Privacy Policy

We collect personal data in two ways: what you type into the enquiry form, and what your browser sends automatically when you load a page.

From the enquiry form

The form on our contact page asks for the following. Only three are required.

• Full name (required) so we know who we are replying to.
• Email address (required) so we can send that reply.
• Project details (required), the free-text description of what you need. Please do not paste credentials, financial account numbers, health information or anyone else’s personal data into this box.
• Company name, phone number, country, service area of interest, budget range, timeline and preferred contact method (all optional), used to route your enquiry to the right person and to reply the way you asked us to.
• An optional file attachment (PDF, DOC, DOCX, PNG or JPG, up to 5 MB). Whatever you put in that file, we receive.
• Your consent, recorded as a ticked box with the date and time. It is not pre-ticked.

Automatically

• Standard server request data: IP address, browser user-agent string, the page requested and the time. Our hosting provider logs this for security and availability.
• For spam and abuse control, we derive a one-way hash of your IP address and user-agent and hold it briefly in memory to count submissions. We do not store the raw IP address alongside your enquiry, and the hash cannot be reversed to recover it.
• A signed timestamp is embedded in the form when the page loads, so we can reject automated submissions that arrive impossibly fast. It contains no information about you.

We do not run a chat widget, we do not use session recording or heatmaps, and we do not buy or enrich contact data from third-party brokers.

• To read your enquiry and reply to it.
• To prepare a proposal, estimate or scope document if you ask for one, and to hold the conversation that follows.
• To keep a record of the engagement if you become a client, including for invoicing and for our statutory accounting obligations.
• To detect and block spam and automated abuse of the form.

We do not use enquiry data for marketing lists, we do not add you to a newsletter because you sent an enquiry, and we do not sell or rent personal data to anyone, ever. If we ever want to send you something unrelated to your enquiry, we will ask first.

This website sets no advertising cookies and runs no advertising or social media tracking pixels.

Where we measure how the site is used, we do so with privacy-preserving, cookieless analytics that records page views and a small number of named events (for example, that an enquiry form was started or submitted successfully). It records no cookie, no cross-site identifier and no personal data, and it cannot follow you to other websites. If no analytics provider is configured, the site collects nothing at all beyond server logs.

If we later adopt a tool that does set cookies or process personal data for analytics, we will add a consent mechanism before switching it on, and update this section.

Under the Digital Personal Data Protection Act, 2023, we process the personal data you submit through the enquiry form on the basis of the consent you give by ticking the box on that form. The box is unticked by default and the form cannot be submitted without it.

You can withdraw that consent at any time, and withdrawing it is as easy as giving it: tell us using the contact route in section 11 and we will stop processing and delete the enquiry, subject only to records we are legally obliged to retain.

Where you become a client, we also process data as necessary to perform our contract with you and to meet legal obligations such as tax and accounting record-keeping.

We share personal data only with the service providers we need in order to run the site and reply to you, and only to the extent each one needs. As at the date above, those categories are:

• Website hosting and content delivery, which processes server request logs.
• Transactional email delivery, which transmits your enquiry to our inbox and any acknowledgement back to you.
• Business email and document storage, where your enquiry sits once it reaches us.
• Privacy-preserving website analytics, where configured, which receives no personal data.

Each is engaged under its own terms and processes data on our instructions. We do not disclose personal data to anyone else except where we are legally required to, or to establish or defend a legal claim.

TODO(verify): name each processor explicitly once the hosting, email and analytics providers are contracted. A named list is materially more useful to a reader than these categories, and is expected under DPDP transparency obligations.

How long we keep things

• Enquiries that do not become projects: retained for 24 months, then deleted. Enquiries frequently revive after a year, which is the only reason the period is that long. Ask us and we will delete yours sooner.
• Enquiries that become projects: retained for the life of the engagement and then in line with our contractual and statutory record-keeping obligations.
• Attachments: deleted on the same schedule as the enquiry they came with.
• Server request logs: retained per our hosting provider’s default period, typically short.
• Spam-control hashes: held in memory only and discarded within 24 hours or on server restart, whichever comes first.

How we protect it

• The whole site is served over HTTPS with HSTS. There is no plain-text route in.
• Form submissions are validated on the server, and uploaded files are checked by their actual content rather than by their claimed file type.
• Access to enquiries is limited to the people who need to answer them, on accounts with multi-factor authentication.
• Credentials for email and hosting are held in environment variables on the server and are never present in the code sent to your browser.

No system is perfectly secure, and we will not claim otherwise. If a breach affecting your personal data occurs, we will notify you and the Data Protection Board of India as required.

We are based in Bhavnagar, Gujarat, India, and work with clients in other countries. Some of the service providers described in section 5 operate infrastructure outside India, so your data may be processed outside India. Where that happens we rely on the provider’s contractual data protection terms, and transfers are subject to any restrictions the Central Government notifies under the DPDP Act.

You can ask us to:

• Tell you what we hold about you and who we have shared it with.
• Correct or complete anything inaccurate or out of date.
• Erase your data, where we are not legally required to keep it.
• Withdraw your consent, which stops further processing.
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Complain to us, and then to the Data Protection Board of India if we do not resolve it.

Use the contact route in section 11. We will respond within 30 days. We may ask you a question to confirm you are who you say you are, because handing your data to someone impersonating you would be a worse outcome than a short delay.

This is a business-to-business website. It is not directed at children, and we do not knowingly collect personal data of anyone under 18. If you believe a child has submitted data through this site, tell us and we will delete it.

We update this policy when what we do changes. The date at the top always reflects the current version. If a change materially affects how we handle data you have already given us, we will contact you rather than rely on you noticing.

For any request or complaint about your personal data, contact us through the enquiry form, and write “Data request” in the first line of the message so it is routed correctly.

You can also call +91 76006 17300.

TODO(verify): a dedicated, monitored email address for data requests, and the name and contact details of the person responsible for answering them, must be published here. The address on the previous site was a typo and undeliverable, so nothing is shown until a working inbox is confirmed in writing. Under the DPDP Act a data principal must have a working route to a grievance contact; the enquiry form is that route until this line is replaced.

TODO(verify): the exact registered entity name and its registered address must appear here as the data fiduciary. ConnectGo Infoware is the trading name used across the site; the registered legal entity and address have not yet been confirmed in writing and two conflicting addresses are publicly visible.