Written in plain language for huelabs. Please have a lawyer familiar with Indian law review it before the site goes live.
Who we are
huelabs (“we”, “us”, “our”) is a design and technology studio based in Kochi, Kerala, India. We design brands, websites, apps and marketing for clients in India and abroad.
This policy explains what personal data we collect through huelabs.in, our forms and our work with clients, why we collect it, and the choices you have. Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), we act as the Data Fiduciary for this data.
What we collect
We only collect what we need. Depending on how you use the site, that can include:
- Enquiries — your name, email, company, budget range and anything you write or attach when you contact us.
- Job applications — your name, email, portfolio link, CV and message when you apply for a role.
- Newsletter — your email address, if you subscribe.
- Orders — name, email, phone number, country and state, GSTIN and business name (if you add them) and order history when you buy from our Shop. Card, UPI and bank details are handled by our payment provider; we never see or store them.
- Labs accounts — your name, email, company, plan and billing history, the files and content you upload, and basic usage logs that keep the service secure and working.
- Client projects — contact details of the people we work with, and any personal data you share with us as part of a project.
- Technical data — your browser stores a few small items so the site works (see our Cookie Policy). Our hosting provider also keeps standard server logs, such as IP address and browser type, for security.
We don’t knowingly collect sensitive data such as health or financial records, and we ask you not to send it through our forms.
How we use it
- To reply to your enquiry, prepare quotes and proposals, and deliver the work we agree on.
- To review job applications and contact candidates.
- To process orders, deliver digital downloads and licences, and run and support our Labs software.
- To send our newsletter, only if you asked for it. Every email has an unsubscribe link.
- To keep the site secure and working properly.
- To meet our legal, tax and accounting obligations, including GST records.
We do not sell your data, and we do not use it for automated decision-making or profiling.
Why we’re allowed to
Under the DPDP Act we process personal data either:
- with your consent — for example when you subscribe to the newsletter. You can withdraw consent at any time, as easily as you gave it; or
- for legitimate uses allowed by the Act — for example when you send us an enquiry or application yourself, place an order, or when we must keep records to comply with Indian law.
Who we share it with
We share personal data only with service providers who help us run the studio, and only what they need:
- website hosting and email providers;
- our newsletter service, Brevo (Sendinblue SAS, France), which stores subscribers and sends the newsletter and waitlist emails;
- payment gateways and banks, to process payments;
- payment and checkout providers, to take payments and issue invoices;
- our accountants and legal advisers, where required.
These providers must protect your data and may only use it to provide their service to us. Some of them may store data on servers outside India. Where that happens, we only use providers in countries not restricted by the Government of India, with reasonable security safeguards.
We may also disclose data if the law requires it, for example in response to a valid order from a court or government authority.
How long we keep it
| Data | How long |
|---|---|
| Enquiries that don’t become a project | Up to 24 months |
| Job applications | Up to 12 months, unless you ask us to delete it sooner |
| Client project records | For the project, plus up to 3 years |
| Invoices, orders and GST records | 8 years, as required by Indian tax law |
| Labs accounts and uploaded content | While your account is open, then deleted within 30 days |
| Newsletter and waitlists | Until you unsubscribe |
When data is no longer needed, we delete it or make it anonymous.
How we protect it
We use reasonable security safeguards, including encrypted connections (HTTPS), access limited to the people who need it, and reputable providers. No system is perfectly secure. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the DPDP Act requires.
Your rights
You have the right to:
- access a summary of the personal data we hold about you and how we use it;
- correct, complete or update it;
- erase it, unless we must keep it by law;
- withdraw consent at any time;
- nominate someone to exercise these rights for you if you die or become unable to; and
- raise a grievance with us, and then with the Data Protection Board of India if you aren’t satisfied.
To use any of these rights, email hi@huelabs.in from the address we have on file. We may ask you to confirm your identity first.
Children
Our services are meant for adults and businesses. We don’t knowingly collect personal data from anyone under 18 without verifiable consent from a parent or guardian. If you believe a child has sent us their data, contact us and we’ll delete it.
Grievance Officer
If you have a question or complaint about how we handle your data, contact our Grievance Officer:
Grievance Officer, huelabs
Kochi, Kerala, India
Email: hi@huelabs.in
Phone: +91 808 669 9041
We will acknowledge your complaint within 48 hours and resolve it within 30 days.
Changes to this policy
We may update this policy when our services or the law change. The “last updated” date at the top shows the latest version. If a change is significant, we’ll announce it on this site and, where appropriate, by email.