Privacy Policy
What we collect, why, how long we keep it, and the rights you have over it. Written to cover Indian, European and Californian law because our clients sit in all three.
Last updated
Who we are
Orus Studio (trading as Orus Studio) is Sole Proprietorship, with its registered office at 1st, Flat-1b, A/P-2/1b C. I. T. Scheme No. Mii Block B, Kolkata,West Bengal, India, 700015. In this policy "we", "us" and "our" mean that entity.
For questions about this policy or how we handle your data, contact hello@orus-studio.com. For formal complaints, see the Grievance Redressal section below.
Scope
This policy covers personal data we collect through this website and through our sales and support communications — that is, data where we decide the purposes and means of processing (we are the Data Fiduciary under the DPDP Act, or Controller under GDPR).
It does not cover data you put into software we build or host for you. There we act on your instructions as a Data Processor, and the terms are set out in our Data Processing Addendum rather than here.
What we collect and why
We do not collect special category data, we do not knowingly collect data about children, and we do not ask for payment card details on this website.
| Data | Why we hold it | Lawful basis | Retention |
|---|---|---|---|
| Name, work email, company, phone | To respond to your enquiry and discuss a possible engagement | Contract / legitimate interests; consent where required | 36 months from last contact |
| Your message, budget band and timeline | To scope a realistic response and route the enquiry correctly | Contract / legitimate interests | 36 months from last contact |
| Page you enquired from and campaign parameters | To understand which content generates useful enquiries | Legitimate interests | 36 months |
| IP-derived country | To apply the right cookie-consent rules for your region | Legitimate interests | Not stored beyond the session cookie |
| Analytics and session replay data | To improve the site | Consent | 14 months (GA4); 30 days (session replay) |
| Correspondence with you | To maintain a record of what was agreed | Contract / legal obligation | 8 years where it relates to a contract |
What we do not do
- We do not sell personal data. We have never done so and have no mechanism to.
- We do not share your enquiry with third parties for their own marketing.
- We do not run advertising or cross-site tracking pixels on this site.
- We do not add you to a marketing list because you sent an enquiry. Any marketing email requires separate opt-in.
Cookies and tracking
Strictly necessary cookies store your consent choices. They carry no identifier and cannot be used to track you.
Analytics and session replay load only after you consent. Visitors in the EEA, UK and Switzerland are asked for opt-in consent before anything non-essential runs; elsewhere we present the same choices and honour your decision.
You can change or withdraw consent at any time from the link in the footer, and withdrawal is as easy as giving it.
Who we share data with
We use a small number of processors, each under a written agreement restricting them to our instructions:
| Processor | Purpose | Location |
|---|---|---|
| Sanity | Stores website content and enquiry records | EU / US |
| Resend | Delivers enquiry notification email | US |
| Google (Analytics, Tag Manager) | Website analytics, only with consent | US / global |
| Microsoft (Clarity) | Session replay, only with consent | US |
| Cal.com | Scheduling, only if you open the calendar | EU / US |
| Hosting and CDN provider | Serving this website | Global edge network |
- We may disclose data where legally compelled — a court order, a lawful request from an authority, or to establish or defend a legal claim.
- If our business is sold or merged, data may transfer to the acquirer under the same protections.
International transfers
We operate from India. Personal data you provide will be processed in India and may be processed by the providers listed above in the EU, UK or US.
For transfers out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with the supplementary measures our providers publish.
Under the DPDP Act, transfers out of India are permitted except to territories the Central Government restricts. We monitor that list and will update this policy if it affects us.
We have not appointed an Article 27 representative in the EU. If you require one for a specific engagement, tell us and we will address it in the contract.
Your rights
Whatever your location, you can ask us to give you a copy of your data, correct it, delete it, or stop using it. We will not charge you and we will not treat you differently for asking.
- Under the DPDP Act 2023 (India): access, correction, erasure, nomination, and grievance redressal.
- Under GDPR (EEA/UK): access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions. You may also complain to your supervisory authority.
- Under the CCPA/CPRA (California): to know, delete, correct, and to opt out of sale or sharing — we do neither.
- To exercise any right, email hello@orus-studio.com. We respond within 30 days, and within 15 days for DPDP grievances.
Security
Data is encrypted in transit and at rest. Access is limited to people who need it for their work, logged, and removed when they leave a project.
We will notify affected individuals and the relevant authority of a personal data breach without undue delay where the law requires it, including within 72 hours to a GDPR supervisory authority.
No system is perfectly secure. We do not claim ours is, and this policy does not warrant that transmission over the internet is free of risk.
Grievance redressal
As required by the Information Technology Rules 2021 and the DPDP Act 2023, our Grievance Officer is Nikhil Chopra, contactable at hello@orus-studio.com.
We acknowledge grievances within 24 hours and resolve them within 15 days. If you remain dissatisfied, you may approach the Data Protection Board of India.
Changes
We update this policy when our processing changes. The date at the top reflects the last substantive change. Where a change materially affects your rights, we will ask for fresh consent rather than rely on the old one.