Privacy policy

This Privacy Policy explains how Graph Infrabuild Private Limited (“we”, “us”, “our”), together with its subsidiaries and group companies, collects, uses, shares, stores and protects personal data of visitors and prospective customers (“you”) who use our website https://www.graphinfra.in and our authorized group websites (together, the “Website”), or who contact us about our real estate projects. Capitalized terms not defined here have the meaning given in our Terms & Conditions at our Terms & Conditions.

We process personal data in accordance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and, as and when in force and to the extent applicable, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Law”). For DPDP Law purposes, Graph Infrabuild Private Limited is the “Data Fiduciary”. By submitting your details or by clicking “I agree” on our consent request, you consent to the processing described in this Policy. If you do not agree, please do not submit your personal data to us.

1. Personal data we collect

Category	Examples	How we collect it
Contact and enquiry details	Name, mobile number, email address, city/postal address, project or unit of interest, budget range, preferred contact time, and any message you write	Enquiry, callback, brochure-download and site-visit forms; calls, WhatsApp and emails you send us
Site-visit and booking-stage details	Visit date and time, identity details needed for security at the site, and (at the booking stage, through a separate process) PAN, KYC and payment details	Site registration desk; application form. We do not ask for Aadhaar, PAN or payment card details through the Website’s enquiry forms
Technical (log) data	IP address, device and browser type, operating system, pages visited, time and date of visit, referring URL, approximate location	Automatically, when you use the Website
Cookies and similar technologies	Cookie identifiers, analytics and advertising identifiers (see Section 5)	Through cookies and pixels placed by us or our service providers
Communications records	Call recordings (where you are informed), emails, chat and WhatsApp messages, feedback and complaints	Directly from you

We do not intentionally collect sensitive personal data such as passwords, biometric data, health or financial account information through the Website. Please do not send such data through enquiry forms or email.

2. Why we use your personal data

We use your personal data only for the purposes below, and only for lawful purposes for which you have given consent or which the law permits:

• to respond to your enquiries, call you back, share brochures, price lists and project information, and schedule site visits;

• to process your booking or application and carry out KYC, documentation and payments, where you choose to proceed, and to meet our obligations under the Real Estate (Regulation and Development) Act, 2016 (“RERA”) and the rules and regulations made under it;

• to coordinate with banks and housing finance companies, where you ask us to help with a home loan;

• to send you updates, offers and information about our projects and services, only where you have separately agreed (see Section 4);

• to operate, secure, analyze and improve the Website and our services, and to prevent fraud and misuse;

• to maintain records, resolve disputes, and comply with legal, tax, accounting, regulatory and law-enforcement requirements; and

• for any other purpose that we tell you about at the time of collection, or that is permitted or required by law.

3. Consent

We will ask for your consent through a clear affirmative action (such as ticking an unticked box) before collecting your personal data through our forms. Our consent request will describe the data collected, the purposes, how you can withdraw consent, how to exercise your rights and how to complain to us or to the Data Protection Board of India. This Policy is available in English and, on request, in any language specified in the Eighth Schedule to the Constitution of India.

4. Marketing communications

Marketing calls, SMS, emails and WhatsApp messages are sent only where you have opted in. Consent to marketing is separate from, and not a condition of, your enquiry. We follow the Telecom Commercial Communications Customer Preference Regulations, 2018 issued by TRAI and honour your registration on the National Customer Preference Register (Do Not Disturb) to the extent applicable. You can opt out at any time by using the “unsubscribe” link or reply instruction in our messages, or by writing to info@graphinfra.in. Transactional and service messages about a booking or enquiry you have made may still be sent.

5. Cookies and similar technologies

Cookies are small files placed on your device. We use:

• Strictly necessary cookies to make the Website work and keep it secure;

• Analytics cookies to understand how the Website is used, so we can improve it; and

• Advertising or marketing cookies and pixels to measure our advertising and show you relevant project information on other platforms.

Cookies other than strictly necessary ones are used only with your consent, which you can give, refuse or change through the cookie banner or settings on the Website, or through your browser settings. Blocking cookies may affect how parts of the Website work.

6. Who we share your personal data with

We do not sell your personal data. We share it only as needed for the purposes in Section 2, with:

• service providers and data processors such as website and cloud hosting providers, CRM, telephony, SMS, email and WhatsApp providers, analytics and advertising platforms, who act on our instructions under written agreements requiring confidentiality and appropriate security;

• our subsidiaries, group companies, associates and RERA-registered channel partners or real estate agents who help us respond to your enquiry or market our projects, within the purposes stated here;

• banks, housing finance companies, legal, technical and professional advisers where you ask for loan facilitation or where required for your booking or our compliance;

• government bodies, RERA authorities, regulators, courts and law-enforcement agencies, where required by law or to protect our legal rights; and

• a buyer or successor, in connection with a merger, restructuring or transfer of business, subject to this Policy continuing to apply.

7. Transfers outside India

Some of our service providers may store or process data on servers outside India. Where this happens, we will do so only as permitted by applicable law, including any restrictions notified by the Central Government under the DPDP Law, and we will require such providers to protect your data in line with this Policy.

8. How long we keep your personal data

We keep personal data only for as long as needed for the purposes for which it was collected, for as long as you have not withdrawn consent, and for any longer period required by law. Enquiry data that does not lead to a booking is kept for 60 months from our last interaction with you. Booking and transaction records are kept for the period required under RERA, the Companies Act, 2013, tax laws and other applicable laws. Certain technical logs are retained for the minimum period required by law. When data is no longer needed, we erase it or anonymize it.

9. Security and data breaches

We adopt reasonable security practices and procedures appropriate to the nature of the data, including access controls, encryption in transit, secure hosting, logging and monitoring, regular backups and staff confidentiality obligations. No system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet. If a personal data breach occurs, we will inform the Data Protection Board of India and affected persons, and report cyber security incidents to CERT-In, in the manner and within the time required by law.

10. Your rights

Subject to applicable law, you have the right to:

• obtain a summary of the personal data we process about you, the processing activities, and the other persons with whom it has been shared;

• request correction of inaccurate or misleading data, completion of incomplete data, and updating of data;

• request erasure of your personal data when it is no longer necessary for the purpose or when you withdraw consent, unless retention is required by law;

• withdraw consent at any time. Withdrawing is as easy as giving consent, but does not affect processing done before withdrawal. After withdrawal we will stop processing, and ask our processors to stop, unless law requires otherwise;

• get your grievance addressed by us (Section 13); and

• nominate another person to exercise your rights if you die or become unable to do so.

To exercise these rights, write to us at info@graphinfra.in with your name and contact details so that we can verify your identity. You may be required to exhaust our grievance process before approaching the Data Protection Board of India.

11. Children

The Website is not directed at persons under 18 years of age, and we do not knowingly process their personal data. If we learn that we hold personal data of a child without verifiable consent of a parent or lawful guardian, we will delete it. If you are a parent or guardian and believe your child has given us personal data, please contact us. We do not track, monitor the behavior of, or target advertising at children.

12. Links to other websites

The Website may link to third-party websites that we do not own or control. We are not responsible for their content or privacy practices. Please read their privacy policies before sharing any data with them.

13. Grievance Officer and contact

For questions, requests or complaints about this Policy or your personal data, please write to us at info@graphinfra.in who will acknowledge and address your concern within the time prescribed by applicable law.

14. Changes to this Policy

We may update this Policy to reflect changes in law or in our practices. The updated version will be posted on this page with a new “Last updated” date, and where a change is material or the law requires it, we will tell you through a prominent notice on the Website or directly, and seek fresh consent where needed.

15. Governing law and jurisdiction

This Policy is governed by the laws of India. Subject to your statutory rights, the courts at Delhi shall have jurisdiction over disputes arising from it.