Privacy Policy

Legal entity

Shreya Highrise Private Limited

CIN

U70109WB2021PTC246677

GSTIN

19ABGCS5087H1ZU

Registered office

Spriha Apartment, Flat No. 01, Ground Floor, 97 Rabindra Sarani, New Barrackpur, Kolkata 700 131, West Bengal

Website

https://shreyahighrise.com

Data protection contact

royconstruction@gmail.com

This policy covers this website and everything that follows from it — the enquiry form, the calls, WhatsApp messages and emails we exchange with you afterwards, a site visit you book, and the paperwork if you go on to book a flat. It applies whether you reach us through the form, by phone, by email or in person at either office.

It does not cover websites we link to. Google Maps, WhatsApp, our social profiles and the banks we introduce buyers to each run under their own policies, and we have no control over what they collect once you are on their side of the line.

What you give us on this website. The enquiry form asks for:

Nothing else on this site asks you for anything. There is no account to create, no newsletter, no chat widget and no payment page.

What is collected automatically. Loading any page on the internet reveals some things whether you intend it or not:

• Your IP address, when — and only when — you submit the enquiry form. It is used to count submissions and stop the form being turned into a machine for mailing strangers. It is held in the server's memory for ten minutes, never written to disk, never attached to your enquiry, and lost entirely when the server restarts.
• Ordinary server logs kept by our hosting provider: the page requested, the time, the response code, the browser and operating system string, and the address the request came from. We use them to keep the site up and to investigate abuse.
• The page you arrived from, if your browser chooses to send one.

What you give us if you book. Everything above happens on the website. A booking happens on paper, at an office, and needs more — identity and address proof, PAN, a photograph, co-applicant and nominee details, bank and home-loan information, and the documents your lender and the sub-registrar require. That information is collected offline, is governed by this policy all the same, and is dealt with in the next section.

What we never collect. No card numbers, UPI IDs or net-banking credentials are handled by this website — there is nothing on it to pay for. We do not collect biometrics, we do not read your precise location, we do not buy lists of phone numbers, and we do not scrape or enrich your details from anywhere else.

• Financial information — income proof, bank statements and loan sanction letters — is collected only when you ask us to coordinate a home loan, and goes only to the lender you name.
• PAN is mandatory by law on a property transaction above the statutory threshold, and is quoted on the TDS challan and the conveyance.
• Aadhaar is optional. Where you choose to give it as address proof we accept a masked Aadhaar, we do not use it for authentication, and we do not store the full twelve digits. No booking is refused for declining to give it.
• Identity documents collected for registration are filed with the sub-registrar as the Registration Act, 1908 requires. Once filed they sit on that office's record and are outside our control.

We do not use your data for anything else. If we ever need to — a new purpose, not a new phrasing of the old one — we will ask you again before we do it.

No automated decisions. Nothing here is decided by an algorithm. There is no lead score, no profiling engine and no automated rejection: a person at the sales desk reads your enquiry, and a person calls you back.

The tick box on the enquiry form is the consent. It says, in terms, that you would like us to contact you about that enquiry by phone, WhatsApp or email. It is not pre-ticked, the form will not send without it, and we record that you ticked it alongside the enquiry so both of us can point to it later.

To withdraw it, tell the person who calls you, reply to any message we send, or write to royconstruction@gmail.com. We stop within one working day. Withdrawing consent does not undo the calls already made, and it does not erase records we are separately required by law to keep — but it does end the contact.

If you withdraw before you have booked, we delete the enquiry entirely on request. If you have already booked, we can stop marketing contact but cannot delete the transaction record — §11 explains why.

Neither is a cookie, neither identifies you, and neither leaves your browser. Clearing them costs you a theme preference and nothing else.

A cookie is a small file a site asks your browser to keep. A pixel — Meta calls its own the Meta Pixel, Google calls its the global site tag — is a fragment of code that reports an event, such as a page view or a form submission, back to the platform. Local storage does the same job as a cookie without the file. We treat all three the same way here.

How to control them. Today there is nothing to decline: we set no analytics or advertising cookie, so there is no banner asking you to accept one. Before the first such tag goes live we will publish a consent banner, ask you before it loads, and update this section on the same day. Strictly necessary cookies cannot be declined, because without them the page does not load and the form cannot be protected. Every major browser also lets you block or delete cookies wholesale, in its privacy settings — the site will still work.

Meta — Facebook, Instagram and WhatsApp.

• Meta Pixel and the Conversions API. When these are live, an event such as *viewed a project page* or *submitted an enquiry* is reported to Meta. Where the event carries contact details, they are hashed — irreversibly scrambled with SHA-256 — in your browser or on our server before they are sent. Meta uses them to match the event to an account and to tell us the advertising worked.
• Custom and Lookalike Audiences. We may ask Meta to show ads to people who have visited this site, and to people who resemble them. Any list we upload is hashed first, and we upload only records for which we hold consent.
• Lead ads. If you fill in a form inside Facebook or Instagram rather than on this site, Meta collects it and passes it to us. Meta's own policy governs that collection; this policy governs everything we do with it afterwards.
• We do not target by sensitive category — no religion, caste, health, sexual orientation or political belief — and we do not direct advertising at anyone under eighteen.

Google — Search, YouTube, Analytics and Maps.

• Google Analytics 4, when live, measures traffic and behaviour in aggregate. We have IP anonymisation on where the setting is available and we do not send it any name, phone number or email address.
• Google Ads conversion tracking and remarketing, when live, tells us which ads produced enquiries and lets us show ads to people who have already visited.
• Google Maps is embedded on the Contact page today. Loading that page loads a frame from Google, which sees your IP address and may set its own cookies.
• Gmail carries the enquiry itself — see §9. Google is our email provider, and processes the message on our instructions.

Opting out of personalised advertising. These controls sit with the platforms, not with us, and they work across every advertiser — not only this one:

• Meta ad preferences→Turn off ads based on data from partners, and see which businesses have uploaded your details
• Google ad settings→Turn personalised advertising off across Google Search, YouTube and partner sites
• Google Analytics opt-out add-on→A browser extension that stops Analytics on every website you visit
• How Google uses data from sites that use its services→Google's own account of what it receives from a site like this one
• Meta Privacy Policy→What Meta does with the data it receives
• Google Privacy Policy→What Google does with the data it receives

Our own desks

Sales, and construction and handover. Access is limited to the people who need it to answer you.

Google (Gmail)

Our email runs on Gmail, so an enquiry sent from this site arrives in — and is stored in — a Google mailbox. Google processes it as our email provider, on our instructions, under its own security terms.

Our hosting provider

Serves the website and keeps the server logs described in §2. Enquiries are not stored on the web server — with one exception: if the mail fails to send, the enquiry is written to the server log so that it can be recovered and answered rather than silently lost. Those log entries age out with every other log.

Meta (WhatsApp)

Only if you choose to message us there. Tapping our WhatsApp button opens WhatsApp with a message drafted; nothing is sent, and Meta learns nothing, until you press send.

Banks and housing finance companies

Only the lender you name, and only when you have asked us to arrange a loan.

Channel partners and brokers

Only where you came to us through one, or told us to work with one. We do not circulate enquiries to brokers.

Professional advisers

Our auditors, lawyers and chartered accountants, under professional confidentiality, when a matter requires it.

Government and regulators

Where a law, a court order or a lawful demand requires it — tax authorities, the sub-registrar, a police investigation, or the Data Protection Board of India.

A buyer of the business

If the company or a project is ever sold, merged or restructured, records may pass to the successor, who is bound by this policy until it tells you otherwise.

Gmail, Google Analytics, Google Ads, Google Maps and Meta all operate global infrastructure, so data reaching them may be processed on servers outside India. §16 of the DPDP Act permits transfer outside India except to a country the Central Government has restricted by notification; we do not transfer to any restricted country, and we will stop any transfer that becomes restricted.

Where a transfer happens, it is covered by the provider's own contractual data-protection terms, and it does not change your rights under this policy or your right to complain to us or to the Board.

When a period ends, the record is deleted or irreversibly anonymised. Aggregate figures that cannot be traced back to a person — how many enquiries a project drew in a quarter — may be kept indefinitely.

• The site is served over HTTPS. Everything you type into the form is encrypted in transit.
• There is no database. The enquiry is composed on our server and sent straight to our own inbox over an authenticated, TLS-encrypted SMTP connection. Nothing is written to disk on the web server, so there is no store to breach.
• The mailbox is protected by two-step verification, and the site authenticates to it with a scoped application password rather than the account password.
• The form is rate-limited to five submissions per address in ten minutes, so it cannot be used to flood a stranger's inbox.
• Everything you type is sanitised before it goes near an email header, which closes the header-injection route into our mail.
• Access is need-to-know. Only the sales and handover desks read enquiries. Paper files at the offices are held in locked storage.

These are reasonable security practices within the meaning of §43A of the Information Technology Act, 2000 and Rule 8 of the SPDI Rules, 2011. They are not a guarantee: no system carrying data across the internet is perfectly secure, and anyone who tells you otherwise is selling something.

If there is a breach. §8(6) of the DPDP Act requires us to report a personal data breach to the Data Protection Board of India and to every affected person. We will do that without delay, in writing, telling you what happened, what data was involved, what we have done about it, and what you should do — even where the breach turns out to be minor.

Access — §11

Ask what personal data of yours we hold, what we have done with it, and who we shared it with. We reply with a summary.

Correction and erasure — §12

Have a wrong detail corrected, an incomplete one completed, an outdated one updated, and anything we no longer need erased.

Grievance redressal — §13

Complain to us about how we have handled your data, and get a reasoned answer within the timelines in §17 — before taking it any further.

Nomination — §14

Name someone to exercise these rights on your behalf if you die or become incapable of exercising them yourself. Write to us and we will record it.

Withdraw consent — §6(4)

At any moment, as easily as you gave it. See §5.

How to exercise them. Write to the address in §17 from the email address or phone number you gave us, or tell us how else to verify that the request is yours — we ask because handing your data to someone impersonating you is itself a breach. We do not charge, and we do not require a form.

We may have to refuse in part. Erasure does not reach records the Companies Act, the tax statutes or a live dispute require us to keep, and it does not reach documents already filed with a sub-registrar. Where we refuse, we say so in writing and tell you which law requires it.

• This website is meant for adults buying property. It is not directed at children, and we do not knowingly collect a child's personal data.
• We do not track children, monitor their behaviour, or direct advertising at them — all three are prohibited outright by §9(3), consent or no consent.
• Where data of a child is genuinely needed — a minor named as a co-owner or a nominee on a booking — we collect it only with the verifiable consent of a parent or lawful guardian, and only for that purpose.
• The same protection applies to a person with disability who has a lawful guardian: we act on the guardian's consent.
• If you believe a child has given us details through this site, write to the Grievance Officer and we will delete them.

• One call, within a working day, from the sales desk — not a call centre, and not an auto-dialler.
• Follow-up only where it is useful: the price sheet you asked for, a floor plan, a visit confirmation, or progress on a project you were watching.
• We stop when you say stop. Say it to the person on the phone, reply STOP to any message, or write to us. It takes effect within one working day and we do not ask again.
• We do not send bulk promotional SMS, and we do not add you to a broadcast list.

Commercial calls and messages in India are regulated by the TRAI Telecom Commercial Communications Customer Preference Regulations, 2018. Independently of anything we do, you can register your preferences on the national Do Not Disturb registry through your operator, by messaging 1909, or in the TRAI DND app — which blocks unsolicited commercial communication from every registered sender, not just from us.

Write with what happened, when, and the phone number or email you gave us, so we can find the record. We acknowledge every complaint in writing within three working days, and answer it within thirty days of receiving it.

If our answer does not satisfy you, you may complain to the Data Protection Board of India, which is the statutory authority for this Act. The Act asks you to exhaust the route above first. Nothing here takes away your right to approach a consumer forum or a court on any other ground.

We update this page when what we do changes — a new analytics tag, a new processor, a change in the law. The version number and the date at the top of the page always tell you which text you are reading, and the effective date tells you when it started to apply.

For a change that materially affects you — a genuinely new purpose, or a new category of recipient — we will not rely on a quiet edit. We will ask for your consent again before the new use begins.

General questions about a flat, a booking or a visit: shreyahighrise@gmail.com, or +91 89103 55765. Anything about your data — access, correction, erasure, consent or a complaint: the Grievance Officer in §17.

Governing law. This policy is governed by the laws of India, and the courts at Kolkata, West Bengal have jurisdiction over any dispute arising out of it.