Privacy Policy

What this policy is, and who publishes it

This policy describes what Avisha Global Technologies Pvt Ltd actually does with personal data. It is not a list of things we reserve the right to do later. Where we do not collect something, we say so plainly instead of writing “we may collect certain information” and leaving you to guess.

It covers visitors to this website, people who send us an enquiry, and individuals whose data we handle when a client engages us. Those situations follow different rules, and the sections below keep them separate. It does not cover third-party sites we link to, and it does not override an agreement or NDA we have signed with you: where a contract and this page differ, the contract governs.

The entity. Avisha Global Technologies Pvt Ltd, a private limited company incorporated in India. Email [email protected], telephone +91-9891983813. To be confirmed: registered office address and CIN

We advise other organisations on DPDP readiness for a living, so a vague policy here would be a poor advertisement. If anything is unclear or wrong, write to us and we will correct it.

Which role we are in: data fiduciary or data processor

Under the Digital Personal Data Protection Act, 2023, responsibility follows whoever decides the purpose of processing. We occupy both roles, in clearly different circumstances.

• We are the data fiduciary for personal data this website and our own operations generate: contact form submissions, correspondence with us, and the technical logs our hosting and CDN providers produce. We decide why it is processed, so the duties in the Act sit with us.
• We are a data processor when a client gives us access to personal data belonging to their customers, patients, students or staff. There the client is the data fiduciary: they decide the purpose, and we process on documented instruction and nothing more.

If your data reached us through a client, your rights are exercised against that organisation, not us. We repeat that below, because people often write to the wrong party and lose weeks.

What this website collects

This is a static HTML website: no accounts, no login, no cart, no comments, no user-generated content. In total, the following personal data arises:

• What you type into the contact form. The exact fields are listed below. Nothing is collected there that you did not type or select yourself.
• What you write to us directly. If you email or call us, we hold that correspondence, your email address or phone number, and whatever you chose to tell us.
• Standard technical logs from serving the site. Our web host and Cloudflare, which sits in front of the site, produce the ordinary server and CDN logs any website produces — IP addresses, timestamps, requested URLs, user-agent strings. They exist to deliver pages and block abuse. We do not mine them to identify visitors, join them to enquiries, or build segments.
• Aggregate page measurement. Counts only, described below. No identifier.

That is the complete list. If you only read the site and never contact us, we hold nothing that identifies you.

What we deliberately do not collect

This section matters more than the one above it, so it is specific rather than reassuring.

• No advertising, marketing or cross-site tracking cookies. None.
• No Google Analytics, ad pixels, conversion tags or social media trackers. Nothing here follows you to another website.
• No session recording, keystroke capture, heat-mapping or device fingerprinting.
• No accounts, so no usernames and no passwords. We cannot lose a credential database because there is not one.
• No payment data: no card numbers, UPI handles or bank details anywhere on this site.
• No Aadhaar number, PAN, government identifier, financial record or health data is requested by any form here. Send one unprompted and we will ask you to stop, then delete it.
• No data-broker enrichment. We do not append your job title, company revenue or technology stack from a third-party service.
• No lead database, no CRM, no marketing automation. Submitting the form creates no record in a sales system, because there is no sales system.
• No mailing list, no newsletter and no autoresponder.

The contact form, field by field

One form exists on this site, at /contact.html. Its fields, in full:

What happens when you press send. The form posts to a PHP handler on our web host, which validates the input and emails it over authenticated SMTP through our Google Workspace account to a team mailbox. Then it stops. Your submission lives as an email, read by the people who answer enquiries, and nowhere else.

There is no CRM, no marketing automation, no lead scoring, no autoresponder and no database of submissions. If we reply and hear nothing back, any follow-up concerns that same enquiry; it does not become a marketing sequence.

Measurement, and why you see no cookie banner

We use Cloudflare Web Analytics to see which pages people read. It is cookieless: it stores nothing on your device, sets no identifier, and does not recognise you across sessions or sites.

What it reports, in aggregate: page, referrer, country, browser, device type. What it cannot tell us: who you are, whether the same individual came back, or anything a profile could be built from.

There is no consent banner here because nothing is stored on your device to consent to and no tracker to refuse. A banner that asks permission for nothing is theatre. If we ever add a cookie or a tool that identifies individuals, we will document it here and on the Cookie Policy, and add consent where the law requires it, before deployment rather than after.

The self-serve tools and the whitepapers

Two interactive tools are published here: the DPDP gap assessment and the DPDP readiness calculator. Both run entirely in your browser.

• Your answers are never transmitted to us. No network request carries them.
• Nothing is stored on any server of ours. We cannot see your score, your answers, or that you ran the tool.
• No email address is required to see your result.
• Close the tab and the answers are gone. If you want to discuss your result, you have to tell us yourself.

Our whitepapers are ungated for the same reason: you can read them without giving an email address, and because there is no gate there is no record of who read what. We would rather be read than hold a list of names.

Client and engagement data

During consulting work a client may give us access to personal data they are the data fiduciary for. This is separate from anything above, and we work to these principles:

• Documented instruction only. We process it for the purposes the engagement defines, under a written agreement. We do not decide new purposes for it.
• Least data. We work from data maps, registers and samples wherever that is sufficient, rather than asking for bulk exports because they are easier.
• Scoped access. Where system access is genuinely required, it is scoped to named people, logged, and revoked when the work ends.
• Confidentiality. Engagement material is held under NDA where one is in place, and not discussed outside the team doing the work.
• No secondary use. Never used to train models, build datasets of our own, or for marketing, and never turned into case studies.
• Return or deletion at the end of the engagement, as the contract requires. Sub-processing only where the contract permits it.

Specific terms — retention, locations, audit rights, breach timelines, sub-processors — live in the executed agreement, not here. If you are assessing us as a vendor, ask for those documents.

Lawful basis for each processing activity

Processing needs either consent or a recognised legitimate use. Each activity and its basis:

You can withdraw consent for us to hold your enquiry at any time, by email. Withdrawing it is as easy as giving it: one message, no form.

How long we keep it

Purpose limitation: we keep personal data only while it still serves the purpose it was given for, then delete it. We do not keep enquiries indefinitely on the theory that they might become useful.

• Enquiries. The email stays in the team mailbox while the conversation is live, and for a defined period afterwards so we have the context if you come back. To be confirmed: retention period for enquiry emails Then it is deleted. Ask us to delete it sooner and we will, unless a statutory record requires otherwise.
• Tool answers. Nothing to retain. They never reach us.
• Measurement and logs. Held by Cloudflare and our host under their own retention settings. The analytics contain no personal data, so there is nothing in them to delete on request.
• Client engagement data. For the duration of the engagement, then returned or deleted per the contract.
• Statutory records. Contracts, invoices and tax records are kept for the period Indian law requires. Those periods are set by statute, not by us, and an erasure request does not override them — we will tell you what is kept and why.

Who else can see your data, and where it is processed

Three third parties are involved in running this website and our email, and no others.

• Google Workspace (Google) — our email. It carries the enquiry from the form handler over authenticated SMTP and hosts the mailbox it lands in.
• Our web hosting provider — a third-party shared web host serving this static site and running the PHP form handler.
• Cloudflare — a CDN and security layer in front of the site, and the cookieless analytics.

Beyond those: we do not sell, rent, licence or trade enquiry data, and we do not share it for anyone’s marketing, including our partners’. It does not go to advertising networks, data brokers or lead-generation platforms. Nobody outside the team who answers enquiries reads it.

We would disclose personal data where legally compelled by a valid order — providing only what it requires, and telling the affected person unless prohibited.

Processing outside India

Google Workspace and Cloudflare are global services, so email and CDN or analytics data may be processed outside India. We say so plainly: a policy implying all data stays onshore when it does not is exactly what we are paid to find in other organisations’ documentation. Where the DPDP Act or a sectoral regulator restricts transfer to a particular country, we comply. For client engagements, data location is a contract term.

Your rights as a data principal, and how to exercise them

If we hold personal data about you as a data fiduciary — in practice, if you contacted us — you have these rights under the DPDP Act:

• Access. A summary of what we hold and what we have done with it.
• Correction and completion. Inaccurate data corrected, incomplete data completed, outdated data updated.
• Erasure. Your data deleted, unless a law requires us to keep it.
• Grievance redressal. A working channel to complain to, described in the next section.
• Nomination. Nominate someone to exercise these rights for you in the event of death or incapacity. Tell us in writing and we record it.

How to ask. Email [email protected]. There is no portal and no form. Put “DPDP rights request” in the subject, and include the email address or phone number you used, roughly when, and what you want done.

What happens next. We acknowledge it, search the mailbox and our records, then either do what you asked or explain precisely why we cannot — for example where a statutory record is involved. We may ask one verification question to confirm the data is yours; we will not demand identity documents we have no business holding. To be confirmed: rights-request response timeline

If your data reached us through a client, that organisation is the data fiduciary and the request belongs with them. If it comes to us, we do not act unilaterally: we route it to the client and tell you so.

Grievance redressal

If you are unhappy with how we handled your personal data or your request, you can complain and a person will answer.

1. Write to us. Email [email protected] with “Grievance” in the subject, or call +91-9891983813 and follow up in writing. Every grievance is logged with the date received.
2. We investigate and respond in writing: what we found, what we have changed, and what we will not change and why. If we got it wrong, we say so.
3. Escalate if we fail you. If your grievance is unresolved, you may complain to the Data Protection Board of India as the DPDP Act and its rules provide.

To be confirmed: grievance officer name and designation Until that designation is published here, grievances sent to the address above reach our designated privacy contact directly. We would rather publish a working email address than a name nobody monitors.

How we protect personal data

Described honestly and generally, because control detail does not belong on a public page.

• The site and the contact form are served over HTTPS, so what you type is encrypted in transit.
• Enquiries reach our mailbox over authenticated SMTP, not plain unauthenticated mail.
• Access to the enquiry mailbox is limited to the people who answer enquiries. It is not circulated around the business.
• The architecture itself removes risk: a static site with no accounts, no visitor database and no stored submissions has very little to breach.

Two limits, stated rather than glossed over. First, this page claims no certification or external audit, and we will not imply one with a logo; if a procurement questionnaire asks about our posture, ask us directly and we will answer precisely. Second, no system is immune. If a breach affecting personal data occurs, we will notify the Data Protection Board of India and affected individuals as the DPDP Act requires, and tell you what happened.

Children’s data

This website is not directed at children. It sells compliance, security and AI services to organisations, and the form asks for business contact details.

We do not knowingly collect personal data from anyone under 18, and we run no behavioural tracking, profiling or targeted advertising at all, so none of it is directed at children. If you believe a child has submitted their details through our form, tell us at [email protected] and we will delete it.

Where children’s data arises on a client engagement — schools, edtech, paediatric healthcare — it is handled as client data under contract, with the DPDP Act’s verifiable parental consent requirements applying to the client as fiduciary.

Changes to this policy, and how to reach us

We update this page when our practice changes. We do not update it to create room for collection we have not started, and we do not add speculative “we may also” clauses.

If we ever introduce a cookie, a tracker, a CRM, a mailing list or a new sub-processor that touches personal data, this page is updated before it goes live, with the date changed and the change described.

Questions, corrections, rights requests and grievances go to the same place, and a person reads them:

• Email: [email protected]
• Telephone: +91-9891983813
• Entity: Avisha Global Technologies Pvt Ltd, India

See also the Cookie Policy and the Terms.