Privacy notice

Studio Desk Architects (“we”, “us”) is an architecture practice based in Dehradun, Uttarakhand. For the personal data you share through this website, we decide why and how it is used. That makes us its data fiduciary under the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the Digital Personal Data Protection Rules, 2025.

Our studio address and phone numbers are on the contact page. For anything about your personal data, write to the data-protection contact at the end of this notice.

We collect only what you choose to send us, and what our host records whenever anyone visits a website.

• When you use the enquiry form: your name; your phone number, your email address or both; whether we may reply on WhatsApp; the kind of project; the town and district of the site; and, if you add them, the plot size, the slope of the site, the approximate built-up area, your timeline, your budget band, how you heard of us and your message. The form also records the page you wrote from, the project you were looking at (if any), the version of this notice you agreed to and the time you sent it.
• When you email, call or message us on WhatsApp: your name, your number or address, and what you write or tell us.
• When you visit the site: our host, Cloudflare, processes your IP address, your browser’s details, the pages you ask for and the time, to deliver the site and protect it from attack.

We don’t ask for sensitive details such as identity documents or bank details. Please don’t send them through the site.

We use your personal data only for these purposes:

• To reply to your enquiry and talk with you about your project: your contact details, the project details and your messages.
• To prepare for a first meeting or a site visit, if you ask for one: the site’s town, district, size and slope, and your timeline and budget band.
• To keep the site working and secure: the technical data our host processes, and our records of how each enquiry was handled.
• To meet our legal duties, such as keeping records the law requires or answering a lawful request from an authority.

How you heard of us, and the page or project you wrote from, only help us understand what brought you to us; the first can be left blank. We don’t use your data for advertising, we don’t sell it and we don’t add you to a mailing list.

The enquiry form asks for your consent before you send it: by ticking its box, you agree that we may use your details to reply to your enquiry, as this notice describes. We record that consent with the version of this notice. When you write to us directly by email, phone or WhatsApp, you share your details so that we can reply, and we use them only for that.

You can withdraw your consent at any time, as easily as you gave it: write to the data-protection contact, or tell us in reply to any message from us. We will then stop using your data and erase it, unless the law requires us to keep it. Withdrawing doesn’t affect what we did with your consent before. If you withdraw while we are discussing a project, we may not be able to continue that discussion.

• Enquiries (form submissions, emails and WhatsApp messages): up to one year after our last exchange about them, then erased, unless you become a client.
• If you become a client, your details become part of the project records, which we keep for as long as our professional and legal duties require.
• Records of how we handled personal data (the processing logs the DPDP Rules require): at least one year from the processing, then erased.
• Our host’s technical logs are kept by Cloudflare for short periods, under its own policies.

A few service providers (data processors) handle personal data for us, only on our instructions and under contracts that require them to keep it secure:

• Cloudflare hosts the website, delivers its pages and images, protects it from attack and stores the enquiries sent through the form.
• Microsoft runs our email (Microsoft 365), so it holds the emails you send us and our replies.

If you choose WhatsApp, your messages travel through WhatsApp, a service of Meta that you use under its own terms; it isn’t our processor. The same applies to the social networks we link to.

These providers may process data in data centres outside India, which the DPDP Act allows except for countries the Government of India restricts. Within the studio, only the people who need your data to reply to you can see it. If a breach affects your personal data, we will tell you and the Data Protection Board of India, as the law requires.

Under the DPDP Act you have the right to:

• Access: ask for a summary of the personal data we hold about you, what we do with it and who we have shared it with.
• Correction and erasure: ask us to correct, complete or update your data, or to erase it once it is no longer needed for the purpose you gave it for, unless the law requires us to keep it.
• Grievance redressal: raise a grievance about how we handle your data, and have it answered within the period shown under data-protection contact.
• Nomination: name someone who can use these rights for you if you die or become unable to use them.

To use any of them, write to the data-protection contact. We may ask you to confirm your identity first, so that we never give your data to someone else.

Some of our project pages name the clients they were designed for, with their agreement. If you are named and would like that changed, write to the same contact.

This site is meant for adults. We don’t knowingly collect personal data from anyone under 18 without the verifiable consent of a parent or lawful guardian. If you are under 18, please ask a parent or guardian to contact us for you. If we learn that we hold a child’s data without that consent, we will erase it.

The site sets no cookies of its own, and it uses no analytics, advertising or tracking tools.

• Film on the home page: if you pause the film, your browser remembers that for the rest of your visit (in its session storage), so the film stays paused as you move around the site. This never leaves your browser and is cleared when you close the tab.
• Security: our host, Cloudflare, may set a strictly necessary cookie when it checks traffic for automated attacks. It is used for security only.

We will update this notice when the way we handle personal data changes. The version, its dates and a summary of the changes appear at the top of the page. If a change affects how we use data you have already given us, we will tell you before it takes effect and, where the law requires, ask for your consent again.

For questions about your personal data, to use your rights, to withdraw your consent or to raise a grievance, write to: