. International transfers

Some processors (including Meta and AI providers) may process data outside India. Where they do, we take steps to ensure the transfer is permitted under applicable law and that appropriate safeguards are in place. We will not transfer personal data to any country restricted by the Central Government.

12. Cookies

Our website uses only essential cookies needed for security and core functionality. See our Cookie Policy.

13. Grievance Officer

In accordance with the DPDP Act and the Information Technology Act, 2000, our Grievance Officer can be reached at:

14. Changes

We may update this policy from time to time. We will post the revised version here with a new "Last updated" date and, where changes are material, notify you through the Service or by email.