We use browser storage, strictly for the Functional category, only if you opt in — to let our AI Pilot chat widget remember your conversation. Nothing else runs until you choose. See our Cookie Policy.
Legal
Data Protection Notice
What personal data we collect, why, and how to exercise your rights — the standalone notice required by Rule 3 of the DPDP Rules, 2025.
Effective Date: 25 October 2026Last Updated: 25 October 2026Version: 1.0
EntityWaves Web Studio — Sole Proprietorship
ProprietorTarun Valluri
GSTIN36BYQPT2686E1ZR
Udyam Registration No.UDYAM-TS-20-0221187
Registered AddressPlot no. 19, Venkatramana Colony Phase-1 Dammaiguda, Hyderabad, Telangana - 500083, India
Websitehttps://www.waveswebstudio.in
Grievance OfficerTarun Valluri, Proprietor
Grievance / Data Protection Contactprivacy@waveswebstudio.in · How to file a grievance
Who We Are
Waves Web Studio is a sole proprietorship owned by Tarun Valluri, registered for GST (GSTIN 36BYQPT2686E1ZR) and as a micro enterprise under Udyam (UDYAM-TS-20-0221187), with its registered address at Plot no. 19, Venkatramana Colony Phase-1 Dammaiguda, Hyderabad, Telangana - 500083, India and website https://www.waveswebstudio.in. For the personal data described on this page, Waves Web Studio is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 — the entity that decides why and how your personal data is processed. We are applying this framework ahead of its statutory commencement date. The DPDP Rules, 2025 were notified on 13 November 2025; most substantive obligations, including the ones this notice describes, formally commence on 13 May 2027. We have chosen to apply them now, as current practice, rather than wait for that date.
What This Notice Covers
This notice stands on its own: you do not need to read any other document to understand what we collect, why, and what rights you have. Our Privacy Policy covers the same ground in more detail and adds context about hosting, security, and third parties — but nothing in that policy changes what is written here.
The Personal Data We Collect, And Why
The table below lists every field we collect, by name — not by a broad category — together with the specific purpose it serves, what that provides or enables for you personally, the legal basis we rely on, and how long we keep it.
Itemised Data Table
| Personal Data Item | Specific Purpose | What This Provides Or Enables You | Legal Basis | Retention |
|---|---|---|---|---|
| Full name (Inquiry form, scheduling form) | To identify you and address our reply to you personally. | You receive a reply addressed to you, not a form letter. | Consent — Section 6, DPDP Act, 2023 | 24 months from your last contact with us, or until you withdraw consent, whichever is earlier. |
| Email address (Inquiry form, scheduling form) | To send you a written response and a scoped, fixed-price proposal. | You receive a quotation without having to call. | Consent — Section 6, DPDP Act, 2023 | 24 months from your last contact with us, or until you withdraw consent, whichever is earlier. |
| Phone number (optional) (Inquiry form, scheduling form) | To call or message you where you've indicated you'd prefer that to email. | You can be reached faster for time-sensitive discussion. | Consent — Section 6, DPDP Act, 2023 | 24 months from your last contact with us, or until you withdraw consent, whichever is earlier. |
| Company name (optional) (Scheduling form) | To understand the organisation behind the inquiry and tailor our proposal to it. | Your proposal reflects your actual business context. | Consent — Section 6, DPDP Act, 2023 | 24 months from your last contact with us, or until you withdraw consent, whichever is earlier. |
| Selected service (Inquiry form, scheduling form) | To route your inquiry to the right scoping process. | A faster, more relevant first response. | Consent — Section 6, DPDP Act, 2023 | 24 months from your last contact with us, or until you withdraw consent, whichever is earlier. |
| Project description (free text) (Inquiry form, scheduling form) | To scope the work before quoting. | An accurate, fixed-price quotation instead of a guess — and if we go ahead, this becomes the starting point for your project record. | Consent — Section 6, DPDP Act, 2023 | 24 months from your last contact with us; if an engagement results, retained for the duration of the engagement plus the statutory periods described in our Privacy Policy. |
| Preferred call date and time (Scheduling form) | To book and confirm your discovery call. | A confirmed calendar slot and a video-call link by email. | Consent — Section 6, DPDP Act, 2023 | 24 months from your last contact with us, or until you withdraw consent, whichever is earlier. |
| Budget range (optional) (Scheduling form) | To scope a proposal that fits within your stated range. | A proposal that fits your budget instead of a mismatched one. | Consent — Section 6, DPDP Act, 2023 | 24 months from your last contact with us, or until you withdraw consent, whichever is earlier. |
| Chat messages you send the AI Pilot widget (AI Pilot chat widget (only if you choose to use it)) | To generate a relevant automated reply, and to let our team follow up on the conversation afterwards. | An immediate answer outside business hours, and a human follow-up if one is needed. | Consent — Section 6, DPDP Act, 2023 (given by opting into Functional cookies and using the widget) | 12 months from the date of the conversation. |
| Marketing opt-in choice (if given) (Inquiry form, scheduling form — a separate, optional checkbox) | To send you occasional updates about our work and availability, only if you have separately ticked this box. | You hear from us for this purpose only if you actually want to. | Consent — Section 6, DPDP Act, 2023 (specific and separate from the inquiry itself) | Until you withdraw consent. |
| IP address, browser/device (user agent), referring page, timestamp (Automatically, via server and form-submission logs) | To operate, secure, and troubleshoot the website, and to detect abuse of our forms. | A working, secure website and spam-free inquiries. | Legitimate use — Section 7(a), DPDP Act, 2023 (data voluntarily provided by visiting or using the website for its specified purpose, where you have not indicated otherwise) | Minimum of 12 months (DPDP Rules, 2025, Rule 8); security-relevant logs are additionally retained for at least 180 days within India, per the CERT-In Directions, 2022. |
| Record of your consent (timestamp, policy version, consent text shown, checkbox states) (Captured automatically when you submit a form) | To demonstrate, if ever required, that you gave informed, specific consent. | Proof of consent sits with us, not you — you don't have to keep anything. | Necessary record-keeping to meet our accountability obligations as Data Fiduciary under Section 6, DPDP Act, 2023 | 3 years from the date of consent, or 3 years from withdrawal, whichever is later. |
Personal Data Item
Full name (Inquiry form, scheduling form)
Specific Purpose
To identify you and address our reply to you personally.
What This Provides Or Enables You
You receive a reply addressed to you, not a form letter.
Legal Basis
Consent — Section 6, DPDP Act, 2023
Retention
24 months from your last contact with us, or until you withdraw consent, whichever is earlier.
Personal Data Item
Email address (Inquiry form, scheduling form)
Specific Purpose
To send you a written response and a scoped, fixed-price proposal.
What This Provides Or Enables You
You receive a quotation without having to call.
Legal Basis
Consent — Section 6, DPDP Act, 2023
Retention
24 months from your last contact with us, or until you withdraw consent, whichever is earlier.
Personal Data Item
Phone number (optional) (Inquiry form, scheduling form)
Specific Purpose
To call or message you where you've indicated you'd prefer that to email.
What This Provides Or Enables You
You can be reached faster for time-sensitive discussion.
Legal Basis
Consent — Section 6, DPDP Act, 2023
Retention
24 months from your last contact with us, or until you withdraw consent, whichever is earlier.
Personal Data Item
Company name (optional) (Scheduling form)
Specific Purpose
To understand the organisation behind the inquiry and tailor our proposal to it.
What This Provides Or Enables You
Your proposal reflects your actual business context.
Legal Basis
Consent — Section 6, DPDP Act, 2023
Retention
24 months from your last contact with us, or until you withdraw consent, whichever is earlier.
Personal Data Item
Selected service (Inquiry form, scheduling form)
Specific Purpose
To route your inquiry to the right scoping process.
What This Provides Or Enables You
A faster, more relevant first response.
Legal Basis
Consent — Section 6, DPDP Act, 2023
Retention
24 months from your last contact with us, or until you withdraw consent, whichever is earlier.
Personal Data Item
Project description (free text) (Inquiry form, scheduling form)
Specific Purpose
To scope the work before quoting.
What This Provides Or Enables You
An accurate, fixed-price quotation instead of a guess — and if we go ahead, this becomes the starting point for your project record.
Legal Basis
Consent — Section 6, DPDP Act, 2023
Retention
24 months from your last contact with us; if an engagement results, retained for the duration of the engagement plus the statutory periods described in our Privacy Policy.
Personal Data Item
Preferred call date and time (Scheduling form)
Specific Purpose
To book and confirm your discovery call.
What This Provides Or Enables You
A confirmed calendar slot and a video-call link by email.
Legal Basis
Consent — Section 6, DPDP Act, 2023
Retention
24 months from your last contact with us, or until you withdraw consent, whichever is earlier.
Personal Data Item
Budget range (optional) (Scheduling form)
Specific Purpose
To scope a proposal that fits within your stated range.
What This Provides Or Enables You
A proposal that fits your budget instead of a mismatched one.
Legal Basis
Consent — Section 6, DPDP Act, 2023
Retention
24 months from your last contact with us, or until you withdraw consent, whichever is earlier.
Personal Data Item
Chat messages you send the AI Pilot widget (AI Pilot chat widget (only if you choose to use it))
Specific Purpose
To generate a relevant automated reply, and to let our team follow up on the conversation afterwards.
What This Provides Or Enables You
An immediate answer outside business hours, and a human follow-up if one is needed.
Legal Basis
Consent — Section 6, DPDP Act, 2023 (given by opting into Functional cookies and using the widget)
Retention
12 months from the date of the conversation.
Personal Data Item
Marketing opt-in choice (if given) (Inquiry form, scheduling form — a separate, optional checkbox)
Specific Purpose
To send you occasional updates about our work and availability, only if you have separately ticked this box.
What This Provides Or Enables You
You hear from us for this purpose only if you actually want to.
Legal Basis
Consent — Section 6, DPDP Act, 2023 (specific and separate from the inquiry itself)
Retention
Until you withdraw consent.
Personal Data Item
IP address, browser/device (user agent), referring page, timestamp (Automatically, via server and form-submission logs)
Specific Purpose
To operate, secure, and troubleshoot the website, and to detect abuse of our forms.
What This Provides Or Enables You
A working, secure website and spam-free inquiries.
Legal Basis
Legitimate use — Section 7(a), DPDP Act, 2023 (data voluntarily provided by visiting or using the website for its specified purpose, where you have not indicated otherwise)
Retention
Minimum of 12 months (DPDP Rules, 2025, Rule 8); security-relevant logs are additionally retained for at least 180 days within India, per the CERT-In Directions, 2022.
Personal Data Item
Record of your consent (timestamp, policy version, consent text shown, checkbox states) (Captured automatically when you submit a form)
Specific Purpose
To demonstrate, if ever required, that you gave informed, specific consent.
What This Provides Or Enables You
Proof of consent sits with us, not you — you don't have to keep anything.
Legal Basis
Necessary record-keeping to meet our accountability obligations as Data Fiduciary under Section 6, DPDP Act, 2023
Retention
3 years from the date of consent, or 3 years from withdrawal, whichever is later.
Legal Basis, In Plain Terms
Most of what we collect, we collect because you gave it to us directly through a form and ticked a consent box — that is "Consent" under Section 6 of the DPDP Act, 2023: free, specific, informed, and given through a clear affirmative action, which you can withdraw as easily as you gave it. A small amount of technical data (like your IP address, from simply visiting the site) is collected under a "legitimate use" recognised by Section 7(a) of the Act — because you voluntarily provided it by using the website for the purpose it's built for, and you haven't told us otherwise. We rely on this basis narrowly, only for this kind of background technical data, never as a substitute for consent on anything you type into a form.
How To Withdraw Consent
You can withdraw consent at any time, and it is exactly as easy as giving it. Email privacy@waveswebstudio.in with "Withdraw Consent" in the subject line, or simply reply to any email we've sent you and say so. We will stop the specific processing you withdrew consent for within 48 hours and confirm by email. Withdrawing consent does not undo processing we already lawfully completed, and if you were mid-engagement with us, certain records still have to be kept to meet our accounting and tax obligations — this is explained under "Retention" in the table above and in our Privacy Policy.
Your Rights, And How To Use Them
You can ask us, at any time, by emailing privacy@waveswebstudio.in: — Access: for a copy of the personal data we hold about you, and how we're using it. — Correction, completion, or updating: to fix inaccurate data, add missing information, or update anything that's changed. — Erasure: to delete your personal data, unless we're required to keep it (for example, under the GST and Income Tax record-keeping rules described in our Privacy Policy). — Nomination: to name another individual who may exercise these rights on your behalf in the event of your death or incapacity — tell us their name, relationship to you, and contact details. To verify it's really you asking, we'll ask you to confirm the name and email address you used when you originally contacted us. We respond to every rights request within 30 days.
How To Complain
If you're unhappy with how we've handled your personal data or a request above, raise it with us directly first — see Grievance Redressal. Section 13(3) of the DPDP Act requires you to give us the chance to resolve it before approaching the Data Protection Board of India. The Board was established on 13 November 2025. As of the date of this notice, it has not yet notified a public complaint mechanism. The current official position is published by the Ministry of Electronics & Information Technology (MeitY) at https://www.meity.gov.in/data-protection-framework. Once the Board's complaint mechanism is operational, you will be able to approach it directly for data-protection matters.
Children
We do not knowingly collect personal data from anyone under 18, and our services are not directed at children. If you believe a child has provided us personal data, email privacy@waveswebstudio.in and we will delete it. We do not track, profile, or target advertising at children.
What We Are, And Are Not
Waves Web Studio is a Data Fiduciary, not a Significant Data Fiduciary, under the DPDP Act. We have not appointed a Data Protection Officer, an independent data auditor, or undertaken a Data Protection Impact Assessment — those are obligations that apply only to Significant Data Fiduciaries, a category we do not fall into. Tarun Valluri, Proprietor, is our Grievance Officer and contact person for data protection matters.
Further Detail
This notice stands on its own. If you would like more detail on hosting, sub-processors, security, or how different categories of data are kept, see our Privacy Policy, Sub-processors, and Security pages.
Questions about this document, or want to exercise a right described in it? Contact our Grievance Officer, Tarun Valluri (Proprietor), at privacy@waveswebstudio.in. We acknowledge within 48 hours and resolve within 30 days. See Grievance Redressal.