1. Who we are
This Privacy Policy explains how Steinn Labs Private Limited ("Steinn Labs", "we", "us", "our") collects, uses, shares and protects personal data when you visit steinnlabs.com, contact us, or work with us.
Steinn Labs Private Limited operates from 1201, RaCasa, Bavdhan, Pune, MH- 411021, India.
We provide computer systems and software design, information technology consultancy, and innovation and artificial intelligence research and consultancy services.
For personal data we collect for our own purposes (for example, website visitors, prospects, and business contacts), Steinn Labs is the controller. Where we process personal data on behalf of a client as part of a project, we act as a processor, and the client's own privacy notice governs that data (see Section 5).
This policy applies to our website, our marketing and sales communications, events, and our business relationships. It does not cover third-party websites or services we link to.
2. Laws that apply
India's Digital Personal Data Protection Act, 2023 (DPDP Act), and applicable rules govern our handling of digital personal data to the extent they apply and are in force.
Where other data protection laws apply to our processing, such as the EU or UK General Data Protection Regulation for individuals in those regions, we comply with them to the extent required.
3. Personal data we collect
We collect only the personal data we need for the purposes in Section 4.
Information you give us
- Contact and identity details: name, job title, company, email address, phone number, and country.
- Communications: the content of enquiries, emails, contact forms, meeting requests, and messages you send us.
- Business and contract details: billing contacts, purchase orders, invoicing details, and signatory information.
- Recruitment data: CVs, portfolios, references, and interview notes if you apply to work with us.
- Event and demo details: registrations, preferences, and feedback when you attend our events, webinars, or trade shows, or request a demo.
Information collected automatically
- Device and usage data: IP address, browser type, operating system, referring pages, pages viewed, time on site, and approximate location derived from your IP address.
- Cookie and similar technology data, as described in Section 6.
Information from third parties
- Publicly available professional information, for example from LinkedIn, company websites, and business directories.
- Business contact data from data providers and sales intelligence platforms we use for B2B outreach.
- Referrals from partners, clients, or other contacts.
We do not intentionally collect special category data (such as health, religious, or biometric data) through our website. Please do not send us such data unless we have specifically asked for it.
4. How we use personal data and our lawful bases
We process personal data with consent or another basis permitted by the applicable law. The purposes below do not themselves create permission to process data; for Indian personal data, a contract or general legitimate interest is not a substitute for consent or a use expressly permitted by the DPDP Act.
| Purpose | Examples | Lawful basis |
|---|---|---|
| Responding to enquiries | Answering contact forms, emails, and demo requests | Legitimate interests; steps before entering a contract |
| Delivering our services | Running projects, workshops, support, and account management | Performance of a contract |
| Billing and administration | Invoicing, payments, record-keeping | Performance of a contract; legal obligation |
| Business development and marketing | B2B outreach, newsletters, event invitations, case studies | Legitimate interests; consent where required |
| Website operation and improvement | Security, troubleshooting, analytics | Legitimate interests; consent for non-essential cookies |
| Recruitment | Assessing applications and contacting candidates | Steps before entering a contract; legitimate interests |
| Legal and compliance | Meeting regulatory requirements, handling disputes, preventing fraud | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we balance our interests against your rights and freedoms. Where we rely on consent, you can withdraw it at any time without affecting processing that took place before withdrawal.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
5. Client data and AI systems
When we build or operate software and AI systems for clients, we may process personal data contained in the client's systems, documents, or datasets. In these cases:
- We act as a processor and handle that data only on the client's documented instructions, under a written agreement that sets out the subject matter, duration, and security measures.
- We do not use client data to train, fine-tune, or improve any general-purpose AI model, ours or a third party's, unless the client has expressly agreed in writing.
- Where a project uses third-party AI model providers or cloud infrastructure, we select providers that offer contractual commitments on confidentiality, security, and data use, and we disclose them to the client as sub-processors.
- Where a client requires it, we deploy solutions within the client's own environment or a self-hosted setup so that data does not leave their control.
- We return or delete client data at the end of the engagement, as agreed in the contract.
If you are an individual whose data is held by one of our clients, please contact that client first. We will support them in responding to your request.
6. Cookies and analytics
Our website uses cookies and similar technologies.
| Type | What it does | Consent needed |
|---|---|---|
| Strictly necessary | Keeps the site secure and working, remembers your cookie choices | No |
| Analytics | Measures traffic and how visitors use the site, so we can improve it | Yes |
| Marketing | Measures the effectiveness of our campaigns and may personalise advertising | Yes |
We set non-essential cookies only after you consent through our cookie banner. You can change your choices at any time through the cookie settings link on our website or your browser settings. Blocking some cookies may affect how the site works.
7. Sharing and international transfers
We do not sell your personal data. We share it only as follows:
- Our team and affiliates: our staff and delivery team, including team members and contractors based in India, who need access to perform their roles.
- Service providers: hosting, cloud, email, CRM, analytics, communication, accounting, and AI model providers who process data on our behalf under contract.
- Professional advisers: lawyers, auditors, accountants, and insurers, under duties of confidentiality.
- Partners: channel or implementation partners, where you have asked to be introduced or where a joint engagement requires it.
- Authorities: regulators, courts, or law enforcement where the law requires us to disclose.
- Business transfers: a buyer or investor as part of a merger, acquisition, financing, or sale of assets, subject to confidentiality.
International transfers. Some recipients are located outside India, including in the United Arab Emirates, the United States and the European Union. We apply contractual safeguards and applicable restrictions on cross-border transfers, including restrictions notified under the DPDP Act. You can contact us for more information about these safeguards.
8. Retention and security
We keep personal data only as long as we need it for the purposes it was collected for, or as the law requires.
| Data | Typical retention |
|---|---|
| Enquiries and prospect contacts | Up to 3 years from last meaningful contact |
| Client contract, billing, and accounting records | 6 years after the engagement ends, or longer if the law requires |
| Client project data (as processor) | As set out in the client contract, then returned or deleted |
| Unsuccessful job applications | Up to 12 months, unless you agree to a longer period |
| Website analytics data | Up to 26 months |
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls based on least privilege, multi-factor authentication, logging and monitoring, secure development practices, and confidentiality obligations for staff and contractors. No system is completely secure. We notify affected individuals and the relevant authority of personal data breaches as required by applicable law.
9. Your rights
Subject to applicable law, including the DPDP Act where in force, you may request access, correction or erasure of personal data, withdraw consent and raise a grievance. Other rights listed below apply where the relevant law grants them:
- Access the personal data we hold about you and receive a copy.
- Correct inaccurate or incomplete data.
- Ask us to delete your data.
- Restrict or object to our processing, including processing based on legitimate interests.
- Object at any time to direct marketing.
- Receive your data in a portable format and have it transmitted to another controller.
- Withdraw consent where we rely on it.
- Not be subject to decisions based solely on automated processing that significantly affect you.
To exercise any of these rights, email us at abhishek@steinnlabs.com or jeet@steinnlabs.com. We may need to verify your identity before acting. We will respond within one month, which we may extend where the law allows; we will tell you if we do.
To raise a data-protection grievance, email abhishek@steinnlabs.com. After using the applicable grievance process, you may pursue a complaint with the Data Protection Board of India where that remedy is available under applicable law. If another jurisdiction's law applies, you may also contact its relevant data protection authority.
10. Other important information
Children. Our website and services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us and we will delete it.
Third-party links. Our website may link to other websites, platforms, or social media. We are not responsible for their privacy practices, and we encourage you to read their policies.
Marketing. You can unsubscribe from our marketing emails at any time using the link in each email or by contacting us.
Changes to this policy. We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. Where changes are significant, we will take reasonable steps to let you know.
11. Contact us
If you have questions about this policy or how we handle personal data, contact us:
Steinn Labs Private Limited, 1201, RaCasa, Bavdhan, Pune, MH- 411021, India. Email: abhishek@steinnlabs.com.