Effective Date: 25 September 2026
Last Updated: 25 September 2026
This Privacy Policy explains how the operator of Credestate and the website https://www.credestate.com/ (“Credestate”, “we”, “us” or “our”) collects, uses, stores, discloses and protects personal data when you visit or use our website, create an account, submit a property enquiry, list or manage a property, communicate with us, use our services, or make a payment through the website.
Credestate operates as a real-estate website and digital platform through which users may discover property listings, submit property enquiries, communicate with agents or property owners, create or manage listings where enabled, and access related real-estate services and information.
This Policy is intended to operate consistently with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), the Information Technology Act, 2000 and applicable rules, and applicable consumer-protection and e-commerce requirements. Where another law imposes a higher or different obligation, that law will apply to the extent required.
1. Who is responsible for your personal data?
For data processed through this website, Credestate is the organisation responsible for determining the purposes and means of processing, to the extent it acts as a “Data Fiduciary” under the DPDP Act.
Privacy / Grievance Contact
Designation: Credestate Grievance Officer / Privacy Contact
Email: credestate.co@gmail.com
Postal address: Delhi, Rohini, India
For a statutory grievance under applicable law, you may first contact us using the details above. Nothing in this Policy limits any right to approach a competent authority or forum where such right is available under applicable law.
2. What personal data we collect
We collect only such personal data as is reasonably required for the relevant purpose. Depending on how you use the website, this may include:
- Identity and contact information: first name, last name, email address, mobile or telephone number and similar contact details.
- Property enquiry information: whether you are a property owner or agent, property type, city, postal/ZIP code, number of bedrooms, number of bathrooms, budget and other information you voluntarily provide about a property requirement.
- Account information: username, account profile information, saved searches, favourites, property listings, messages, preferences and authentication-related information where account functionality is enabled.
- Property and listing information: property address or location, photographs, descriptions, pricing, property characteristics, ownership or agency information and supporting documents that you choose or are required to upload for a listing or service.
- Transaction information: billing information, transaction identifiers, order information, payment status, subscription or package information and related records where paid services are offered.
- Communication information: the contents of enquiries, support requests, emails, messages, feedback and other communications you send to us.
- Technical information: IP address, browser and device information, operating system, approximate location inferred from technical information, referring pages, timestamps, pages visited, diagnostic information and security logs.
- Cookie and similar technology information: identifiers and preferences associated with cookies, local storage, analytics or similar technologies used on the website.
Please do not submit sensitive personal information that is not reasonably required for a property enquiry, listing or service. Where you upload information relating to another individual, you should have the authority or permission required to do so under applicable law.
3. How we collect personal data
We may collect data directly from you when you:
- submit a contact, enquiry, valuation or property-related form;
- create or manage an account or property listing;
- save a property, search or preference;
- contact our team by email, telephone or other communication channel;
- purchase a package, subscription or other paid service;
- submit a complaint, request or feedback; or
- interact with the website and its technical, security and analytics systems.
We may also receive information from agents, property owners, service providers, payment processors or other users where they lawfully provide information to us in connection with a property, enquiry, transaction or service.
4. Why we use personal data
We may process personal data for the following purposes:
- to respond to property enquiries and requests;
- to provide, administer and improve Credestate services;
- to create, maintain and secure user accounts;
- to publish, manage and administer property listings where you request or authorise publication;
- to connect or facilitate communication between relevant users, agents, owners or service providers;
- to process payments, subscriptions, invoices, refunds and related transactions;
- to personalise searches, saved properties and website functionality;
- to prevent fraud, abuse, unauthorised access, spam and other unlawful or harmful activity;
- to troubleshoot technical problems, monitor performance and maintain website security;
- to send service communications such as confirmations, account notices, security alerts and support messages;
- to send marketing or promotional communications where permitted and, where required, based on your consent; and
- to comply with legal, regulatory, tax, accounting, law-enforcement or dispute-resolution requirements.
Under the DPDP Act, personal data may be processed for a lawful purpose on the basis of consent or a permitted legitimate use, as applicable. Where consent is required, we will request it through an appropriate notice and consent mechanism rather than relying solely on a statement buried in this Policy.
5. Notice and consent
Where we rely on consent, we aim to provide a clear notice describing the personal data requested, the purpose of processing and the available rights and mechanisms for exercising them. Consent should be specific, informed and capable of being withdrawn.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. If a processing activity is necessary for another lawful purpose, contractual service, security requirement or legal obligation, we may continue that processing to the extent permitted by law.
We do not treat continued browsing of the website as blanket consent to optional processing. Where a separate consent is required, we will seek that consent through the relevant website flow.
6. Marketing and communications
We may send service-related communications that are necessary to operate an account, respond to an enquiry, complete a transaction or provide requested services.
Where applicable law requires consent for promotional communications, we will obtain the required consent. You may unsubscribe from promotional emails using the unsubscribe mechanism provided in the communication or by contacting us. We may still send essential service and security communications where permitted.
7. Cookies and similar technologies
Credestate may use cookies, local storage, pixels and similar technologies for essential website functions, authentication, security, preferences, analytics, performance measurement and, where enabled and permitted, marketing.
Some cookies may be placed by third-party service providers that support website functionality, analytics, customer relationship management, payments, maps, security or other services. The exact cookies may change as website functionality and vendors change.
Where required by applicable law, we will provide an appropriate mechanism for managing consent to non-essential cookies or similar technologies. Disabling essential cookies may prevent parts of the website from functioning correctly.
8. Third-party service providers and sharing
We may disclose or make personal data available to third parties where necessary for the purposes described in this Policy and as permitted by law. These may include:
- website hosting, infrastructure, security and technical-support providers;
- customer relationship management, enquiry-management and communication providers;
- analytics and measurement providers;
- payment gateways and financial service providers used to process transactions;
- property owners, agents or other parties where a user has requested or authorised communication or where necessary to fulfil a service;
- professional advisers such as lawyers, accountants, auditors and insurers where reasonably required;
- government, law-enforcement or regulatory authorities where disclosure is required or lawfully requested; and
- successors, buyers or transaction counterparties in connection with a merger, acquisition, restructuring, financing or sale of assets, subject to applicable law and appropriate safeguards.
Our website currently uses or may use services and integrations such as WordPress, WooCommerce, HubSpot, Google services and Razorpay or other payment providers. The specific data shared with a third party depends on which feature you use and the configuration active at the relevant time.
Where a third party processes personal data on our behalf, we seek to require appropriate contractual, technical and organisational safeguards consistent with applicable law.
9. Property listings and user-submitted information
Some parts of Credestate allow users, property owners, agents or other authorised parties to submit property information. Information intended for public listing may be displayed to other website visitors or shared as part of the requested property-service workflow.
You are responsible for ensuring that information you submit is accurate, lawful, not misleading and does not improperly disclose another person’s personal data. Do not upload identification documents, financial information, signatures, contact lists or other sensitive information unless it is genuinely required for the service and you have the right to provide it.
10. Payments
Where the website offers paid packages, subscriptions, memberships or other paid services, payment processing may be handled by a third-party payment gateway such as Razorpay.
Payment providers may collect and process card, bank, UPI or other payment credentials under their own terms and privacy policies. Credestate may receive transaction references, payment status, billing details and other limited transaction information required to reconcile the transaction and provide the service. Payment credentials should be entered only through the payment provider’s authorised payment interface.
11. Data retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide the requested service, to maintain business and security records, to resolve disputes, to prevent fraud, or to comply with legal, tax, accounting or regulatory requirements.
When personal data is no longer required for a lawful purpose, we seek to delete, anonymise or otherwise dispose of it in accordance with our retention practices and applicable law. Where a law or regulation requires a longer retention period, that legal requirement takes precedence.
12. Security safeguards
We take reasonable measures appropriate to the nature of the personal data and the risks of processing. Depending on the system and service involved, safeguards may include HTTPS/TLS encryption for data in transit, access controls, authentication controls, security monitoring, backups, logging, vendor controls and procedures for detecting and responding to unauthorised access or other security incidents.
No website or electronic transmission can be guaranteed to be completely secure. You should use strong and unique credentials, protect your account information and notify us promptly if you suspect unauthorised access to your account.
13. Personal data breaches
If we become aware of a personal data breach, we will assess and respond to it in accordance with applicable law. Where required by the DPDP Act and DPDP Rules, we will provide notices to affected Data Principals and make the required notification to the Data Protection Board of India or other competent authority within the applicable timelines.
Our response may include containment, investigation, remediation, security improvements and guidance to affected individuals on steps they can take to reduce risk.
14. Your rights under the DPDP Act
Subject to the DPDP Act, DPDP Rules and other applicable law, a Data Principal may have the right to:
- obtain information about the personal data being processed and related processing information, subject to statutory conditions;
- request correction or updating of inaccurate or incomplete personal data;
- request erasure of personal data that is no longer required for the purpose for which it was processed, subject to legal and other applicable exceptions;
- withdraw consent where processing is based on consent;
- make a grievance to the Data Fiduciary and use the statutory escalation mechanism available under applicable law; and
- exercise the right to nominate another individual to exercise rights in accordance with the DPDP Act and applicable rules.
To exercise a right, contact credestate.co@gmail.com with the subject line “DPDP Request”. We may require reasonable information to verify your identity and protect against unauthorised requests.
Where the requested action cannot be completed because of a legal, security, fraud-prevention, contractual or other lawful reason, we will explain the applicable limitation to the extent permitted by law.
15. Children’s data
The DPDP Act treats a person under 18 years of age as a child. Our website and real-estate services are not designed to solicit children to create accounts or independently enter into property-related transactions.
We do not knowingly seek to process a child’s personal data for prohibited purposes. Where processing of a child’s personal data is necessary and permitted, we will implement the consent and other safeguards required by applicable law, including verifiable parental or lawful guardian consent where required.
16. Accuracy of information
We expect users to provide information that is accurate, complete and current. If you discover that personal data associated with your account or enquiry is inaccurate, please contact us so that we can review and, where appropriate, correct it.
17. International processing and data transfers
Some service providers used by websites may operate infrastructure or support services from locations outside India. Where personal data is processed or transferred outside India, we will do so subject to applicable law, contractual safeguards and any restrictions or requirements notified by the Government of India.
18. Links to third-party websites
Credestate may contain links, maps, embedded content or integrations supplied by third parties. Once you leave our website or interact directly with a third-party service, that provider’s own terms and privacy policy may apply. We do not control the privacy practices of independent third parties.
19. Changes to this Privacy Policy
We may update this Policy when our services, technology, legal obligations or data practices change. The revised Policy will be published on this page with an updated “Last Updated” date. Where required by law, we will provide additional notice or obtain consent before implementing a material change.
20. Contact and grievance mechanism
If you have a privacy question, data-rights request, complaint or grievance, contact:
Credestate Grievance Officer / Privacy Contact
Email: credestate.co@gmail.com
Address: Delhi, Rohini, India
We will acknowledge and handle grievances in accordance with the timelines and procedures applicable to the particular complaint under the DPDP Act, DPDP Rules, consumer-protection law and any other applicable law.
21. Applicable legal framework
This Policy is intended to be interpreted with the applicable laws of India, including the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 and other applicable data-protection, cyber-security, consumer-protection and e-commerce requirements.
Official legal references: