This policy explains how Code Colonies Private Limited ("Code Colonies", "we", "us") handles personal data of visitors to matruos.com (the "Site"). We are the Data Fiduciary for this data under the Digital Personal Data Protection Act 2023 ("DPDP Act") and, for visitors in the European Union or the United Kingdom, the controller under the GDPR and UK GDPR. This notice is given under section 5 of the DPDP Act and rule 3 of the DPDP Rules 2025.
Section 1Who we are
Code Colonies Private Limited, CIN U62091GJ2023PTC140196, 12th Floor, Office 1216 and 1217, i-Square, Science City Road, Sola, Ahmedabad 380063, Gujarat, India. Privacy contact and Grievance Officer: Dr. Mahipatsinh Sagar, consulting@codecolonies.com.
Section 2What we collect, why, and on what basis
| What | Why | Basis |
|---|---|---|
| Name, work email, phone, company, role and message, when you fill in a contact or book-a-call form | To reply, arrange the call and discuss what you asked about | Your consent, given when you submit the form (DPDP Act s.6); for EU/UK visitors, steps you ask for before a contract (GDPR Art. 6(1)(b)) |
| What you type into the website assistant, and its replies | To answer you and improve the assistant's answers | Your consent, given when you start the chat; for EU/UK visitors, our legitimate interest in answering visitors (Art. 6(1)(f)) |
| Technical data: IP address, browser, device, pages visited, referring page | To deliver the Site, keep it secure and prevent abuse | Use you make of the Site for this purpose (DPDP Act s.7(a)); for EU/UK visitors, legitimate interest (Art. 6(1)(f)) |
We do not knowingly collect data from anyone under 18; the Site is meant for businesses. Please do not send us sensitive data (health, financial account, identity numbers) through the Site.
Section 3Who we share it with
- Our group and staff
- who need it to respond to you.
- Service providers
- who host the Site, deliver email, run forms, analytics, the website assistant and our customer records, under contracts that bind them to use the data only for us and keep it secure.
- Authorities
- , only when the law requires it.
- A successor
- , if our business or a product is transferred, bound by this policy.
We do not sell personal data.
The providers this Site uses, and what each does:
- Our hosting provider
- delivers the website and receives the standard information every browser sends with a request, such as your IP address.
- Resend
- sends your enquiry to our team by email.
- HubSpot
- is our customer relationship management (CRM) system. We record your enquiry there so the right person can follow it up and we keep a record of our conversation with you.
- Cloudflare Turnstile
- checks that a form is sent by a person, using technical signals from your browser and device, such as your IP address.
- Google Calendar and Google Meet
- are used when you book a meeting. Your name, email and the time you chose go into a calendar invitation with a Google Meet link.
- Vercel Web Analytics and Speed Insights
- count page views and measure how fast pages load while the website is hosted on Vercel. When the website is self-hosted, we use Umami analytics, run on our own server, instead. None of them sets cookies or identifies you.
- Anthropic
- provides the AI model that writes Muni's answers, when Muni is connected to it. The question you type is sent to it, so please do not type personal details into Muni.
- Pexels
- serves some of the photographs and receives your browser's standard request information when an image loads.
Some of these providers may process your data outside India.
Section 4Where it is processed
Our providers may process data outside India, including in the United States and the European Union. The DPDP Act permits transfers except to countries the Central Government restricts under section 16; none is restricted today. For EU and UK visitors, transfers outside those regions rely on the European Commission's Standard Contractual Clauses or another lawful mechanism.
Section 5How long we keep it
| What | How long |
|---|---|
| Enquiries and call requests that do not lead to a contract | 2 years after our last contact, then deleted |
| Enquiries that lead to a contract | For the contract, then as tax and company law require (up to 8 years) |
| Website assistant chats | 12 months |
| Technical and security logs | Up to 1 year; CERT-In logs at least 180 days |
Section 6Cookies
- This Site sets no analytics or advertising cookies, and uses no tracker that identifies you.
- It keeps two small entries in your browser's local storage: your light or dark theme choice, and that you have seen the privacy notice. Clearing your browser data removes them.
- Page counts come from Vercel Web Analytics, or Umami on our own server when the Site is self-hosted. Neither sets cookies.
- Cloudflare Turnstile, which checks that a form is sent by a person, may set a necessary security cookie when you send a form.
- The booking page shows Google Calendar inside the page. Google may set its own cookies when it loads, under Google's privacy policy.
Section 7Your rights
Under the DPDP Act you can ask for a summary of your data and who it was shared with, correct or update it, erase it, withdraw consent (as easily as you gave it), nominate someone to act for you, and complain (sections 6, 11 to 14). EU and UK visitors also have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR, and may complain to their supervisory authority.
Write to consulting@codecolonies.com. We reply within 30 days at most and may ask you to confirm who you are. If you are not satisfied, you may complain to the Data Protection Board of India.
Section 8Security
We protect personal data with encryption in transit, access controls and logging. No website is completely secure; please do not send confidential information through forms.
Section 9Changes
We will update the date above when we change this policy, and tell you on the Site of any change in how we use your data.