Privacy Policy

What this notice covers

This notice covers personal data we process through this website: the contact form, the careers application form, the certificate verification page, cookies, and our website analytics. It applies to digital personal data about identifiable individuals.

It does not cover data we process under a separate written agreement with a client organisation. Where we operate infrastructure on a client's behalf we act as a Data Processor for that client, on their instructions, and their notice governs that processing rather than this one.

The personal data we collect

We collect only what the specific interaction needs. Nothing on this site requires you to create an account, and we do not buy personal data from third parties or build profiles of visitors.

When you submit the contact form we collect the first and last name, email address and mobile number you enter, together with the company name, job title, service of interest, preferred contact method, how you heard about us, the subject and the message. The email address and mobile number are mandatory because they are how we reply; the rest helps us route the enquiry.

When you apply through the careers form we collect your name, email address, phone number, the position applied for, years of experience, current salary, current organisation, current city, your key skills, and the resume and photograph you attach.

When you verify a certificate we process the certificate number you enter, in order to look it up. We do not use it to identify you.

If you consent to analytics, we and Google Analytics collect your IP address, browser and device type, the pages you view, the page that referred you and the times of those visits. If you do not consent, none of this is recorded and the site works exactly as before.

If you consent to live chat, Tawk.to processes the messages you send in the chat widget and the identifiers it stores in your browser to keep a conversation together.

Why we process it, and on what basis

We process each item for a stated purpose and no other. Where the basis is your consent, you gave it by a clear affirmative action and can withdraw it at any time.

• To answer your enquiry - the contact form data. Basis: your voluntary submission of the form for that purpose, and it is necessary to do the thing you asked for.
• To assess your job application - the careers form data and attachments. Basis: your voluntary submission for that purpose.
• To confirm whether a certificate is genuine - the certificate number. Basis: necessary to perform the look-up you requested.
• To keep the site and its forms secure - the session cookie that carries the anti-forgery token, and rate-limit counters. Basis: necessary to provide the service safely.
• To understand which pages are read - analytics. Basis: your consent, given through the cookie notice. Off unless you turn it on.
• To let you chat with us from the site - the live chat widget. Basis: your consent, given through the cookie notice. Off unless you turn it on.
• To evidence your cookie choice - the consent record described below. Basis: necessary to comply with our own obligation to show that consent was given.

Cookies and similar technologies

Strictly necessary cookies are set on every visit: a session cookie that carries the anti-forgery token protecting the forms, and a cookie recording your choice below so we do not ask again on every page. The site cannot serve a form securely without them, so they have no switch.

Everything else is off until you turn it on. Analytics and live chat are not loaded into the page at all before you consent, rather than being loaded and then held back - a tag that has run has already set its identifiers, so withholding the tag is the only way consent can precede the processing.

The panel below lists every cookie by name, who sets it, what it is for and how long it lasts. It is also where you withdraw consent, which takes the same single click as giving it.

Open cookie preferences

Recording your cookie choice

When you make a choice we store it in a cookie in your browser, and we also record it on our server: a random identifier, the version of this notice you were shown, the time, and which categories you allowed.

The server record contains nothing about you - no IP address in any form, no browser details, no page address. We keep it because the Act puts the burden on us to show what was consented to and when, and a cookie on your own machine cannot carry that burden by itself.

Who else sees your data

We do not sell personal data, and we do not share it for anyone else's marketing. We share it only with the providers we need to run the service, each of which acts as a Data Processor on our instructions.

• Google (Google Analytics) - website usage data, only if you consent to analytics.
• Tawk.to - chat messages and chat identifiers, only if you consent to live chat.
• Our email provider - the contents of a form submission, in order to deliver it to the responsible team.
• Our hosting provider - everything necessarily present on the server that runs this site.
• Professional advisers, auditors, or a government agency or court where we are required by law to disclose it.

Transfers outside India

Google and Tawk.to process data on infrastructure outside India, so consenting to analytics or to live chat involves a transfer outside India. The Act permits transfer to any country the Central Government has not restricted by notification. If a country we transfer to is restricted, we will stop transferring to it.

The contact and careers forms do not require any transfer outside India beyond ordinary email delivery.

How long we keep it

We keep personal data only for as long as the purpose needs it, and erase it when the purpose is met or you withdraw consent, unless a law requires us to retain it.

REVIEW NOTE: the periods below reflect what this system currently implies rather than a retention schedule anyone has approved. They must be confirmed, and the code and mailboxes made to match, before this notice is published.

• Enquiry emails - retained in the recipient mailbox. Confirm a period.
• Job applications, including the resume and photograph - retained for the recruitment cycle. Confirm a period, and confirm whether unsuccessful applications are erased or kept with consent for future openings.
• Cookie consent records - 395 days, matching the life of the consent cookie.
• Analytics data - up to 2 years, set by Google.
• Website page-view logs - recorded only with analytics consent. Confirm a period and set the database to enforce it.
• Rate-limit counters - short-lived, and keyed by a hash rather than a readable address.

How we protect it

The site is served over HTTPS with HSTS, a Content Security Policy and related response headers. Forms are protected against cross-site request forgery with per-session tokens, against automation with timing and honeypot checks, and against abuse with rate limiting. Uploads are validated by actual file type, not by the name they arrive with. Credentials live outside the codebase, and access to the administrative panel is authenticated and rate-limited.

No safeguard is complete. If a breach affects your personal data we will notify you and the Data Protection Board of India as the Act requires.

Your rights

As a Data Principal under the Act you have the following rights over the personal data we hold about you. There is no charge, and we will respond within a reasonable period.

• Access - a summary of the personal data we hold about you, the processing we carry out, and the identities of other Data Fiduciaries and Processors with whom it has been shared.
• Correction and completion - to have inaccurate or misleading data corrected, and incomplete data completed.
• Erasure - to have your personal data erased, unless retention is required for a specified purpose or by law.
• Withdrawal of consent - to withdraw consent at any time, as easily as you gave it. Withdrawal does not undo processing already carried out lawfully.
• Grievance redressal - to have a grievance answered by us before escalating.
• Nomination - to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

How to exercise your rights

For cookies, use the cookie preferences panel: it grants and withdraws consent immediately and needs no request to us.

For anything else, email us from the address you gave us, saying what you want. If we cannot identify which records are yours from the request we will ask for the minimum needed to find them, and nothing further.

You also have a duty under the Act not to make a false or frivolous request, and to give authentic information when you exercise a right of correction.

Grievance redressal

If you are not satisfied with how we have handled your personal data or your request, contact our Grievance Officer. We will acknowledge and respond within the period the Act allows.

REVIEW NOTE: the Act requires the contact details of a Grievance Officer to be published. A named officer must be appointed and named here before this notice is published; the address below is a role address, not a person.

If we do not resolve your grievance, you may escalate it to the Data Protection Board of India.

Children and persons under guardianship

This site and our services are directed at businesses, not at children. We do not knowingly collect the personal data of anyone under 18.

The Act requires verifiable consent from a parent or lawful guardian before processing a child's personal data, and prohibits tracking, behavioural monitoring and targeted advertising directed at children. We do not carry advertising, and analytics are consent-based and not used to build profiles.

If you believe a child has given us personal data through this site, contact us and we will erase it.

Changes to this notice

If we materially change what we collect, why, or who we share it with, we will update this notice and increment the version attached to the cookie notice, which asks for your choice again rather than carrying forward a decision you made about a different notice.

The date at the top of this page is when it was last changed.

Contact us

For any question about this notice, or to exercise a right described in it, email us at the address shown below. Please put "Data protection" in the subject so it reaches the right person.