The Plain-Language Summary
The only personal data Xolro actively collects is what you type into our contact form, and we use it for exactly one thing: replying to you. We keep no user database and no accounts. You can ask us at any time what we hold about you, ask us to correct it, or ask us to delete it — and we will.
1. Who We Are (Data Fiduciary)
Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the organisation that decides why and how your personal data is processed is called the Data Fiduciary. For the website xolro.com and the enquiries it receives, that is Xolro.
You are the Data Principal — the person the data is about. You can reach us about anything on this page at support@xolro.com.
2. Scope of This Notice
This notice covers digital personal data that Xolro processes in connection with this website and the enquiries sent to us through it. It applies to personal data processed within India, and to data collected in connection with offering our services to Data Principals located in India.
Where this notice and our general Privacy Policy both apply, this notice governs the DPDP-specific rights and obligations described below.
3. What We Collect, and Why
Section 5 of the DPDP Act requires us to tell you plainly what personal data we process and for what purpose. In full:
| Data | Purpose | Basis |
|---|---|---|
| Name, email address, enquiry topic, company name (optional) and your message — submitted through our Contact form | To read your enquiry and reply to it, and to carry on the resulting conversation about a project, product or partnership. | Your consent |
| Standard server logs — IP address, browser user agent, timestamp and requested URL | Generated automatically by our hosting provider to keep the site available and to mitigate abuse and denial-of-service attacks. | Legitimate use — security and service integrity |
| Aggregated, cookieless page-view analytics | To understand which pages are read. Not tied to an identifiable individual and not used to profile or track you across sites. | Legitimate use — service improvement |
Your light/dark theme choice (xolro-theme) | Stored in your own browser so the site remembers your display preference. It never leaves your device and never reaches us. | Not personal data |
We do not operate user accounts, we do not maintain a customer database, and we do not collect financial, biometric, health or government identification data through this website.
4. What Happens to a Contact Form Submission
We think you should know the actual route your message takes, not a summary of it:
- You submit the form. Your browser sends the fields to an endpoint on our own site over an encrypted (HTTPS) connection.
- That endpoint composes an email and hands it to our mail provider, which delivers it to the Xolro support mailbox. The submission is not written to any website database.
- Your message then lives in that mailbox, like any email you would have sent us directly, until it is deleted under our retention practice below.
- If that delivery fails, the form falls back to opening a draft in your own email client, so nothing is silently lost. In that case the message goes nowhere until you press send yourself.
5. Consent, and Withdrawing It
Under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the stated purpose. When you fill in and submit our contact form having read this notice, you are consenting to us using those details to reply to you — and to nothing else.
You may withdraw that consent at any time, as easily as you gave it, by emailing support@xolro.com. Withdrawal does not make our earlier processing unlawful, but we will stop processing your data going forward and erase it unless we are required by law to retain it.
We do not add you to marketing lists or newsletters on the strength of a contact enquiry. That would be a different purpose, and it would need its own consent.
6. Your Rights as a Data Principal
Chapter III of the DPDP Act gives you the following rights, and we honour all of them:
- Right to access information. Ask us for a summary of the personal data we hold about you, what we are doing with it, and who we have shared it with.
- Right to correction and erasure. Ask us to correct inaccurate or misleading data, complete incomplete data, update it, or erase it altogether.
- Right of grievance redressal. Raise a complaint with us about how we have handled your data or your request, and receive a response.
- Right to nominate. Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
7. How to Exercise Your Rights
Email support@xolro.com with the subject line "DPDP Request". To help us find your data, please tell us which right you are exercising and include the email address you originally wrote to us from.
We aim to acknowledge every request within 7 working days and to resolve it within 30 days. There is no fee. We may ask you a question to confirm you are the person the data is about, but only to the extent needed to avoid disclosing your data to someone else.
8. Grievance Redressal
If you are unhappy with how we have handled your personal data or your request, write to our grievance contact at support@xolro.com with the subject line "DPDP Grievance". We will respond substantively rather than with an acknowledgement alone.
Escalating beyond us. If your grievance remains unresolved after you have raised it with us, the DPDP Act entitles you to complain to the Data Protection Board of India. Exhausting our own redressal process first is a precondition, which is why we would rather hear from you directly at the outset.
9. Retention and Erasure
Because there is no website database behind this site, the only thing to retain is the email correspondence itself. We keep it while the conversation is live and for as long as it remains relevant to an ongoing or prospective engagement.
Once the purpose you gave the data for is no longer being served — the enquiry went nowhere, or the work concluded — and we are under no legal obligation to keep it, we erase it. You never have to wait for that: ask us to delete your correspondence and we will do it.
10. Security Safeguards
Section 8(5) of the DPDP Act requires reasonable security safeguards to prevent a personal data breach. Ours are:
- Encryption in transit. The entire site is served over HTTPS/TLS with HTTP Strict Transport Security enabled, including the form submission itself.
- Collecting as little as possible. The strongest protection against a breach is not holding the data — we run no user accounts and no customer database.
- Mailbox access is restricted to Xolro personnel who need it to answer you, and is protected by a dedicated application credential rather than a shared password.
- Submitted values are escaped and sanitised before being placed into an email, so a submission cannot inject content or forge mail headers.
11. Personal Data Breach
In the event of a personal data breach, Section 8(6) of the DPDP Act requires us to inform the Data Protection Board of India and each affected Data Principal. We will do so, in the manner and within the timelines prescribed, and our notice to you will describe what happened, what data was involved and what you can do about it.
12. Service Providers We Rely On
We engage a small number of Data Processors to run this website. They act on our instructions, under contract, and only for the purposes described here:
- A cloud hosting and CDN provider — serves the website and generates the standard access logs described in Section 3.
- A business email provider — delivers and stores the enquiries you send us.
Engaging a processor does not transfer our responsibility. Under the DPDP Act, Xolro remains accountable to you for personal data processed on our behalf. We do not sell, rent or trade personal data, and we do not share it with advertising networks or data brokers.
13. Transfer of Data Outside India
Our providers operate globally, so personal data may be processed on infrastructure located outside India. Section 16 of the DPDP Act permits such transfers except to territories the Central Government restricts by notification. We do not transfer personal data to any restricted territory, and we will update this notice if that position changes.
14. Children and Persons with Disabilities
Under the DPDP Act a child is anyone under 18. Processing a child's personal data requires verifiable consent from a parent or lawful guardian, and the Act prohibits tracking, behavioural monitoring and targeted advertising directed at children.
Xolro's website and enquiry form are intended for a business and technical audience, and are not directed at children. We do not knowingly collect a child's personal data, we run no behavioural tracking or targeted advertising of any kind, and if we learn that a child's data has reached us without the required consent we will erase it. The same requirement for a lawful guardian's consent applies to a person with a disability who has a lawfully appointed guardian.
15. Your Duties Under the Act
Section 15 places a few duties on Data Principals as well: do not impersonate another person when providing your details, do not suppress material information when it is legally required, do not register a false or frivolous grievance, and provide only authentic information when exercising your right to correction.
16. Language and Availability
This notice is published in English. The DPDP Act entitles you to receive it in English or in any language listed in the Eighth Schedule to the Constitution of India. Write to us and we will provide it in your preferred Eighth Schedule language.
17. Changes to This Notice
We will update this notice as our products launch, as our processing changes, or as the rules made under the DPDP Act are brought into force in phases. The revision date at the top of this page always reflects the current version.
18. Contact
For any question about this notice, to exercise a right, or to raise a grievance, email support@xolro.com or use our Contact page.
See also our Privacy Policy and Terms of Use.