Privacy Policy
What we collect, why, how long we keep it, and the rights you have over it. Written to cover Indian, European and Californian law because our clients sit in all three.
Last updated
Who we are
Orus Studio (trading as Orus Studio) is Sole Proprietorship, with its registered office at 1st, Flat-1b, A/P-2/1b C. I. T. Scheme No. Mii Block B, Kolkata, West Bengal, India, 700015. In this policy "we", "us" and "our" mean that entity.
For questions about this policy or how we handle your data, contact hello@orus-studio.com. For formal complaints, see the Grievance Redressal section below.
Scope
This policy covers personal data we collect through this website and through our sales and support communications — that is, data where we decide the purposes and means of processing (we are the Data Fiduciary under the DPDP Act, or Controller under GDPR).
It does not cover data you put into software we build or host for you. There we act on your instructions as a Data Processor, and the terms are set out in our Data Processing Addendum rather than here.
What we collect and why
We do not collect special category data, we do not knowingly collect data about children, and we do not ask for payment card details on this website.
| Data | Why we hold it | Lawful basis | Retention |
|---|---|---|---|
| Name, email, company, phone | To respond to your enquiry and discuss a possible engagement | Contract / legitimate interests; consent where required | 36 months from last contact |
| Your message, the service you are interested in, and any optional ERP details (users, industry, modules) | To scope a realistic response and route the enquiry correctly | Contract / legitimate interests | 36 months from last contact |
| Page you enquired from and campaign parameters | To understand which content generates useful enquiries | Legitimate interests | 36 months |
| Analytics and session recording data | To understand how the site is used and improve it | Legitimate interests; you can opt out at any time | 14 months (GA4); 30 days (session replay) |
| Correspondence with you | To maintain a record of what was agreed | Contract / legal obligation | 8 years where it relates to a contract |
What we do not do
- We do not sell personal data. We have never done so and have no mechanism to.
- We do not share your enquiry with third parties for their own marketing.
- When we advertise on Google, a Google Ads conversion measurement may record that an enquiry came from an ad. We do not sell your data.
- We do not add you to a marketing list because you sent an enquiry. Any marketing email requires separate opt-in.
Cookies and tracking
We use Google Analytics 4 and Microsoft Clarity to understand how visitors use this site: which pages are read, where people click and scroll, and where they leave. Clarity records sessions with what you type into forms masked, and we do not use these tools to identify you.
You can turn analytics and session recording off for your browser at any time with 'Opt out of analytics' in the footer. Our Cookie Policy lists every cookie and how long it lasts.
Who we share data with
We use a small number of processors, each under a written agreement restricting them to our instructions:
| Processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosts this website and stores enquiry records | Australia |
| Zoho Mail | Delivers enquiry notification and confirmation email | India |
| Google (Analytics, Tag Manager, Ads) | Website analytics and ad conversion measurement | US / global |
| Microsoft (Clarity) | Session recording and heatmaps, form inputs masked | US |
| Cal.com | Scheduling, only if you open the calendar | EU / US |
- We may disclose data where legally compelled — a court order, a lawful request from an authority, or to establish or defend a legal claim.
- If our business is sold or merged, data may transfer to the acquirer under the same protections.
International transfers
We operate from India. Personal data you provide will be processed in India and may be processed by the providers listed above in the EU, UK or US.
For transfers out of the EEA or UK we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with the supplementary measures our providers publish.
Under the DPDP Act, transfers out of India are permitted except to territories the Central Government restricts. We monitor that list and will update this policy if it affects us.
We have not appointed an Article 27 representative in the EU. If you require one for a specific engagement, tell us and we will address it in the contract.
Your rights
Whatever your location, you can ask us to give you a copy of your data, correct it, delete it, or stop using it. We will not charge you and we will not treat you differently for asking.
- Under the DPDP Act 2023 (India): access, correction, erasure, nomination, and grievance redressal.
- Under GDPR (EEA/UK): access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions. You may also complain to your supervisory authority.
- Under the CCPA/CPRA (California): to know, delete, correct, and to opt out of sale or sharing — we do neither.
- To exercise any right, email hello@orus-studio.com. We respond within 30 days, and within 15 days for DPDP grievances.
Security
Data is encrypted in transit and at rest. Access is limited to people who need it for their work, logged, and removed when they leave a project.
We will notify affected individuals and the relevant authority of a personal data breach without undue delay where the law requires it, including within 72 hours to a GDPR supervisory authority.
No system is perfectly secure. We do not claim ours is, and this policy does not warrant that transmission over the internet is free of risk.
Grievance redressal
As required by the Information Technology Rules 2021 and the DPDP Act 2023, our Grievance Officer is Nikhil Chopra, contactable at hello@orus-studio.com.
We acknowledge grievances within 24 hours and resolve them within 15 days. If you remain dissatisfied, you may approach the Data Protection Board of India.
Changes
We update this policy when our processing changes. The date at the top reflects the last substantive change. Where a change materially affects your rights, we will ask for fresh consent rather than rely on the old one.