GDPR & DPDP
Compliance
Last Updated:
24 September 2026
This page outlines the data protection standards, compliance frameworks, and privacy commitments maintained by L.A.vation. As an architectural design practice, we handle personal and project-related data with restraint, confidentiality, and technical security.
We are committed to operating in full compliance with:
The Digital Personal Data Protection Act, 2023 (DPDP Act, India)
The General Data Protection Regulation (EU) 2016/679 (GDPR), to the extent that we interact with, process inquiries from, or showcase works to individuals located within the European Economic Area (EEA) and the United Kingdom.
1. Identity of the Data Fiduciary / Controller
Entity Name: L.A. vation
Principal Architect & Proprietor: Monalisa Acharya
GST Identification Number: 21AIIPA2049M1ZK
Practice Address:
HIG-32 Duplex (1st Floor), Shailashree Vihar, Chandrasekharpur, in front of DAV School, Bhubaneswar, Odisha, PIN:751021, IndiaDesignated Data Protection Point of Contact:
Monalisa AcharyaOfficial Compliance Email:
notices@studio-dsm.com
2. Principles of Data Processing
Whether operating under the Indian DPDP Act or EU GDPR, we adhere strictly to the following core data processing principles:
Lawfulness, Fairness & Transparency: We process personal data exclusively for specified, legitimate architectural practice purposes, ensuring the user is fully aware of how their information is handled.
Purpose Limitation: Information collected through inquiry channels is used solely to respond to project requirements, evaluate site briefs, or coordinate professional appointments.
Data Minimization: We collect only the minimum data points necessary to process a design inquiry.
Storage Limitation: We do not retain contact or project records longer than necessary to serve your project consultation or satisfy statutory record-keeping mandates.
Integrity & Confidentiality: Administrative and technical access controls ensure that personal data is protected against unauthorized access, loss, or alteration.
3. Categories of Data We Process
Note: We do not process sensitive personal data, biometric identifiers, or financial credit data through this public portfolio website.
4. Compliance with the Digital Personal Data Protection Act, 2023 (India)
For individuals residing in India, L.A.vation functions as a Data Fiduciary:
Notice & Consent: We obtain clear, affirmative consent prior to processing inquiries submitted through our website forms.
Right to Access & Summary: You have the right to request a summary of the personal data we hold about you and the processing activities undertaken.
Right to Correction & Erasure: You may request rectification of inaccurate personal data or erasure of your details from our active inquiry records.
Right of Grievance Redressal: If you have concerns about how your data is handled, you may write directly to our designated compliance contact. We commit to acknowledging grievances within
7 working days.Right to Nominate: You have the right to designate an authorized representative to exercise your data rights in the event of incapacity or death.
5. Compliance with the General Data Protection Regulation (GDPR - EU/UK)
For visitors and prospective collaborators residing in the European Union or the United Kingdom, L.A.vation acts as a Data Controller:
Lawful Bases for Processing:
Article 6(1)(a) Consent: Explicit consent given when submitting forms or opting into direct communications.
Article 6(1)(b) Contract: Necessary for taking pre-contractual steps at your request (e.g., preparing architectural proposals).
Article 6(1)(f) Legitimate Interests: Operating, securing, and maintaining our digital portfolio.
Your GDPR Rights:
Right of access (Article 15)
Right to rectification (Article 16)
Right to erasure / "Right to be Forgotten" (Article 17)
Right to restriction of processing (Article 18)
Right to data portability (Article 20)
Right to object to processing (Article 21)
International Data Transfers: If data is transmitted outside the EEA, we ensure adequate protective mechanisms, standard contractual clauses, or explicit consent exemptions are met.
Right to Lodge a Complaint: You maintain the right to lodge a complaint with your local EU/EEA Data Protection Supervisory Authority.
6. Third-Party Processors & Infrastructure
To deliver this web portfolio securely, we engage trusted technical service providers who maintain strict confidentiality and data protection standards:
Web Hosting & CMS Platform:
Framer B.V. / Cloudflare, Inc. / Namecheap, Inc. / Amazon Web Services, IncForm Processing & Delivery:
Framer B.V. / Google LLC / Amazon Web Services, IncCloud Storage & Communications:
Google LLC / Amazon Web Services, IncAnalytics (if enabled):
Google LLC / Anonymized Analytics Provider / Meta Platforms, INC.
7. Data Security Measures
We implement industry-standard protective protocols, including:
Mandatory HTTPS/SSL transport-layer encryption across all pages.
Access-restricted databases and administrative consoles protected by multi-factor authentication.
Regular purging of legacy form entries and non-converted preliminary inquiries.
8. Exercising Your Rights & Grievance Redressal
To exercise any of your rights under the DPDP Act 2023 or GDPR, or to request the deletion or correction of your information, submit a formal request to our registered office / email
We will review, verify identity, and respond to your request within statutory timelines.
