On this page
- Who we are
- Personal data we collect
- How we use it and our legal bases
- Who we share it with
- International transfers
- How long we keep it
- How we protect it
- Cookies and analytics
- Your rights
- Region-specific information
- Children
- Personal data inside client project files
- Grievance Officer and contact
- Changes to this policy
In short
- We collect what you send us (like your name, email and project details) and, only if you allow it, analytics about how you use our site.
- We use your data to reply to you, deliver projects, bill you, and improve our site. We never sell it.
- Your project files are used only for your project and are kept confidential.
- You can ask to see, correct or delete your data, or withdraw consent, by emailing privacy@uvlglobal.com or using our privacy request form.
1. Who we are
UVL Global ("UVL Global", "we", "us", "our") provides 3D architectural rendering, virtual staging and interactive walkthrough services to clients in India, the United States, the Middle East, Europe and Africa.
For personal data collected through this website and our sales and billing activities, UVL Global is the data fiduciary (India) and controller (EU/UK and similar laws). When we handle personal data inside files a client gives us for a project, we act on the client's behalf as a processor (see section 12).
Contact for anything in this policy: privacy@uvlglobal.com.
2. Personal data we collect
We collect the following categories of personal data:
| Category | Examples | Where it comes from |
|---|---|---|
| Contact and inquiry details | Name, work email, phone, company, project city and region, and your answers to our project questions (services needed, project type, timeline) | You, through our forms, email, phone or chat |
| Project information | Plans, CAD drawings, 3D/BIM models, reference photos, site addresses, and any names or images of people that appear in them | You or your team when you share files |
| Communications | Emails, messages, meeting notes, feedback on drafts | You |
| Billing and transaction details | Billing name and address, tax IDs such as GSTIN, invoices, payment status. Card and bank details are handled by our payment providers, not stored by us | You and our payment providers |
| Website usage data (only with your consent) | Pages viewed, clicks, scrolls, device and browser type, approximate location from IP address, referring site, and Microsoft Clarity session replays and heatmaps (with typed text masked) | Google Analytics and Microsoft Clarity cookies and similar technologies |
| Consent records | A random consent ID, whether you accepted or rejected analytics, how and on which page you made the choice, your approximate country (from your IP address, which we do not store) and the date and time | Our cookie banner, cookie settings and Consent Manager, each time you make or change a choice |
| Withdrawal and privacy requests | Your name, email, what you asked us to stop or delete, any reference you give, and when each step was completed. Your email is also kept in scrambled (hashed) form on a do-not-contact list | You, through our Consent Manager or privacy request form |
| Email verification | A one-time code we email you when you send a form, to confirm the address is yours. We don't store the code. A signed confirmation stays in your browser for 30 minutes so you aren't asked again | Our website forms |
| Technical logs | IP address, browser user agent, date and time of requests, error logs | Our hosting provider, automatically, to keep the site secure and working |
We do not knowingly collect sensitive personal data, such as health, biometric or financial account data, and we ask you not to send it to us.
3. How we use it and our legal bases
We use personal data only for the purposes below. The legal basis depends on where you are:
| Purpose | Legal basis (EU/UK GDPR) | Basis under India's DPDP Act |
|---|---|---|
| Reply to your inquiry and send you an estimate | Steps before entering a contract; legitimate interests | Legitimate use: you provided the data voluntarily for this purpose (Section 7(a)); or consent |
| Deliver your project, manage revisions and communicate with you | Performance of a contract | Legitimate use (Section 7(a)) and consent |
| Invoicing, payments, tax and accounting records | Legal obligation; contract | Compliance with law (Section 7) |
| Website analytics and improvement (Google Analytics, Microsoft Clarity) | Consent | Consent |
| Keeping a record of your cookie choices, so we can respect them and show that we do | Legal obligation (proving consent); legitimate interests | Compliance with law |
| Security, fraud prevention and keeping logs | Legitimate interests; legal obligation | Legitimate use and compliance with law |
| Showing finished work in our portfolio, where the client has agreed | Contract; legitimate interests | Consent of the client |
| Responding to legal claims and requests from authorities | Legal obligation; legitimate interests | Compliance with law or court orders (Section 7) |
We do not use your personal data for automated decisions that have legal or similarly significant effects on you, and we do not use it for targeted advertising.
4. Who we share it with
We share personal data only with people and companies that help us run our business, and only as much as they need:
- Our team and vetted contractors who work on your project, all bound by confidentiality obligations.
- Hosting and infrastructure: Vercel Inc. (website hosting, USA, and storage of consent records in its Mumbai, India region).
- Analytics, only with your consent: Google LLC (Google Analytics) and Microsoft Corporation (Microsoft Clarity).
- Email, file-sharing and productivity tools we use to communicate and exchange project files.
- Payment providers and banks that process your payments.
- Professional advisers, such as accountants, auditors and lawyers.
- Authorities when the law requires it, or to protect our rights, our clients or the public.
- A buyer or successor if our business is reorganised, merged or sold, under the same protections as this policy.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
5. International transfers
We work with clients in several regions, and our service providers are based in different countries, mainly India and the United States. Your personal data may therefore be processed outside the country where you live.
When we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant), or other lawful safeguards. Transfers from India follow the DPDP Act and any restrictions the Government of India notifies. You can ask us for more information about these safeguards.
6. How long we keep it
| Data | How long |
|---|---|
| Inquiries that don't become projects | Up to 24 months after our last contact, then deleted |
| Client project files and working files | For the project and up to 12 months after final delivery so we can re-send or update files, unless you ask us to delete them sooner or we agree a different period in writing |
| Final deliverables (archive copy) | Up to 3 years, unless you ask us to delete them |
| Invoices, contracts and accounting records | 8 years, or longer if tax or other laws require |
| Website analytics data | No longer than 14 months, set in our Google Analytics and Microsoft Clarity settings |
| Consent records | 5 years after your last choice, so we can show we respected it |
| Withdrawal request records | 3 years after the request is completed, to show we handled it |
| Do-not-contact list (hashed email) | For as long as needed to keep respecting your choice |
| Security and access logs | At least 1 year, as required for security purposes |
When a retention period ends, we delete or anonymise the data. Where India's DPDP Rules require, we will tell you at least 48 hours before we erase data because you have not interacted with us.
7. How we protect it
We use reasonable technical and organisational safeguards to protect personal data: HTTPS encryption for our website, access limited to people who need it, confidentiality obligations for our team and contractors, and providers we have checked. You can read more on our Security & Confidentiality page.
No system is completely secure. If a personal data breach happens, we will notify the relevant authority and affected people as required by law. For India, that means the Data Protection Board of India and affected Data Principals, within the timelines in the DPDP Rules.
8. Cookies and analytics
We use strictly necessary storage to remember your cookie choice. We use Google Analytics and Microsoft Clarity only if you allow analytics in our cookie banner. You can change your choice at any time from , the link in our footer, or our Consent Manager, which also shows your consent history. Details are in our Cookie Policy.
We honour the Global Privacy Control browser signal by keeping analytics off unless you switch it on yourself.
9. Your rights
Depending on where you live, you have some or all of these rights:
- Access: get a copy or summary of the personal data we hold about you, and how we use and share it.
- Correction and completion: fix inaccurate data or complete and update what's missing.
- Erasure: ask us to delete your data, unless we must keep it by law.
- Withdraw consent: as easily as you gave it, at any time, without affecting earlier processing. Use our Consent Manager.
- Object or restrict: object to processing based on legitimate interests, or ask us to limit it.
- Portability: receive data you gave us in a common, machine-readable format.
- Opt out of sale or sharing: we don't sell or share data for targeted advertising, but you can still send this request.
- Nominate (India): name someone to exercise your rights if you die or become incapacitated.
- Grievance redressal and complaint: raise a complaint with us, and with a regulator (see section 10).
To use any of these rights, fill in our privacy request form or email privacy@uvlglobal.com. We may need to confirm your identity first. We respond within 30 days. Where the law allows us more time, we tell you why. Using your rights is free, and we will not treat you differently for using them. You can also use an authorised agent, who must show proof of your authorisation.
10. Region-specific information
India
We process digital personal data under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. You may raise a grievance with our Grievance Officer (below). If you are not satisfied with our response, you may complain to the Data Protection Board of India. You can ask for this notice in English or any language in the Eighth Schedule to the Constitution of India.
European Economic Area, United Kingdom and Switzerland
You have the rights under the GDPR, UK GDPR or Swiss FADP described above. You can complain to your local data protection authority, for example the Information Commissioner's Office in the UK, though we'd like the chance to resolve your concern first.
United States
Residents of California and other US states with privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon) may have rights to know, access, correct, delete and opt out of the sale or sharing of personal data, and to appeal our decision on a request. In the last 12 months we collected the categories in section 2 (identifiers, commercial information, internet activity, approximate geolocation and professional information) for the purposes in section 3. We have not sold personal data or shared it for cross-context behavioural advertising, and we do not knowingly collect data from anyone under 16. To appeal a decision, reply to our response with the subject line "Appeal".
Middle East and Africa
If you are in the UAE, Saudi Arabia, Qatar, Bahrain, Oman, Kuwait, South Africa, Nigeria, Kenya, Egypt, Ghana, Tanzania, Morocco or another country with a data protection law, you have the rights that law gives you, and you may complain to your national regulator. Examples include the UAE Data Office, the Saudi Data & AI Authority (SDAIA), South Africa's Information Regulator, the Nigeria Data Protection Commission and Kenya's Office of the Data Protection Commissioner.
11. Children
Our website and services are for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
12. Personal data inside client project files
Drawings, photos and models that clients send us can contain personal data, such as owners' names, property addresses or people in photos. For this data we act as a processor for our client: we use it only to deliver the project, keep it confidential, protect it, and delete or return it when the project ends, as set out in our Service Agreement. People whose data appears in these files should contact the client first. We will help the client respond.
13. Grievance Officer and contact
Grievance Officer / Privacy Contact
UVL Global
Email: privacy@uvlglobal.com
We acknowledge grievances within 7 days and aim to resolve them within 30 days.
14. Changes to this policy
We may update this policy when our services, providers or the law change. We will post the new version here with a new "Last updated" date. If the changes are significant, we will tell you by email or with a notice on our website.