Privacy policy

Last updated 22 September 2026. This policy explains how Wriggy Digital Private Limited handles personal data under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it.

1. Who we are

Wriggy Digital Private Limited, CIN U61900DL2025PTC442901, registered in Delhi and operating from Noida, Uttar Pradesh, is the Data Fiduciary for personal data collected through this website, through our recruitment process, and in the course of our commercial relationships. We carry forward the business of A2Z Office Systems, which has served clients since 2015.

Where we deliver managed services, cloud, network, data centre, security, payments or software work for a client, personal data inside that client’s estate is processed on their instructions. In that situation the client is the Data Fiduciary and we are a Data Processor. Section 7 sets out what that means in practice.

2. Scope

This policy covers personal data of:

• visitors to wriggydigital.com;
• people who contact us, request a quote or subscribe to anything we publish;
• named contacts at client, prospect, vendor, OEM and carrier organisations;
• candidates who apply for a role with us;
• individuals whose data we encounter while delivering services for a client, to the limited extent described in section 7.

It does not cover sites we link to. Once you leave this site, the policy of the site you land on applies.

3. The words used

• Personal data — any data about an individual who is identifiable by or in relation to that data.
• Data Principal — the individual the personal data is about. That is you.
• Data Fiduciary — whoever decides why and how personal data is processed.
• Data Processor — whoever processes personal data on a Data Fiduciary’s instructions.
• Processing — any operation on personal data, including collection, storage, use, sharing and erasure.

4. What we collect

When you use the website. Our server and our analytics record IP address, approximate location derived from it, browser and device type, referring page, pages viewed and time spent. This is collected whether or not you fill in a form.

When you contact us or request a quote. Name, work email address, phone number, company, city, the practice you have selected, and whatever you write in the message field. We do not ask for, and ask you not to send, financial account numbers, identity document numbers or health information through this form.

When you apply for a role. Your CV and its contents, contact details, work history, qualifications, notice period and expectations, and any notes our interviewers record. References are contacted only with your agreement.

When you are a contact at a client, vendor or partner. Name, role, work email, work phone, and correspondence relating to the engagement.

What we do not collect on this website. We do not run advertising pixels, we do not build visitor profiles for resale, and we do not attempt to identify individual visitors who have not contacted us.

5. Why we process it, and on what basis

Under the DPDP Act we process personal data either with your consent or for a certain legitimate use permitted by section 7 of the Act.

• To answer an enquiry and prepare a proposal — on the consent you give when you submit the form.
• To deliver and support a contracted service — on the consent of the individual, or as necessary for the performance of the contract with the organisation that employs them.
• To assess a job application — on the consent given when you apply; retained afterwards only as described in section 10.
• To meet statutory, tax, audit and regulatory obligations — a legitimate use under section 7 of the Act; consent does not apply and cannot be withdrawn for it.
• To understand which pages are read — aggregated analytics, on the cookie choice you make.

We do not use personal data collected for one of these purposes for a different purpose without asking you first.

6. Notice, consent and withdrawal

Every form on this site states what is collected and why before you submit it. Consent given to us is specific to the purpose stated, informed, unconditional and unambiguous, and it is given by a clear affirmative action — ticking the consent box.

You can withdraw consent at any time. Write to info@wriggydigital.com. Withdrawal is as easy as giving consent was, and costs nothing. When you withdraw, we stop processing and erase the data within a reasonable period, unless a law requires us to keep it. Withdrawal does not make anything we did before it unlawful.

This notice is available in English and, on request, in any language listed in the Eighth Schedule to the Constitution.

7. When we act for a client, not for ourselves

Delivering managed services, migrations, cloud workspaces, security operations, payment integrations or software means our engineers work inside systems that hold our client’s personal data — their employees, their customers, their transactions.

In that work we are a Data Processor and the client is the Data Fiduciary. We:

• process only on the client’s documented instructions, under a written contract;
• take the minimum access the task requires, and give it up when the task ends;
• do not use anything we see for our own purposes, and never for training models or marketing;
• do not engage a sub-processor without the client’s agreement;
• notify the client without delay if we become aware of a breach affecting their data, so they can meet their own obligations;
• return or erase the data at the end of the engagement, on the client’s instruction.

Individuals whose data sits in a client estate should raise rights requests with that client. If a request reaches us, we pass it to them and assist.

8. Who we share it with

We do not sell personal data, and we do not share it with anyone for their own marketing. We share only what the work requires, with:

• Carriers, OEMs and cloud vendors, where provisioning a circuit, licence or device genuinely requires a named contact — limited to that contact’s name, work email and work phone.
• Service providers we rely on — website hosting, email delivery, spam filtering and analytics — each under contract and each restricted to processing on our instructions.
• Professional advisers — auditors, lawyers and insurers, where they need it.
• Authorities, where disclosure is required by law, court order or a lawful regulatory demand.

9. Transfers outside India

Some of the services we use — email delivery, analytics, and certain cloud platforms — process data on servers outside India. Section 16 of the DPDP Act permits this except to countries the Central Government restricts by notification, and we will stop any transfer that becomes restricted. Where a client requires data to stay in India, we design the engagement that way and say so in the contract.

10. How long we keep it

• Enquiries that do not become business — 24 months from the last exchange, then erased.
• Client records and correspondence — the contract term plus eight years, to meet company law, tax and audit requirements.
• Unsuccessful job applications — 12 months, so we can come back to you about a later role. Tell us and we will remove it sooner.
• Website analytics — 14 months in aggregate form.
• Client estate data we process — only while the engagement needs it, then returned or erased on the client’s instruction.

When a retention period ends, the data is erased and so is any backup copy, on the next backup cycle.

11. Security

We apply reasonable security safeguards as section 8(5) of the Act requires, including:

• encryption in transit, and at rest where the platform supports it;
• role-based access, granted on need and reviewed when a role changes;
• multi-factor authentication on administrative accounts;
• logging and monitoring of access to systems holding personal data;
• separation between our own systems and any client environment we are engaged on;
• contractual security obligations on every processor we use.

No system is beyond compromise, and we do not claim otherwise. What we commit to is that an incident is detected, contained and disclosed rather than absorbed quietly.

12. If there is a breach

If personal data we hold is subject to unauthorised access, disclosure, alteration or loss, we will notify the Data Protection Board of India and every affected Data Principal, in the form and within the time the Act and its rules require. The notice will describe what happened, what data was involved, what we have done about it, and what you can do to protect yourself.

13. Your rights

As a Data Principal you have the right to:

• Access — a summary of the personal data we hold about you, what we are doing with it, and who we have shared it with.
• Correction and completion — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your data erased, unless a law requires us to keep it.
• Grievance redressal — to complain to us first, and to have an answer.
• Nomination — to nominate someone to exercise these rights on your behalf if you die or become incapable of doing so.

To exercise any of these, write to info@wriggydigital.com with enough detail for us to find your record. We respond within 30 days. There is no charge. We may ask you to confirm your identity before we act, which protects you rather than us.

If our answer does not satisfy you, you may complain to the Data Protection Board of India. Please raise it with us first — the Act expects that, and it is usually faster.

14. Your duties

Section 15 of the Act places duties on Data Principals too. In plain terms: give us accurate information, do not impersonate someone else, do not suppress material information when providing data for a document or identifier, and do not file a false or frivolous complaint.

15. Children and persons with disability

This is a business website. It is not directed at children and we do not knowingly collect data from anyone under 18. We do not track children, serve them advertising, or profile them. If you believe a child has submitted data through this site, tell us and we will erase it. Where we process a child’s data or that of a person with a lawful guardian, we obtain verifiable consent from the parent or guardian as section 9 requires.

16. Cookies and analytics

This site sets a small number of cookies:

• Strictly necessary — session and security cookies that make forms and pages work. These cannot be switched off.
• Analytics — used to count page views and understand which pages are read. IP addresses are truncated before storage.

We do not set advertising or cross-site tracking cookies. Blocking cookies in your browser does not lock you out of any part of this site.

17. DPDP compliance at Wriggy Digital

The DPDP Act applies to us twice over: to the personal data we hold as a business, and to the estates we build and run for clients. We treat both as the same discipline.

As a Data Fiduciary we maintain a record of what personal data we hold and why, a stated retention period for each category, a documented process for rights requests and a named Grievance Officer, processor contracts with everyone who handles data on our behalf, and a breach notification procedure aligned to the Act.

As a Data Processor for clients every engagement that touches personal data carries a written processing agreement covering scope, instructions, access limits, sub-processing, breach notification and end-of-engagement return or erasure.

In what we design and build, DPDP is a requirement in the design rather than a review at the end: data residency where the sector demands it, access control inherited from the client’s directory, audit logging on systems holding personal data, encryption in transit and at rest, retention and purge built into the application, and masking of personal data before it reaches any AI model. Our AI enablement work carries the same controls — no client data is used to train a model, and that is written into the contract.

This section describes our own practice. It is not legal advice, and it does not substitute for your organisation’s own assessment.

18. Grievance Officer

Questions about this policy, requests about your personal data, and complaints go to our Grievance Officer:

• Name — Kaptan Bhati
• Designation — Grievance Officer, Wriggy Digital Private Limited
• Email — info@wriggydigital.com
• Phone — +91 70113 14151
• Post — Wriggy Digital Private Limited, Noida, Uttar Pradesh, India

We acknowledge every request and answer within 30 days.

19. Changes to this policy

When this policy changes materially we update the date at the top and, where the change affects how we use data you have already given us, we tell you directly. Previous versions are available on request.