Master Privacy & Data Protection Charter
Institutional data governance, strict purpose limitation, zero behavioral trackers, and statutory data principal safeguards across JJ Coders.
Constitutional Scope, Governance Framework & DPDP Act 2023
1.1 Statutory Governance: This Master Privacy Charter constitutes the formal data protection policy of JJ Coders, an independent digital technology studio operated by Founder Johan Jomet from Kerala, Republic of India. This Charter is structured in strict conformity with:
- The Digital Personal Data Protection Act, 2023 (DPDP Act, Republic of India);
- The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011;
- The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
- Global data protection benchmarks, including Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and the California Consumer Privacy Act (CCPA/CPRA) for international visitors.
1.2 Scope of Operations: This policy applies to all personal data processed across the root domain jjcoders.com, official product subdomains (including suna.jjcoders.com, build.jjcoders.com, games.jjcoders.com), and commercial inquiry channels.
Strict Data Minimization & Personal Data Inventory
In accordance with Section 6(1) of the DPDP Act 2023, JJ Coders enforces an absolute data minimization standard. We collect only data strictly necessary to fulfill direct client inquiries, execute authorized development retainers, and maintain platform security:
Name, business email, contact phone/WhatsApp number, and project scope submitted voluntarily via our contact modal or lead capture forms.
Anonymized IP address, user-agent string, and edge request latency collected transiently by Cloudflare for DDoS prevention and rate limiting.
Invoice references, billing addresses, and payment transaction identifiers processed securely through authorized banking gateways. Zero card numbers stored.
Lawful Grounds for Processing & Purpose Limitation
Processing of personal data is conducted solely upon recognized statutory grounds under Section 4 and Section 7 of the DPDP Act 2023:
- Contractual Performance: Processing contact coordinates and project details to prepare Statements of Work, build client software, and deliver deliverables.
- Explicit Consent: Processing voluntary email waitlist submissions or analytics telemetries solely upon affirmative opt-in consent through our cookie consent controller.
- Legitimate Uses & Cybersecurity: Processing server traffic logs to block automated bot floods, brute-force attacks, and SQL/XSS injection attempts under Section 7(b) of the DPDP Act 2023.
- Statutory Compliance: Retaining commercial invoice records as mandated by Indian tax and accounting regulations.
Zero Third-Party Advertising Trackers & Cookie Architecture
4.1 Zero Cross-Site Behavioral Advertising: JJ Coders enforces an absolute prohibition against commercial ad surveillance. We do not deploy Meta Pixel, TikTok Pixel, LinkedIn Insight Tag, or third-party behavioral retargeting networks. We never sell, monetize, or broker user personal data to data aggregators.
4.2 Google Consent Mode v2 Default Denial: Telemetry scripts (Google Analytics 4: G-BYWRNW90NG) operate in strict compliance with Google Consent Mode v2, defaulting all storage parameters (analytics_storage, ad_storage, ad_user_data, ad_personalization) to denied prior to explicit visitor interaction. If a user rejects cookies or takes no action, analytics scripts remain permanently disabled with IP anonymization enforced.
Authorized Cloud Infrastructure & Subprocessor Registry
JJ Coders partners exclusively with enterprise-grade cloud providers bound by strict data processing agreements and SOC2/ISO 27001 certifications:
Cross-Border Data Transfers & Statutory Safeguards
Because JJ Coders operates modern globally distributed edge infrastructure, technical data (such as encrypted HTTPS network requests) may be routed through edge servers located outside the Republic of India. In strict compliance with Section 16 of the DPDP Act 2023, JJ Coders transfers data solely to jurisdictions that are not restricted by the Central Government of India, ensuring all subprocessors enforce contractual safeguards equivalent to Indian statutory requirements.
Protection of Minors & Children (DPDP Act § 9)
In strict accordance with Section 9 of the DPDP Act 2023 and the Children's Online Privacy Protection Act (COPPA), JJ Coders platforms are designed exclusively for commercial, professional, and adult audiences. We do not knowingly collect, process, or track the personal data of individuals under the age of eighteen (18). If we obtain actual knowledge that personal data of a minor has been collected without verifiable parental consent, such data will be expunged from our servers immediately. Parents or guardians may contact our Grievance Officer at privacy@jjcoders.com.
Cryptographic Security Standards & Retention Schedules
8.1 Security Standards: JJ Coders enforces comprehensive administrative and technical safeguards pursuant to Section 8(5) of the DPDP Act 2023, including mandatory TLS 1.3 transport encryption, HTTP Strict Transport Security (HSTS), Subresource Integrity (SRI) on external scripts, and strict origin isolation.
8.2 Retention Schedules: Inactive inquiry communications and form logs are automatically expunged after ninety (90) calendar days unless an active commercial development agreement is executed. Accounting and taxation records are preserved for the statutory duration mandated by Indian law.
Data Principal Rights (DPDP Act §§ 11–14 & GDPR)
Every individual whose personal data is processed by JJ Coders possesses enforceable statutory rights:
Request a summary of personal data being processed and identities of subprocessors with whom it was shared.
Demand the correction of inaccurate data, completion of incomplete records, or permanent erasure of data no longer required.
Access our designated Grievance Officer with guaranteed acknowledgment within 24 hours and statutory resolution within 15 days.
Nominate any individual who, in the event of death or incapacity, shall exercise rights on your behalf.
Designated Grievance & Data Protection Officer
In strict compliance with Section 13(1) of the Digital Personal Data Protection Act, 2023 and Rule 3(2) of the Information Technology (Intermediary Guidelines) Rules, 2021, the details of our statutory Grievance Officer are:
Personal Data Breach Notification Protocols (DPDP Act § 8(6))
In the event of a verified personal data breach compromising the confidentiality or integrity of user data, JJ Coders will: (a) notify the Data Protection Board of India in the form and manner prescribed by statutory regulations; and (b) notify affected data principals with actionable remediation guidance without undue delay, in full compliance with Section 8(6) of the DPDP Act 2023 and CERT-In directions under Section 70B of the Information Technology Act, 2000.
Statutory Privacy Requests & Data Subject Access
To exercise your statutory right to access, rectify, or expunge personal data, transmit an authenticated request to our Data Protection Desk: