Privacy & legal information

Business details & contacts

Appzilla is the platform brand. Khenitech and DNA TECHBASE remain the separately identified service providers below; each contracts and invoices for its own work.

Khenitech — app launch support

Legal identity

KHENI DHARMESH TULSHIBHAI, sole proprietor trading as KheniTech.

Business address

Third Floor, 15, Sanagana Row House 1, Puana Simada Road, Nana Varachha, Surat, Gujarat 395006, India.

Business contact

contact@khenitech.com

DNA Techbase — EU compliance support

Legal identity

DNA TECHBASE S.R.L., Romanian limited liability company.

Registered office

Aleea Romanilor, Nr. 23, Bl. 12, Sc. 2, Ap. 107, Deva, Hunedoara County, Romania.

Trade Register

J2025048383009

Unique registration code (CUI)

52084942. This is not a statement of VAT registration.

EUID

ROONRC.J2025048383009

Registered share capital

200 RON

Business contact

contact@dnatechbase.com · +40 787 749 242

The Romanian registered office is a correspondence address, not a walk-in service location. Services are offered to business clients only. Khenitech and DNA TECHBASE are separate businesses: each signs contracts and issues invoices for its own agreed work. Your proposal and contract identify the provider responsible for each service. A shared brand presentation does not itself create a partnership, agency, joint controller arrangement or statutory representative appointment.

Before launch: confirm the legal website operator, relevant tax/VAT disclosures, Khenitech’s required business-registration disclosures, and who handles shared enquiries. DNA TECHBASE has not been appointed as Khenitech’s GDPR representative for this service by the creation of this website.

Privacy notice

Scope & responsibility

This draft covers this website and enquiries about the services it presents. It does not cover personal data inside a client’s app or systems; those require a separate assessment, instructions and appropriate agreements before access.

The two providers are identified above. For this shared workflow, the controller allocation and any processing or joint controller arrangement remain to be agreed. For privacy questions you can contact either provider at its listed address. Final controller, applicable representative and any required DPO details must be published before launch. A generic contact mailbox is not a DPO appointment.

Information & purposes

Your email address and message are requested so we can reply meaningfully; name and app link are optional. You may instead contact a provider directly. Do not include account credentials, payment-card details, health information, identity documents, private client records or unnecessary personal data. No automated decisions with legal or similarly significant effects, profiling, advertising or newsletter registration are implemented in this website.

Private site administration

The /admin workspace uses Google sign-in through Firebase Authentication. Only the two approved, verified administrator accounts may access drafts, enquiries and traffic reports, change enquiry status, delete enquiries or change content. We process administrator email addresses and authentication identifiers to enforce access, and record an administrator ID, action, revision and timestamp for content changes. Drafts and activity records are restricted; published website copy and its publication timestamp/revision are public. Do not enter client personal data into the content editor.

Administrator sessions and the editor use memory-only application storage. Refreshing requires sign-in again. Google’s sign-in pages and authentication helpers may process technical authentication state under their own practices. Firebase/Google provide authentication, database and hosting services. The content database is configured in European region eur3; this is not a guarantee that authentication, provider support or every network operation stays in the EEA. Legitimate interests in secure administration and content accountability are the proposed basis, subject to the pending controller and supplier review. Administrator account records, drafts and activity retention require an agreed schedule; automatic activity deletion is not configured. Restrict account records while access is needed, review on offboarding, and define deletion and any justified accountability retention before launch.

How sending works & who receives the data

“Submit enquiry” sends your details to the private website inbox. The two authorised administrators may handle the request on behalf of the providers. Email notification delivery is not configured: administrators check the inbox and reply from their business mailboxes. If online submission fails, an email draft option is offered; you must send that draft in your own email application. Direct emails do not automatically enter this inbox. To contact one provider only, email that provider directly.

Messages sent to both providers reach both businesses and authorised staff handling the request. Mail providers, approved service providers and professional advisers may process necessary information within their agreed roles. Exact mailbox providers, forwarding, staff access locations and backup arrangements for this shared service are not yet verified. They must be documented and accurately disclosed before live operation. No client-system access or general onward sharing is authorised by an initial enquiry.

International processing

Khenitech is based in India and DNA TECHBASE is based in Romania. Sending directly to Khenitech makes your message available to a business in India. Hosting, mail services or remote staff access can involve other countries. This site does not promise EU-only storage.

Any onward transfer subject to GDPR Chapter V requires a valid transfer mechanism and the applicable risk assessment and safeguards before it starts. The mechanism, relevant countries and how to obtain safeguard information must be completed for this service before launch. Choosing an email recipient is not a substitute for ongoing transfer safeguards, and acceptance of this notice does not waive your rights.

Private enquiry tracking

After submitting, you receive an enquiry number and a private tracking link with a downloadable QR code. The link contains a random access key; the database stores a hash of that key. The number alone does not grant access. Anyone holding the complete link or QR code can see the service topic, current status, submission/update times and replies deliberately published by our team. Your name, email, original message and submitted app link are not returned by the tracking endpoint. Keep the link private and save it securely; it is not automatically emailed to you. Contact the team with your enquiry number if you lose access.

Tracking lasts until the enquiry is deleted or expires, up to 180 days after submission. Published replies are stored with the enquiry and follow the same deletion schedule. The tracking page does not load visitor analytics or persist your enquiry in application browser storage. Your browser history, bookmarks and downloaded QR image may retain the private link until you remove them. The key is sent to our backend in a request body rather than a URL query. Tracking uses the same proposed enquiry-handling basis described above, subject to the pending controller and supplier review.

Retention

Submitted enquiries are scheduled for deletion from the website inbox 180 days after submission, with daily cleanup (normally within 24 hours of expiry). Administrators may delete them earlier when no longer needed. Email replies and downloaded copies are separate records and are not removed by inbox deletion. Unsaved form fields remain in page memory only. Abuse prevention uses a daily hash derived from the request IP address, limited to two days plus cleanup delay; raw IP addresses are not stored in the application database. Infrastructure providers may process network logs under their own operational schedules.

DNA TECHBASE’s existing company enquiry policy normally removes non-client enquiry correspondence six months after closure, through monthly review (within 30 days), and permits earlier deletion when no longer needed. Necessary client, financial or claim records follow the applicable purpose and retention period. This policy was adopted for the company website; its application to the shared service and Khenitech’s retention schedule must be confirmed. Shared-service mailbox deletion is not yet configured or verified. Backup expiration depends on the actual provider cycle and is not immediate deletion from every copy.

Your rights & complaints

Depending on the applicable GDPR conditions, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. If consent is used for a future optional purpose, you may withdraw it as easily as you gave it; withdrawal does not undo earlier lawful processing. These rights are subject to their statutory conditions.

Send a privacy request to the relevant provider’s listed contact, identify the correspondence concerned, and provide only information reasonably needed to locate it. Do not attach identity documents by default. Identity verification should be proportionate. Requests must normally be answered within one month; a necessary extension of up to two further months must be explained within the first month.

You can complain to a supervisory authority, particularly where you live, work or believe an infringement occurred, without first contacting us. In Romania, see ANSPDCP. Other EEA authorities are listed by the European Data Protection Board.

Material changes in purposes, providers or data flows require review and an updated notice before the changed processing. This draft’s date is a document revision date, not an assurance that all operational measures are in place.

Cookies & browser storage

Optional page-view measurement is disabled until you choose “Allow page counts”. “Decline” is equally available. We store only your yes/no choice in localStorage under helper-analytics-choice-v1, until you change it or clear browser data. Use “Privacy choices” at the bottom of public pages to withdraw consent at any time. Withdrawal stops future measurement; already aggregated totals cannot be linked back to you or removed individually.

With consent, a page load sends only its fixed page path to our backend. The database stores UTC daily totals for Home, Services and Legal, retained for 180 days with daily cleanup. We create no visitor ID, visitor list, cross-site profile or session recording. Totals include repeat views and exclude visitors who decline, failed requests and administrator pages. Consent is the proposed basis for optional measurement (Article 6(1)(a)); technical abuse prevention uses the proposed legitimate-interest basis. Hosting and backend providers necessarily process network details to deliver requests. No advertising pixels, social embeds or remote fonts are loaded.

The private /admin page additionally loads Google’s authentication helper when needed for sign-in. Firebase Authentication is configured for an in-memory session and Firestore uses a memory-only application cache. No persistent content draft is kept in the browser; private drafts saved by an administrator are stored in the restricted Firebase database. Google’s own sign-in pages may use their own cookies and operational authentication state. See the private-administration section above.

A previous local prototype saved an enquiry under app-enquiry-draft. This version attempts to remove that one legacy record on page load; no other browser storage is cleared. If storage access is blocked, you may need to clear that site’s saved data in your browser settings.

The email application and external websites you open have their own storage and privacy practices. Downloads are files you choose to create. When hosting is enabled, its network processing, logs and any infrastructure cookies must be checked and reflected here.

Traffic consent is separate from submitting an enquiry. Refusing measurement does not restrict browsing or contacting us.

Website use & service enquiries

This informational website introduces app launch and EU compliance support. There is no online checkout, payment, visitor account or automatic service purchase. Viewing the site, preparing an email or making an enquiry does not create a paid engagement, guarantee acceptance or commit either party to a price or deadline.

Each provider contracts and invoices for its own agreed work. Before work starts, its written engagement must identify the supplier, scope, deliverables, fees, taxes, timing, responsibilities, acceptance, change control, cancellation and complaints arrangements. Where both businesses provide services, the documentation must distinguish their respective work and fees. If customer systems or personal data are involved, appropriate access, confidentiality, processing and transfer terms must also be settled before access.

General website content is not a legal opinion or a determination that an app meets every rule. App-store approval is decided by the relevant store; support cannot guarantee approval or regulatory outcomes. Qualifications and regulated-service scope must be verified before relevant claims are made.

Only request work on materials and accounts you are authorised to use. Use redacted examples for initial discussion. Do not disrupt the site, introduce malicious content, or try to bypass security. Branding and original materials belong to their respective rights holders; lawful statutory uses remain available.

This service is offered exclusively to clients acting for business or professional purposes, including sole traders acting in that capacity. It does not offer consumer engagements. The provider must confirm the client’s business capacity before contracting; an enquiry does not itself establish that capacity. Nothing here excludes data protection rights, liability or other rights that cannot lawfully be excluded. Governing law and dispute terms require provider-specific review; no exclusive foreign-court clause is imposed here.

For service complaints, contact the provider concerned at its listed business email with the engagement reference and the resolution sought. For privacy complaints, use the channels above. Existing agreements are not automatically amended by this draft.

Accessibility & assistance

The site includes responsive layouts, semantic headings, keyboard-operable controls, visible focus indicators, labelled forms and reduced-motion support. These features are not an accessibility certification. A full audit and assessment of applicable national accessibility requirements remain part of launch review.

If you cannot access information or use a control, contact either provider with the page address, the difficulty and your preferred accessible format. Avoid including sensitive information in screenshots. We will consider an appropriate alternative way to provide the information.

Reference guidance

This draft was prepared with reference to EDPB small-business guidance and Your Europe’s online privacy guidance. Applicable national law and the actual arrangements must be reviewed before final publication.