Privacy Policy — RWA Connect 360

1. Introduction

RWA Connect 360 (“we”, “our”, or “the platform”) is operated by Navara Tech. This Privacy Policy explains how we collect, use, store, and protect personal information submitted through this platform, in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian law.

2. Information We Collect

Identity information: Full name, email address, mobile number, ownership type (Owner / Tenant)
Unit information: Flat/plot/house number, floor, block/sector
Identity proof: Scanned document uploaded during registration (Aadhaar, PAN, passport, etc.)
Financial records: Membership fee payment history, receipt numbers, payment modes
Activity data: Login timestamps, admin audit trail actions

3. How We Use Your Information

To manage resident registration and membership records
To process and track annual membership fee payments
To send email notifications (verification, receipts, announcements)
To generate society reports for the RWA governing body
To maintain an audit trail of administrative actions for accountability

4. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on Supabase, with the primary region set to India (Supabase Mumbai region — AWS ap-south-1) (Mumbai — AWS ap-south-1). Data at rest is encrypted. Row-level security policies ensure each society can only access its own residents' data. We do not sell or share your personal data with any third party for advertising or commercial profiling.

Limited cross-border processing

Honesty matters here, so we name the operational sub-processors that may receive small amounts of metadata outside India in the course of normal operations:

Sentry (error monitoring, US) — receives stack traces and request metadata when an unhandled error occurs. We scrub email addresses, Indian mobile numbers, and PAN/Aadhaar patterns from every event before transmission (see DPDP Section 8(5) safeguards).
SMTP provider (transactional email — currently Gmail / Google Workspace, US) — handles delivery of verification, receipt, and notification emails. Subject + recipient + body cross the network boundary as part of normal email delivery.

No DPDP Section 16 country restriction applies as of the date of this policy. If the Government of India notifies country-specific transfer restrictions, we will update our sub-processor list and notify you in advance.

5. Data Retention

Resident data is retained for the duration of your membership and for 7 years after de-activation to comply with financial record-keeping requirements under Indian law. Identity proof documents may be deleted upon written request after membership ends, subject to any applicable legal hold.

6. Your Rights (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, you have the right to:

Access a summary of your personal data held by us (Section 11)
Correct inaccurate or incomplete personal data (Section 12(1))
Request erasure of your data (Section 12(3) — subject to retention obligations)
Withdraw consent at any time (Section 6(4)) — see Section 11 below
Nominate a person to exercise your rights in the event of death or incapacity
File a complaint with the Data Protection Board of India (Section 13(3))

To exercise any of these rights, submit a request via /grievance or write to Gaurav Gupta <grievance@rwaconnect360.com>. We respond within 30 days.

7. Cookies

We use strictly necessary session cookies to maintain your authenticated session. We do not use advertising, tracking, or analytics cookies.

8. Changes to This Policy

We will notify you in advance and request fresh consent before any material change to this policy. For non-material editorial fixes (typo corrections, link updates, clarifications), we will post the revised policy with an updated date. We do not treat continued use of the platform as deemed consent to a new policy version.

9. Contact

For privacy-related queries, write to our Grievance Officer:

Gaurav Gupta
Email: grievance@rwaconnect360.com
Phone: +919211551123
Response SLA: 30 days

You can also submit a grievance through our online form. If we fail to resolve your concern, you may escalate under Section 13(3) DPDP Act to the Data Protection Board of India, and from there appeal under Section 29 DPDP Act to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

10. Your Duties (DPDP Section 15)

Under Section 15 of the DPDP Act, you have the following duties when interacting with us:

Comply with the provisions of all applicable laws while exercising your rights;
Ensure not to impersonate another person while providing your personal data;
Ensure not to suppress any material information while providing your personal data;
Ensure not to register a false or frivolous grievance or complaint with us or with the Data Protection Board of India;
Furnish only such information as is verifiably authentic when exercising your rights of correction or erasure.

Knowingly false or frivolous grievances can attract a penalty of up to ₹10,000 under Section 15 read with the First Schedule of the DPDP Act.

11. Withdraw Consent (DPDP Section 6(4))

You may withdraw your consent for any non-essential processing at any time. Residents can use the in-app Privacy Settings to disable WhatsApp notifications or to request account deletion. Admins can do the same from their Privacy Settings. You can also write to the Grievance Officer (above) at any time.

Withdrawal of consent is forward-only — under Section 6(5), withdrawal does not invalidate processing we lawfully carried out before the withdrawal took effect, and we are still permitted to retain certain records (e.g., paid-fee receipts) where Indian law requires us to.