Loading page content
This notice explains what personal data DATATrust India collects through this website and our business operations, why we process it, who we share it with, how long we keep it and what rights you have.
It is structured to satisfy the itemised notice requirement under the Digital Personal Data Protection Act, 2023 and the transparency obligations of Articles 13 and 14 of the GDPR where those apply. Where the two regimes differ, we have applied the more protective standard.
DATA Trust India Consulting, trading as DATATrust India, is the Data Fiduciary for the personal data described in this notice. Our registered office is at B-313, 3rd Floor, Ansal Chambers-1, Bhikaji Cama Place, New Delhi, Delhi 110066, India.
We have appointed a Data Protection Officer based in India who is accountable to our board. You can contact them directly at dpo@datatrustindia.com. Where we act as a Data Processor for a client, that client is the Data Fiduciary and this notice does not govern their processing.
We collect only what we need for the purpose stated, and we do not collect special category or sensitive personal data through this website. The table below itemises each category and the purpose for which we process it.
| Category of personal data | Purpose of processing |
|---|---|
| Name, work email, organisation, role, phone | Responding to an enquiry, scoping an engagement, and maintaining our record of the conversation. |
| Enquiry content and topic | Understanding your requirement and routing it to the right practice lead. |
| Email address (newsletter) | Sending The Digital Trust Brief, on consent you may withdraw at any time. |
| Name, work email, organisation, role (resource download) | Delivering the requested resource and notifying you when a new version is published. |
| Name, email, phone, experience, application content | Assessing your application for a role and communicating with you about it. |
| Website usage data (pages viewed, referrer, approximate region, device type) | Understanding which content is useful and detecting abuse of our forms. Collected in aggregate and not used to build individual profiles. |
| IP address (transient) | Rate limiting our public form endpoints to prevent abuse. Not stored beyond the rate-limit window. |
Under the Digital Personal Data Protection Act, 2023 we process your personal data on the basis of the consent you give when you submit a form, or where a listed legitimate use applies — for example, where you have voluntarily provided your data for a specified purpose and have not indicated that you object to its use for that purpose.
Where the GDPR applies to our processing, we rely on consent for marketing communications, contractual necessity for engagement delivery, and legitimate interests for responding to business enquiries and protecting our systems from abuse. Where we rely on legitimate interests, we have completed a balancing assessment and you may object at any time.
This section exists because it is the part most readers care about, and because stating it publicly constrains us.
Our primary infrastructure is hosted in India. Some processors we use — notably for email delivery and content distribution — may process data outside India.
Where personal data subject to the GDPR is transferred to India or elsewhere outside the EEA, we rely on the European Commission's Standard Contractual Clauses and have completed a transfer impact assessment for each route, applying supplementary technical measures where that assessment indicated residual risk.
Under the DPDPA, cross-border transfer is permitted to any country other than those restricted by notification of the Central Government. We monitor that list and will adjust our processing if it changes.
We erase personal data once the purpose for which it was collected is served, unless retention is required by law. Our schedule is below.
| Data | Retention period |
|---|---|
| Enquiry that did not proceed to an engagement | 24 months from last contact, then erased. |
| Enquiry that became an engagement | Duration of the engagement plus 7 years, for professional and tax purposes. |
| Newsletter subscription | Until you unsubscribe, then erased within 30 days. |
| Resource download record | 24 months, to notify you of new versions, then erased. |
| Unsuccessful job application | 12 months, unless you ask us to keep it longer for future roles. |
| Aggregated website analytics | 14 months, in aggregate form only. |
| Transient IP for rate limiting | Discarded when the rate-limit window closes, within minutes. |
As a Data Principal under the DPDPA, you have the following rights, and we will not make it difficult to exercise any of them.
Email dpo@datatrustindia.com with the right you wish to exercise. We will acknowledge within three working days and respond substantively within the statutory period. We may ask you to verify your identity before acting, and we will ask for no more information than is necessary to do so.
There is no charge for exercising a right. We will not ask you why you are exercising it.
We hold ourselves to the standards we advise clients to meet. Our technical and organisational measures include encryption in transit and at rest, role-based access control with least privilege, multi-factor authentication on all administrative access, centralised logging with retention that meets CERT-In requirements, and quarterly access certification.
Our own information security management system is aligned to ISO/IEC 27001, we run an annual independent penetration test, and we operate a documented personal data breach response process rehearsed at least annually.
We will assess any personal data breach without delay and intimate the Data Protection Board of India and each affected Data Principal in the form and manner prescribed under the DPDPA. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay where there is a high risk to their rights and freedoms.
If you believe you have found a vulnerability in our systems, please report it to security@datatrustindia.com. We welcome coordinated disclosure and will not pursue action against good-faith security research.
This website and our services are directed at business professionals and are not intended for anyone under 18. We do not knowingly collect personal data from children, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
If you believe a child has provided us with personal data, contact dpo@datatrustindia.com and we will erase it.
We revise this notice when our processing changes or when the law does. The effective date and last updated date at the top of this page always reflect the current version.
Where a change materially affects how we process your personal data, we will notify you directly — by email if we hold your address for that purpose — rather than relying on you noticing a date change. We retain previous versions and will provide them on request.
For any question, request or complaint relating to this document, contact our Data Protection Officer at dpo@datatrustindia.com, or write to us at B-313, 3rd Floor, Ansal Chambers-1, Bhikaji Cama Place, New Delhi, Delhi 110066, India.
We acknowledge every request within three working days and respond substantively within the statutory period. If you are not satisfied with our response, you may escalate to the Data Protection Board of India or, where the GDPR applies to the processing, to your local supervisory authority.