Privacy, in plain English.

Who is responsible

GattyWorks Private Limited is an India-based software studio and the controller or Data Fiduciary for enquiries and our own client administration. CIN: U58201KA2025PTC204259. Registered office: Shri Damayanthi Nivas, Kudthadka, Bajal, Mangalore, Dakshina Kannada, Karnataka 575007, India. Contact us at hello@gattyworks.com.

What we collect

We may collect:

• name, work email, company, country, and project brief;
• billing details and payment status, but not full card numbers;
• project and audit material you authorise us to access, such as source code, configurations, logs, user roles, test data, itemised technology bills, contracts, and usage metrics;
• site security records and aggregate Cloudflare Web Analytics data.
• a two-letter country code supplied by Cloudflare to choose the default pricing currency. The lookup returns only INR or USD and GattyWorks does not store the country code.

Do not send passwords, API keys, production databases, or other secrets by email. We arrange a secure handoff after the scope is signed.

Why we use it

We use data to answer enquiries, prepare and perform a contract, invoice and keep required business records, secure our services, and handle legal claims. These uses rely on steps requested before a contract, performance of a contract, legal obligations, and our legitimate interests in running a secure studio. We use consent where law requires it, including for optional marketing. We do not sell personal data or build advertising profiles.

Client data during delivery

When we handle personal data only for a client project or audit, the client normally remains the controller or Data Fiduciary and GattyWorks acts on the client's documented instructions. The signed scope or data processing agreement sets the purpose, access, security, deletion, approved subprocessors, and incident process. We use the minimum access and test data the work needs.

Providers and transfers

We may use Cloudflare, email and collaboration providers, and the payment provider named in your invoice, such as Stripe, Razorpay, or PayPal. Project-specific providers are listed in the signed scope. Our team operates from India and these providers may process data in other countries. For restricted EEA or UK transfers to India, we put the required data processing terms and transfer safeguards in place before access, such as EU Standard Contractual Clauses or the UK IDTA/Addendum.

How long we keep it

• Unsuccessful enquiries: normally up to 12 months.
• Project access and working copies: removed or returned within 30 days after handover or the agreed re-audit, unless the signed scope sets another period.
• Contracts, reports, invoices, and payment records: as long as tax, accounting, dispute, or security law requires, normally up to 8 years.

We may keep a record longer where law requires it or a legal claim is active. We delete or anonymise it when that reason ends.

Security and incidents

We use access controls, encryption in transit, least-privilege project access, secure secret transfer, logging, and backups appropriate to the work. No system is risk-free. If a breach affects client data, we notify the client without undue delay and support any legally required notice to people or regulators.

Your rights

Depending on your location, you may ask for access, correction, erasure, restriction, portability, withdrawal of consent, or an objection. Indian users may also use applicable grievance and nomination rights. Email hello@gattyworks.com. We aim to acknowledge requests within seven days and complete them within the period required by applicable law. We may need to verify your identity and may retain records we are legally required to keep. You may also complain to the Data Protection Board of India, an EEA data protection authority, or the UK Information Commissioner, as applicable.

Children

Our services are for businesses and adults. We do not knowingly collect personal data directly from children.

Cookies and contact

See our Cookie Policy. Questions, complaints, or rights requests can be sent to hello@gattyworks.com.