Privacy Policy.

01 · Information We Collect

We collect information that you voluntarily provide to us, information we receive automatically when you use our website or app, and information from third-party sources where you have authorised the sharing.

Information you provide directly:

• Name, email, phone number, and address — submitted via contact, enquiry, or scheduling forms
• Property preferences — budget, locality, BHK configuration, and timeline
• Financial information — for home loan applications, this may include income, employer, and credit details (only collected when you specifically apply for loan advisory)
• Identification documents — Aadhaar, PAN, passport, and address proof when required for transactions or KYC
• Job application data — resume, work history, references (when applying through our Careers page)

Information we collect automatically:

• Device information — browser type, operating system, IP address, device identifiers
• Usage data — pages visited, time spent, click patterns, referring URLs
• Location data — approximate location based on IP address (precise location only with your consent)
• Cookie and tracking data — see Section 06 for details

Information from third parties:

• Listing platforms — when you contact us via 99acres, MagicBricks, or similar portals, your enquiry details are forwarded to us
• Banking partners — loan eligibility responses from our 8 lender partners
• Social media — basic profile data when you log in or contact us via Facebook, LinkedIn, Instagram, or WhatsApp

02 · How We Use Your Information

We use your personal data only for specific, legitimate purposes that are reasonably necessary to deliver our services and improve your experience.

Service delivery:

• Match you with relevant properties based on your stated preferences
• Schedule and conduct site visits
• Process transactions, including agreement drafting and registration support
• Provide post-sale services like Khata transfer, painting, and tenant sourcing
• Process home loan and Loan Against Property applications with our banking partners

Communication:

• Respond to your enquiries via call, WhatsApp, email, or SMS
• Send service-related notifications (visit confirmations, document requests, status updates)
• Share market insights, property recommendations, and the Maisai Brief newsletter (only with your subscription consent)

Legal and compliance:

• Comply with KYC obligations under the Prevention of Money Laundering Act (PMLA), 2002
• Meet RERA disclosure and record-keeping requirements
• Respond to lawful requests from courts, regulators, or law enforcement agencies

Improvement and analytics:

• Analyse website usage to improve our service quality (using aggregated, anonymised data)
• Train our team and audit service quality (call recordings, where notified)

03 · Sharing of Information

We do not sell or rent your personal data to third parties. We share information only in the following limited circumstances:

• Banking and loan partners: When you apply for a home loan or LAP, we share relevant financial information with our lending partners (Axis, HDFC, SBI, ICICI, Kotak, Union Bank, Bajaj Finserv, LIC HFL) to evaluate your eligibility.
• Builders and sellers: When you express interest in a specific property, we may share your contact details and basic preferences with the seller or builder, with your consent.
• Legal and registration agencies: Sub-Registrar offices, BBMP, BMRDA, KIADB, and similar government agencies receive transaction-related data as required by law.
• Service providers: Vetted third parties — including legal advisors, painters, tenant verification agencies, and document couriers — who help us deliver services. They are bound by confidentiality agreements.
• Regulatory bodies: RERA, Income Tax Department, and other regulators where required by law.
• Business transfer: If Maisai Realty is acquired, merged, or restructured, your data may be transferred to the new entity, subject to the same protections as this policy.

In all cases, we limit the data shared to the minimum necessary, and we maintain records of disclosures as required under the DPDP Act 2023.

04 · Data Security

We take reasonable security measures aligned with industry best practices and ISO 27001 standards to protect your data from unauthorised access, alteration, disclosure, or destruction.

• Encryption: All data in transit between your browser and our servers uses TLS 1.3 encryption. Sensitive data at rest is encrypted with AES-256.
• Access controls: Internal access to your data is restricted to employees who need it for their role, on a need-to-know basis. All employees sign confidentiality agreements at onboarding.
• Audit trail: Every access, modification, and deletion of personal data is logged and monitored.
• Retention period: We retain personal data only as long as necessary to fulfil the purpose for which it was collected, or as required by law (typically 7 years for transaction records under tax law). After retention period expiry, data is securely deleted.
• Breach notification: In the unlikely event of a data breach affecting your personal data, we will notify you and the Data Protection Board of India within 72 hours, as required under the DPDP Act 2023.

05 · Your Rights

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), you have the following rights with respect to your personal data:

• Right to access: Request a summary of the personal data we hold about you and how it is being processed.
• Right to correction and erasure: Ask us to correct inaccurate or incomplete data, or erase data that is no longer necessary for the purpose collected.
• Right to grievance redressal: Lodge a complaint with our Data Protection Officer (details below) or with the Data Protection Board of India.
• Right to nominate: Nominate another individual who can exercise your rights in case of your death or incapacity.
• Right to withdraw consent: Withdraw consent for processing at any time. Note that this may affect our ability to deliver certain services.
• Right to data portability: Request a structured, commonly used, machine-readable copy of your personal data, where technically feasible.

To exercise any of these rights, write to us at privacy@maisairealty.com. We will respond within 30 days as mandated by the DPDP Act.

06 · Cookies & Tracking

Our website uses cookies and similar tracking technologies to improve your browsing experience and understand how you use our services.

• Essential cookies: Required for basic site functionality (session management, form security, language preference). These cannot be disabled without breaking core functionality.
• Analytics cookies: Help us understand which pages are popular, where visitors come from, and how to improve the site. We use Google Analytics 4 with IP anonymisation enabled.
• Marketing cookies: Used by Meta Pixel, LinkedIn Insight Tag, and Google Ads to show relevant property advertisements on other websites and measure campaign effectiveness.

You can control cookie preferences through our cookie banner (shown on first visit) or your browser settings. Disabling marketing cookies will not affect your ability to use the site, only the relevance of ads you may see elsewhere.

07 · Children's Privacy

Our services are not directed at children under 18 years of age. We do not knowingly collect personal data from anyone under 18.

Under the DPDP Act 2023, processing children's data requires verifiable parental consent and is subject to additional restrictions, including a prohibition on tracking, behavioural monitoring, and targeted advertising directed at children.

If we become aware that we have inadvertently collected personal data from a child without verified parental consent, we will delete it immediately. If you believe a child has shared personal data with us, please contact our Data Protection Officer.

08 · International Transfers

Your personal data is primarily stored and processed within India. In some cases, we may use cloud services or third-party tools (analytics, email delivery, customer support software) whose servers are located outside India.

When we transfer data outside India, we ensure that:

• The transfer is to a country approved by the Government of India for cross-border data flow under Section 16 of the DPDP Act 2023, or
• The recipient is bound by contractual safeguards (Standard Contractual Clauses) ensuring an equivalent level of protection

We do not transfer sensitive financial or KYC data outside India. Such data remains on Indian-soil servers operated by RBI-recognised data centres.

09 · Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other reasons. The "Last updated" date at the top of this page indicates when the most recent change was made.

For material changes that significantly affect how we handle your data, we will notify you in advance via email (if we have your email on file) or through a prominent notice on our website. Continued use of our services after a policy update constitutes acceptance of the revised terms.

We recommend reviewing this page periodically. If you'd like to be notified of any update, please subscribe to our policy-updates list at privacy@maisairealty.com.

10 · Contact for Privacy Concerns

If you have any questions, requests, or complaints about this Privacy Policy or how we handle your personal data, please contact our Data Protection Officer:

If you are not satisfied with our response, you may also file a complaint with the Data Protection Board of India, the regulatory body established under the DPDP Act 2023.