Effective date: [date this policy goes live]Last updated: [date this policy goes live]

1. Who we are

This website is operated by [proprietor's full legal name], carrying on business as "Markitect" ("Markitect", "we", "us", "our"), a sole proprietorship based in India, with its principal place of business in Mumbai, India. [GST or other registration number, if applicable.]

We take the privacy of the people who visit our website and get in touch with us seriously. This policy explains what personal data we collect through our website, why we collect it, how we use and protect it, and the rights you have over it.

For the purposes of this policy, we act as the data fiduciary (equivalent to a data controller) for the personal data described below. Under the Information Technology Act 2000 and the associated SPDI Rules 2011, and under the Digital Personal Data Protection Act 2023 as it comes into force, we are responsible for the personal data we collect through this website.

2. What this policy covers

This policy applies only to personal data we collect through this website, namely:

• Data you submit through our enquiry, contact, or "book a call" forms.
• Data you provide when you subscribe to our newsletter or marketing communications.
• Data collected automatically through cookies, analytics, and server logs when you browse the site.

This policy does not cover personal data we process on behalf of our clients while delivering our services. That data is governed by our master services agreements and separate data processing agreements with each client, not by this website policy. Section 15 explains this in more detail.

3. The personal data we collect

Depending on how you interact with the site, we may collect:

Data you give us directly

• Identity and contact details: your name, work email address, phone number, company name, and job title.
• The content of any message, enquiry, or brief you send us through a form or by email.
• Your email address if you subscribe to our newsletter.

Data we collect automatically

• Technical and usage data: your IP address, browser type and version, device type, operating system, referring URLs, the pages you view, and the dates and times of your visits.
• Data collected through cookies and similar technologies, as described in section 7.
• Server log data generated when your browser requests pages from our site.

We do not knowingly collect sensitive personal data (such as financial account details, health data, or government identifiers) through this website, and we ask that you do not submit such data through our forms.

4. How we collect your data

We collect personal data when you:

• Complete and submit a form on our site.
• Subscribe to our newsletter or marketing list.
• Email us or otherwise contact us using the details on the site.
• Browse the site, through cookies, analytics tools, and server logs.

5. The lawful basis for processing

We process your personal data on the following grounds.

Consent. Where the DPDP Act requires it, we process your personal data on the basis of the consent you give when you submit a form or subscribe. Before or at the point of collection, we tell you what data we are collecting and why. Your consent is free, specific, informed, and unconditional, and you can withdraw it at any time (see section 12). Withdrawing consent does not affect processing carried out before the withdrawal.

Legitimate uses and legal obligations. In some cases we process data because it is necessary to respond to a request you have made, to run and secure our website, or to comply with a legal or regulatory obligation.

6. How we use your personal data

We use your personal data to:

• Respond to your enquiry, arrange and hold a discovery call, and provide the information you have asked for.
• Send you newsletters and marketing communications you have subscribed to, and let you unsubscribe at any time.
• Operate, maintain, secure, and improve our website.
• Understand how visitors use the site so we can make it more useful.
• Keep records, and meet our legal, accounting, and reporting obligations.
• Detect, prevent, and address technical issues, fraud, or misuse.

We do not sell your personal data. We do not use your data for automated decision-making that produces legal or similarly significant effects on you.

7. Cookies and analytics

Our website uses cookies and similar technologies to make the site work, to remember your preferences, and to understand how the site is used.

• Essential cookies are needed for the site to function and cannot be switched off in our systems.
• Analytics cookies help us understand how visitors interact with the site, for example which pages are most visited. We use [name your analytics provider, for example Google Analytics 4] for this.
• Marketing cookies, if used, help us measure the effectiveness of our campaigns. [Remove this bullet if you do not run ad pixels or marketing cookies.]

Where required by law, we will ask for your consent before setting non-essential cookies, through a cookie banner. You can manage or refuse cookies through your browser settings, though some parts of the site may not work properly if you do. [If you publish a separate cookie policy, link it here.]

8. Who we share your data with

We do not sell or rent your personal data. We share it only in the following circumstances, and only to the extent necessary:

• Service providers and processors who help us run the website and our business, such as hosting, email, analytics, and customer-relationship tools. They act on our instructions and are bound to protect your data.
• Professional advisers such as lawyers, accountants, and auditors, where reasonably necessary.
• Authorities and other parties where required to comply with law, enforce our terms, or protect our rights, property, or safety, or those of others.
• A successor entity in connection with a sale, merger, or reorganisation of our business, subject to this policy.

9. Cross-border transfers

We may transfer, store, or process personal data outside India, including where our service providers operate from other jurisdictions. Where we do so, we take reasonable steps to ensure the data remains protected in line with this policy and applicable law. Transfers are made in accordance with the DPDP Act, including any restrictions the Central Government may notify on transfers to specified countries.

10. How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this policy, or for as long as required to meet legal, accounting, or reporting obligations. When personal data is no longer required and no legal ground for retention applies, we erase it or anonymise it. Newsletter data is kept until you unsubscribe.

11. How we protect your data

We maintain reasonable security safeguards designed to protect personal data against unauthorised access, disclosure, alteration, and loss. These include access controls, encryption in transit where appropriate, and internal policies that limit who can access personal data. No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

If a personal data breach affects your data, we will take steps to address it and will notify you and the Data Protection Board of India where required under the DPDP Act and Rules, and comply with any obligations under the IT Act and CERT-In directions.

12. Your rights

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correction and completion of inaccurate or incomplete personal data, and updating of out-of-date data.
• Erasure of your personal data where it is no longer needed for the purpose it was collected, unless retention is required by law.
• Grievance redressal for any concern about our handling of your personal data.
• Nomination of another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Withdraw consent at any time, as described in section 5.

We will respond to valid requests within the timelines required under applicable law. We may need to verify your identity before acting on a request.

13. How to exercise your rights and raise a grievance

To exercise any right, or to raise a concern about how we handle your personal data, contact us via legal@markitect.io:

We aim to acknowledge grievances promptly and resolve them within the timelines set out under applicable law. If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India once the relevant provisions are in force.

14. Children's data

Our website and services are intended for business users and are not directed at children. We do not knowingly collect personal data from anyone under the age of 18 through this website. If you believe a child has provided us personal data, contact our Grievance Officer and we will take appropriate steps to delete it.

15. Personal data we process for our clients

When we deliver services to our clients, we may process personal data that belongs to, or is controlled by, those clients. In that context we act as a data processor on the client's instructions, not as the fiduciary. That processing is governed by the services agreement and data processing agreement we sign with each client, and is not covered by this website policy. If you are an individual whose data is processed as part of a client engagement, please contact the relevant client, who is the fiduciary for that data.

16. Third-party links

Our website may contain links to third-party websites, tools, or resources. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policy of any third-party site you visit.

17. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. When we do, we will revise the "last updated" date at the top of this page. Where changes are significant, we will take reasonable steps to notify you. We encourage you to review this page periodically.

18. Contact us

For any questions about this policy or about how we handle your personal data, contact us at: legal@markitect.io