Privacy Policy & Data Protection Notice

1. Who we are and what this policy covers

This website, homesunder2cr.in (the “Site”), is operated by Siya Ram Realty Ventures, a real-estate enquiry and advisory business based in Gurugram, Haryana, India (“we”, “us”, “our”).

For the purposes of India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”), we are the Data Fiduciary: we decide why and how your personal data is processed. You are the Data Principal.

We also comply with the Information Technology Act, 2000 (“IT Act”), including section 43A, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), which require every organisation that handles personal information to publish a privacy policy and to appoint a grievance officer. This page is that policy.

This policy covers personal data we collect:

• through this Site, including the “Get Best Price” form and the pop-up;
• when you call or WhatsApp the numbers published on the Site;
• when you give us your details at a site visit, exhibition or property event;
• when you interact with an advertisement or link we run that points to this Site.

It does not govern what a developer, builder, bank, housing-finance company or other third party does with your data once you deal with them directly. Their own privacy notices apply to that.

Not a fiduciary in the investment sense. We are a property enquiry and advisory service. Nothing on the Site is an offer, allotment or contract for sale, and our handling of your data does not create any agency, brokerage or fiduciary relationship beyond what the DPDP Act itself says.

2. Your consent notice — itemised (DPDP Act, section 5)

Section 5 of the DPDP Act, read with Rule 3 of the DPDP Rules, requires us to give you a notice in clear and plain language, before or at the time we ask for your consent. The notice must stand on its own, list each item of personal data and the purpose for it, and tell you how to exercise your rights, withdraw consent and complain. This section is that notice. The rest of this page explains it in more detail.

What consent means here

Your consent is taken by a clear, positive action: you tick the box in the form yourself and press the submit button. The box is never pre-ticked, and ticking it is not a condition of browsing the Site. Consent is free, specific, informed, unconditional and unambiguous for the purposes listed above only. It does not cover anything else, and it is not bundled with any other permission.

Withdrawing consent

You may withdraw consent at any time. Withdrawal is as easy as giving consent: call or WhatsApp either number in section 18, or write to our grievance officer, and say you want to stop. We act on it within 7 days and confirm in writing. We may keep a minimal suppression record (your number and the fact you opted out) so that we do not contact you again by mistake. Withdrawal does not affect processing already carried out, or processing we must do to comply with law.

Other languages

Under section 5(3) of the DPDP Act, you may ask to read this notice in any language listed in the Eighth Schedule to the Constitution. If you would prefer Hindi or another language, call us and we will provide it free of charge.

3. Personal data we collect

In practice, the categories are:

• Details you type into the form: your name, mobile number, optional email address, and the tick of the consent box.
• Technical data attached to a submission: the page or advertisement you came from (campaign tags such as utm_source, utm_medium, utm_campaign), the time of submission, and the IP address seen by our server. We use the IP address for rate-limiting and abuse prevention only.
• Communications: the contents of calls, WhatsApp messages or emails you send us, and notes our team makes about your requirement (budget range, preferred sector, timing) so that you do not have to repeat yourself.
• Site usage data: standard server logs kept by our hosting provider (Vercel) — request path, timestamp, browser and device type, approximate location derived from IP. These are used for security and performance.

We collect this data directly from you, or automatically when your browser loads the Site. We do not buy contact lists, and we do not enrich your data from brokers or data aggregators.

4. What we do not collect

To be explicit, this Site does not ask for, and we do not want:

• Aadhaar, PAN, passport, voter ID or any other government identifier;
• bank account, card, UPI, IFSC or payment details — we never take payments through this Site;
• salary slips, ITRs, credit scores or loan files (if a home-loan introduction is needed later, that happens separately, with the lender and only with your separate consent);
• biometric data, health data, caste, religion, sexual orientation, or any other sensitive personal data or information as defined in the SPDI Rules;
• data from children under 18;
• your contacts, photos, SMS inbox, call logs or precise GPS location.

If anyone claiming to represent us asks for such information over the phone before you have signed anything, treat it as a red flag, stop, and call us on the numbers below to check.

5. Why we process your data and on what legal basis

Under the DPDP Act we must have a lawful basis for every processing activity. Ours are your consent (sections 4 and 6) and, in a few narrow cases, certain legitimate uses (section 7). Specifically:

1. To respond to your enquiry. Calling or messaging you back about the homes you asked about — the reason you gave us your number.
2. To shortlist and arrange site visits. Matching your stated requirement with available inventory and coordinating a visit.
3. To follow up. A reasonable number of attempts to reach you about your enquiry (normally up to three calls or messages over a few weeks), and no more marketing once you tell us to stop.
4. To keep records. Maintaining the evidence of your consent and of the enquiry itself, which is necessary to answer a complaint or a regulator's question.
5. For security. Detecting spam, bots and abuse, and protecting the Site and our systems.
6. To comply with law. Responding to a lawful request from a court, the police, a regulator such as HRERA, or a statutory authority, where the law requires it (a legitimate use under section 7 of the DPDP Act, so no separate consent is needed for that).

We do not make automated decisions about you, do not profile you for credit, and do not use your data to train any model. If that ever changes, this policy will be updated and we will ask you first.

6. Cookies, local storage and your browser

The Site is deliberately light. It does not run advertising cookies, cross-site trackers, fingerprinting scripts or session-replay tools. It sets no cookie of its own. It does store a few small values in your browser's session storage and local storage so the page behaves sensibly:

These values never leave your device except as part of a form submission you choose to make, and none of them identifies you on any other website. You can clear them at any time from your browser settings; doing so only means the pop-up may reappear.

Third-party requests. The Site loads its fonts (Playfair Display and Inter) from Google Fonts, which means Google receives your IP address and browser details when the page loads. No analytics, advertising pixel or social plug-in is enabled at the date of this version. If we add Meta Pixel, Google Analytics or similar later, this policy will be updated first, the tools will be configured to collect the minimum, and — where the law requires it — your consent will be asked for before they load.

7. Who we share data with

We do not sell, rent or trade your personal data. We do not share it with other brokers for their own marketing. Sharing is limited to the following, and only as much data as each recipient actually needs:

• Hosting and infrastructure: Vercel Inc., which hosts the Site and processes form submissions on our behalf (data centre: United States). Our lead storage holds the enquiry; Vercel acts as our data processor under contract.
• Communication providers: WhatsApp (Meta Platforms) when you message us or when we reply on WhatsApp, and our telecom/mobile service provider for calls. Your use of WhatsApp is also governed by WhatsApp's own privacy policy.
• Internal tools: the CRM, spreadsheet, email or SMS service our small team uses to record and follow up enquiries. Access is restricted to staff who need it.
• Developers, channel partners or promoters — but only when a specific project is relevant to your enquiry and you have agreed that we may introduce you. We share only what is needed for that introduction, and we name the project first.
• Professional advisers (advocates, chartered accountants, auditors) where necessary, under duties of confidentiality.
• Legal and regulatory disclosure: courts, police, HRERA, the Data Protection Board of India or another authority, where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend a legal claim.
• Business transfer: if the business is sold, merged or reorganised, enquiry data may transfer to the successor, which must honour this policy. We will tell you before that happens if we can.

Every processor we use is bound to handle your data only on our instructions and to keep it secure. Where a processor is outside India, see section 8.

8. Storage and cross-border transfers

Our hosting and lead storage are provided by Vercel Inc. and are located in the United States. Some communication tools we use may also process data outside India. This means your personal data may be transferred outside India.

We do so on the basis of your consent, as permitted by section 16 of the DPDP Act and Rule 15 of the DPDP Rules. We do not transfer personal data to any country or territory that the Central Government has restricted by notification, and we will update this section if such a restriction affects us. Where the SPDI Rules apply, your data is transferred only with your consent and only to a recipient that ensures the same level of data protection we apply.

Regardless of where data is stored, we remain responsible for it and will handle any request or complaint you make in the same way.

9. How long we keep data, and when we delete it

We may keep data longer where the law requires it, where it is needed for a live dispute or legal claim, or where a court or regulator has directed retention. We do not keep data merely because storage is cheap: when the purpose is served, the record goes.

You can ask us to erase your data earlier — see section 11. We will confirm what was deleted, usually within 30 days. Note that erasure may mean we can no longer help with your property search, and we may still hold the fact that you asked us to delete it.

10. How we protect your data

Section 8(4)–(5) of the DPDP Act and Rule 6 of the DPDP Rules require reasonable security safeguards; the SPDI Rules require reasonable security practices and procedures. Our measures include:

• transport encryption (HTTPS) across the whole Site, with security headers set at the host;
• collecting only what is needed — the fewer fields, the smaller the exposure;
• access to enquiry data limited to named team members, protected by individual logins and multi-factor authentication where available;
• rate-limiting and a hidden honeypot field to reduce automated spam and abuse;
• no storage of card, bank or identity-document data on our systems at all;
• periodic review of who has access, and removal of access when someone leaves;
• contractual data-protection obligations on processors that handle data for us.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India within 72 hours of becoming aware of it, as required by Rule 7, and we will inform every affected person without delay, describing what happened, the likely consequences, what we have done, and what you can do to protect yourself.

11. Your rights and how to exercise them

As a Data Principal you have the following rights under the DPDP Act. They are free to exercise, and we will not treat a request as a reason to stop serving you.

How we verify. We may ask you to confirm the mobile number we hold, or to call from it, before we act — this protects you from someone else erasing or reading your record. We do not ask for ID documents to answer a data request unless there is a genuine doubt about identity.

How long we take. We acknowledge a request within 7 days and respond within 30 days, which is also the outer limit under the SPDI Rules for grievance resolution. If a request is complex we will tell you why and give a date.

Where we may refuse. We may decline a request that is manifestly unfounded, excessive or repetitive, or that would require us to delete data we must keep by law or for a live legal claim. If we refuse, we explain the reason and how you can escalate.

12. Calls, WhatsApp and opting out

We contact people who have asked us to. When you tick the consent box, you are asking us to call or WhatsApp you about homes in Gurugram. That is the only reason we use your number.

• We normally call between 9:00 am and 9:00 pm unless you ask us to call at another time.
• We do not make promotional calls or send promotional messages to numbers that have not consented, and we do not use automated diallers or pre-recorded calls.
• If you are registered on the TRAI Do Not Disturb list, tell us and we will not make promotional calls to you. Enquiry calls you have asked for, or calls needed to complete a transaction you started, are not promotional calls under the Telecom Commercial Communications Customer Preference Regulations, 2018.
• To stop, just say so on the call or reply STOP on WhatsApp. We add you to our internal do-not-contact list within 7 days. You do not need to give a reason.

13. Children and minors

The Site is intended for adults looking for property. We do not knowingly collect personal data of children under 18, and we do not direct any marketing at children. If we learn that we hold a child's data, we will delete it. If you believe a child has submitted details to us, contact the grievance officer and we will remove the record.

14. Other websites, developers and brochures

The Site may link to developer websites, map locations, loan calculators or WhatsApp. Once you leave our Site, the destination's own privacy policy applies; we are not responsible for how a third party handles your data.

Photographs on the Site are representative images of interiors, not pictures of a specific flat you will be shown, and any prices or availability discussed with you are indicative until confirmed in writing. Project-specific details, carpet areas, approvals and the project's RERA registration number are provided by the developer and should be verified by you independently on the Haryana Real Estate Regulatory Authority's website before you pay anything. We are not the promoter of any project.

15. Changes to this policy

We review this policy at least once a year and whenever our practices, tools or the law change. The version number and “last updated” date at the top of this page always tell you which version you are reading.

If a change materially affects how we use your data, we will give you a fresh notice before we start that new processing — and where the DPDP Act requires consent, we will ask for it again. We will not apply a new purpose to data you gave us for an old one without your agreement.

16. Grievances and complaints

Step 1 — tell us first

In line with section 13 of the DPDP Act and Rule 9 of the DPDP Rules, we have appointed a grievance officer who is answerable for data protection questions and complaints:

Please include your name, the mobile number you used, what happened, and what you want us to do. We acknowledge within 7 days and aim to resolve within 30 days. If we need more time, we will say why and when you can expect an answer.

Step 2 — the Data Protection Board of India

If we have not resolved your grievance within 30 days, or you are not satisfied with the outcome, you may complain to the Data Protection Board of India under section 13(2) of the DPDP Act, in the manner prescribed by the DPDP Rules. Complaints are filed through the Board's official portal; the current link is published by the Ministry of Electronics and Information Technology at meity.gov.in.

Other remedies

Nothing here takes away any other remedy you have — including a complaint to the Haryana Real Estate Regulatory Authority about a registered project, a consumer complaint, or proceedings before any court of competent jurisdiction.

17. Governing law and jurisdiction

This policy and our handling of your personal data are governed by the laws of India, including the DPDP Act, the DPDP Rules, the IT Act and the SPDI Rules. The courts at Gurugram, Haryana have exclusive jurisdiction over any dispute arising out of this policy, without prejudice to any statutory forum that has jurisdiction over your complaint.

18. How to contact us

For anything to do with your personal data — and for ordinary enquiries — reach us at:

This policy is published in English. You may request it, or the section 5 notice above, in any language listed in the Eighth Schedule to the Constitution of India.