- We do not sell, rent, monetize, or trade your corporate or personal data.
- Your proprietary software source code and project briefs are NEVER used to train public AI or Large Language Models (LLMs).
- Full compliance with India's Digital Personal Data Protection Act, 2023 and GDPR standards.
- All client repositories, staging databases, and credentials are protected under Mutual Non-Disclosure Agreements (NDAs).
1. Introduction & Data Fiduciary Identity
Welcome to Our City Nirman Private Limited (“Our City Nirman”, “OCN”, “Company”, “we”, “us”, or “our”). We are an engineering center and digital product studio incorporated under the Companies Act, 2013, with registered corporate offices at: At - Simanpur, Post - Sadipur, Ps - Pirpainti, Dist - Bhagalpur, Bihar - 813209, India.
This Privacy Policy (“Policy”) outlines our standards regarding the collection, processing, storage, and transfer of personal data when you interact with our public website (ourcitynirman.online), engage our software development, SaaS platform, cloud engineering, or advisory services, or apply for career opportunities.
For the purposes of India's Digital Personal Data Protection Act, 2023 (DPDP Act) and relevant international privacy laws, Our City Nirman operates as the Data Fiduciary for personal data collected through our public touchpoints, and as a Data Processor on behalf of corporate clients who deploy applications engineered by our team.
2. Information & Personal Data We Collect
We adhere to strict data minimization principles. We collect only what is strictly necessary:
A. Information Voluntarily Provided by You
When you submit a project inquiry, request a quote, book a discovery call, or subscribe to tech briefings: Full Name, Corporate Email Address, Phone Number (including WhatsApp if provided), Company Name, Job Title, Project Budget, Technical Architecture Requirements, and RFP documentation.
B. Client Engagement & Project Technical Artifacts
Under mutual non-disclosure agreements: Git repository URLs, staging database configurations, API credentials, product wireframes, and design schemas required to execute software deliverables.
C. Technical Telemetry & Automated Data
IP address (cryptographically salted for security rate-limiting), browser version, operating system, referral URL, time stamp, and aggregate performance telemetry to detect and prevent DDoS and malicious automated bot traffic.
D. Job Applicant & Recruitment Data
Resumes, LinkedIn and GitHub profile URLs, work experience, portfolio submissions, and code test evaluations submitted through our Careers portal.
3. Legal Grounds & Purposes of Processing
We process your data exclusively under valid legal grounds under applicable law:
To review inquiries, provide project estimates, execute Statements of Work (SOWs), and deliver software contracts.
Where you explicitly consent to receive engineering insights, product demos, or technical updates.
To maintain API security, investigate fraudulent inquiries, optimize site performance, and protect corporate assets.
To comply with taxation, corporate filing mandates, and lawful orders issued under Indian jurisdiction.
4. AI & Source Code Confidentiality Guarantee
Our City Nirman takes an unequivocal, uncompromising stance on Artificial Intelligence training and code privacy:
5. Technical Safeguards & Cloud Security
We employ comprehensive technical and organizational measures (TOMs) aligned with ISO 27001 principles:
- Encryption Standards: Data in transit is enforced via TLS 1.3 with HSTS headers. Persistent client records are encrypted at rest using AES-256 algorithms.
- Access Segregation: Strict Role-Based Access Control (RBAC) and hardware Multi-Factor Authentication (MFA) govern developer access to internal infrastructure.
- Automated Vulnerability Audits: Continuous dependency scanning (OWASP compliance) to detect and remediate package vulnerabilities before deployment.
- Environment Isolation: Staging, quality assurance, and production environments are strictly air-gapped on distinct virtual private clouds (VPCs).
7. Sub-Processors & International Data Transfers
We do not sell personal data to data brokers or third parties. We share data only with trusted sub-processors under rigorous Data Processing Agreements (DPAs):
Encrypted cloud database hosting with dedicated IP whitelisting.
Enterprise compute, object storage, and secure serverless hosting.
Optimized media asset transformation and global CDN delivery.
Direct automated dispatch of project inquiry confirmations.
For international clients located in the United States, United Kingdom, European Union, UAE, Canada, and Australia, cross-border data transfers are safeguarded through Standard Contractual Clauses (SCCs) and DPDP Act compliance.
8. Data Retention & Secure Purging
We retain personal data only for as long as necessary to fulfill the purposes outlined:
- Prospective Inquiries: Non-converting project inquiries are automatically purged after 24 months.
- Client Contract Records: Invoices, milestone completions, and signed SOWs are retained for 7 years to satisfy statutory audit and taxation laws under Indian Companies Act.
- Development Repositories: Staging environments and temporary sandbox access are permanently deleted within 60 days following final project acceptance and warranty completion.
9. Your Legal Rights (DPDP Act & GDPR)
Under India's Digital Personal Data Protection Act, 2023, and global standards (such as GDPR), you hold specific enforceable rights as a Data Principal:
Request a clear summary of all personal data held and processing activities conducted.
Rectify incomplete, inaccurate, or outdated personal information promptly.
Request complete deletion of personal data where retention is no longer statutory.
Withdraw consent for marketing communications or optional processing at any time.
Nominate an individual to exercise rights on your behalf in the event of death or incapacity.
Direct access to our designated Grievance Officer before escalating to the Data Protection Board of India.
To exercise any of these rights, email ourcitynirman@gmail.com with the subject line “DPDP Data Principal Request”. We will respond within thirty (30) business days.
10. Protection of Minors
Our services, SaaS platforms, and enterprise solutions are strictly intended for business enterprises, commercial partners, and adults aged 18 and older. We do not knowingly solicit or collect personal data from individuals under the age of 18 without verifiable parental/guardian consent as stipulated under Section 9 of the DPDP Act.
11. Statutory Grievance Redressal & Contact Information
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, the contact details of our designated Grievance Redressal Officer are published below:
12. Policy Revisions & Governance
We review this Privacy Policy periodically to reflect changes in our technology ecosystem, legal statutes, and international data protection standards. Material updates will be published on this URL with a revised effective date. Continued engagement with our services following publication constitutes acceptance of updated practices.