Privacy Policy & Data Protection

1. Introduction & Scope

Obrix ("Company", "we", "us", or "our") operates the corporate website obrix.in and its three core initiatives: Infrava (civil engineering automation software), Shramiksetu (construction workforce network), and Obrix Infra (civil contracting delivery), headquartered at Pinac Galaxy, Gala No. 1, Kapurbawdi Naka, Thane - 400608, Maharashtra, India.

We are committed to protecting your privacy in full compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of the Republic of India and applicable Information Technology laws. This policy explains what personal data we collect, why we collect it, how it is secured, retention periods, and your rights as a Data Principal.

2. Data We Collect Across Our 7 Forms

We only collect personal data directly and voluntarily provided by you through our web forms:

• General Contact Form: Name, phone number, email address, inquiry category, and message text.
• Infrava Early-Access Waitlist: Name, work email, phone number, organization name, professional role (e.g. Billing Engineer, Structural Consultant), and engineering discipline interest.
• Shramiksetu Worker Registration: Full name, mobile/WhatsApp number, primary construction trade/skill (e.g. Mason, Bar Bender, Carpenter), current city/district, years of experience, preferred work location, and expected daily rate.
• Shramiksetu Contractor Request: Company name, contact person name, phone number, site location, trades/headcount required, start date, and site requirements.
• Obrix Infra Quotation: Full name, company name, email address, phone number, project category (RCC, Industrial, Pavement, etc.), project location, scale/built-up area, project notes, and optional architectural/structural drawings (PDF, DWG, DXF).
• Investor / Strategic Partner Inquiry: Full name, organization/fund name, email, phone number, interest areas, and pitch deck request confirmation.
• Career Application: Full name, phone number, email address, target position, portfolio/LinkedIn URL, cover note, and uploaded Curriculum Vitae (PDF/DOCX).

3. Lawful Basis for Processing (Consent)

In accordance with Section 6 of the DPDP Act 2023, personal data is processed solely based on your explicit, affirmative consent obtained at the point of submission via a required consent checkbox. You may withdraw consent at any time as detailed in Section 7 below.

4. Purpose of Processing

We process your data exclusively for legitimate operational purposes:

• To schedule software onboarding and pilot testing for Infrava.
• To connect skilled construction workers with verified contractors without intermediary fees.
• To review civil engineering drawings and calculate preliminary contracting estimates.
• To respond to partnership, supplier, investor, and customer inquiries.
• To evaluate employment and internship applications.
• We never sell, rent, or trade your personal data to third-party advertisers or data brokers.

5. Data Storage, Security & Uploads

We employ robust technical and organizational security measures to protect your data:

• Encryption: All web traffic is encrypted in transit using TLS 1.3 (HTTPS) with strict HTTP Strict Transport Security (HSTS). Sensitive database fields and backups are encrypted at rest.
• File Upload Safety: Uploaded drawings (DWG/DXF/PDF) and resumes are validated by content magic-bytes, renamed with cryptographically random identifiers, and stored in isolated storage outside the web root. No uploaded file is ever exposed via a public URL.
• Access Controls: Access to submitted inquiries is restricted to authorized Obrix personnel authenticated with Argon2id passwords and mandatory Time-Based One-Time Password (TOTP) 2-Factor Authentication (2FA). All administrative actions are recorded in an immutable audit log.

6. Data Retention Schedule

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected:

• Career Applications (unselected): Retained for 180 days for future relevant engineering openings, then permanently purged.
• Contact, Early Access & Investor Inquiries: Retained for up to 2 years from last contact unless deletion is requested.
• Shramiksetu Worker Profiles: Retained until the worker requests de-registration or after 12 months of inactivity.
• Contracting & Quotation Inquiries: Retained for 3 years for engineering audit purposes; projects that convert into executed contracts are retained for 7 years as required by Indian commercial tax laws.

7. Your Rights as a Data Principal (Deletion on Request Flow)

Under the DPDP Act 2023, you have the following rights:

• Right to Access: Request a summary of the personal data Obrix holds about you.
• Right to Correction & Updating: Request correction of inaccurate or incomplete data.
• Right to Erasure (Deletion on Request): You may request complete erasure of your personal data from our servers and backups.
• Right to Grievance Redressal: Direct escalation to our designated Grievance Officer.

8. Grievance Officer & Contact Information

In accordance with the DPDP Act 2023 and Information Technology Rules, the details of our designated Data Protection & Grievance Officer are: