Data Protection & Confidentiality Policy

This policy covers information that clients and their customers share with FebTech while we build, host or support a project: business plans, source material, customer and order data, credentials and access details. It sits beside our Privacy Policy, which covers visitors to this website.

For a client's customer data, the client decides why and how it is collected and used, and FebTech processes it on the client's instructions, only to deliver the agreed service. For its own website visitors and enquiries, FebTech decides. We follow India's Digital Personal Data Protection Act, 2023 and the rules made under it, as they apply to us.

• We treat everything you share as confidential and use it only for your project.
• Only staff who need it for the project can see it, and all staff and interns are bound by written confidentiality obligations.
• We do not share your information with others except subcontractors and service providers who need it to deliver your project and who are bound by similar duties, or where the law or a court order requires it.
• Confidentiality does not cover information that is already public, that you have published, or that we already held or received lawfully from someone else.

• Access to client systems uses individual accounts, strong unique passwords and, where the service supports it, two-step verification.
• Client credentials are shared with us through a secure channel and are not stored in chat history, emails or code repositories.
• Customer data is not copied to personal devices or used for testing outside the project.
• Software and servers we manage are kept updated, and admin panels and configuration files are kept out of public access.
• Staff access is removed when a person leaves the team or the project ends.

Project data is held on the hosting you choose or on our hosting provider's servers. Where a third-party service is needed, such as payment gateways, email, analytics or WhatsApp providers, the data they receive is covered by their own terms. We tell you which services a project uses.

If we become aware of a security incident that affects your data, we will tell you without undue delay and, where possible, within 72 hours of confirming it. We will explain what happened, what data is involved and what we are doing about it, and help you with any notice you have to give to affected people or authorities.

When a project ends, or on your written request, we return your data in a standard format and delete our copies within 60 days, except what the law requires us to keep, such as invoices and tax records, and routine backups that expire on their normal cycle.

Give us only the data a project needs. Tell us if it includes sensitive data, such as health, financial or children's information, so we can agree extra safeguards. You are responsible for having the right to collect and share the data you give us and for the privacy notice shown to your own users.

To exercise your rights, report a concern or ask about how data is handled, write to info@febtech.in. We respond within 30 days.