1. Who controls the data
The site owner must identify the actual legal entity acting as controller or equivalent, its address and privacy contact before launch; do not infer these details from the brand name.
PRIVACY & DATA
Privacy Policy
This notice explains the intended handling of enquiry, client, order and document information. The published version must match the actual data flows and applicable law.
2. Scope of this notice
This notice covers information collected through the website, enquiries, orders, support, payment coordination and delivery, to the extent the provider actually controls that processing.
3. Data categories
Potential data includes contact details, jurisdiction, service selection, instructions, communications, order records, billing records and files voluntarily supplied for an order.
4. Data minimisation
Only request fields reasonably necessary for the stated service. Avoid collecting identity numbers, bank credentials, medical data or privileged records unless genuinely necessary and properly protected.
5. Purpose before collection
Explain the specific purpose at the point of collection, such as responding to an enquiry, assessing scope, performing a contract, invoicing, fraud prevention or meeting legal duties.
6. Lawful basis
For jurisdictions requiring a lawful basis, document the actual basis for each purpose, such as contract, legal obligation, legitimate interests or consent. Do not use consent as a blanket substitute for a correct legal basis.
7. Consent design
Where consent is required, make it specific, informed, freely given, affirmative and recorded. Do not bundle optional marketing consent with necessary service processing.
8. Withdrawal of consent
Provide a practical method to withdraw consent where consent is the basis. Withdrawal does not invalidate prior lawful processing or erase records that must be retained under another lawful basis.
9. Notice timing
Provide the notice at or before collection where required and explain what happens if a customer declines to provide required information.
10. Client authority
The client must have authority to submit third-party information. The provider should collect only what is needed and must handle any notice obligations that apply to data received indirectly.
11. Special-category data
Health, biometric, financial, identity, criminal, family and other sensitive information may trigger additional protections. The provider must identify relevant categories and legal conditions before accepting such material.
12. Privileged or confidential material
Do not upload privileged legal communications or confidential records unless the customer has confirmed authority and the approved secure channel and handling arrangement are in place.
13. Use for performance
Information may be used to clarify instructions, prepare the agreed deliverable, communicate progress, manage revisions and provide support for the specific order.
14. Billing and accounting
Billing, transaction, tax and accounting records may be retained as required by law and for legitimate audit, fraud-prevention and dispute purposes.
15. Security and abuse prevention
Limited technical and transaction information may be used to protect the service, detect abuse, investigate suspicious activity and maintain system integrity.
16. Marketing
Marketing communications should be sent only where permitted and with any required consent. Provide a clear unsubscribe or opt-out method and do not make service delivery conditional on optional marketing.
17. No unrelated sale
Do not sell, rent or disclose client documents for unrelated commercial purposes unless specifically disclosed and lawfully authorized. Any sale or sharing defined by local law must be addressed explicitly.
18. Service providers
Identify relevant categories of hosting, email, storage, customer-support, analytics, security and payment vendors and ensure contracts and instructions appropriately govern their access.
19. Payment providers
Payment providers generally process payment data under their own terms. The site should avoid collecting full card numbers, passwords, UPI PINs or other payment credentials directly.
20. Email applications
If a form opens a mail draft, tell users clearly that information remains in their browser until they send the email and selected attachments are not automatically transmitted.
21. Uploads and secure transfer
A file picker alone does not mean a file has been uploaded. Any future upload backend must use access controls, encryption, malware scanning, retention controls and tested deletion workflows appropriate to the risk.
22. International transfers
Disclose cross-border processing where required and put lawful transfer mechanisms in place when applicable. Do not promise that information will remain in one country unless that is operationally true.
23. Retention schedule
Set actual retention periods by data category and purpose, including enquiries, active work files, final deliverables, invoices, consent logs and security logs. Delete or anonymise data when no longer needed, subject to lawful exceptions.
24. Backups and deletion
Explain that deletion from active systems may not immediately remove protected backups, legal archives or records subject to legal hold; establish and publish realistic deletion cycles.
25. Access and correction
Provide a channel to request access to or correction of personal data where applicable, and verify the requester’s identity proportionately.
26. Deletion and erasure
Assess deletion requests under the applicable law, including exceptions for legal obligations, claims, security and recordkeeping. Do not promise absolute deletion where exceptions apply.
27. Portability and restriction
Where required by law, provide portability, restriction or objection mechanisms and explain their scope and limits.
28. Marketing opt-out rights
Honor applicable rights to object to direct marketing and maintain a minimal suppression record where needed to respect the opt-out.
29. California and other US rights
Where applicable thresholds and laws are met, provide the required notices and rights mechanisms for access, correction, deletion, portability, opt-out of sale or sharing and limits on sensitive information.
30. European and UK rights
Where GDPR or UK GDPR applies, assess rights of access, rectification, erasure, restriction, portability, objection and complaint, as well as applicable lawful bases and transfer requirements.
31. India data protection
Assess the Digital Personal Data Protection Act 2023 and notified Rules, their phased commencement and the business’s actual role before asserting compliance. Provide notices and rights mechanisms when applicable.
32. Children
The service is not intentionally designed for independent submission by children unless specifically stated. Requests involving minors require applicable age, guardian and lawful processing checks.
33. Automated decisions
If automated tools are used to classify, price, route or evaluate requests, disclose them where required and assess whether they produce legal or similarly significant effects.
34. AI and external tools
Do not submit client documents to public AI or third-party tools unless the provider has evaluated the tool, disclosed relevant processing, obtained any required authorization and applied suitable safeguards.
35. Confidentiality controls
Limit access to personnel and contractors who need information to perform assigned work; use confidentiality terms and access reviews appropriate to the risk.
36. Access logging
Where appropriate, keep records of access, changes, downloads, sharing and deletion to support investigation and accountability without collecting excessive monitoring data.
37. Security safeguards
Implement risk-appropriate administrative, technical and physical controls such as access restrictions, multi-factor authentication, encryption, patching, backups, training and vendor review; describe only controls actually implemented.
38. Breach response
Maintain a documented incident-response process and meet applicable notice deadlines to regulators and affected people. Do not promise that breaches are impossible.
39. Complaints and regulator contact
Provide a usable privacy complaint route and, where required, identify the relevant supervisory authority or regulator and explain the right to complain.
40. Data protection officer or representative
If a DPO, local representative or other contact is legally required, identify that person or role and provide accurate contact details.
41. Purpose changes
Before using data for a new incompatible purpose, provide further notice and obtain consent or another lawful basis where required.
42. Public reviews and testimonials
Use customer names, images, statements or case details only with appropriate permission and disclosures. Do not expose confidential service details in marketing.
43. Cookies and device data
Explain essential storage and any analytics, advertising, embedded media or similar technologies separately in the Cookie Policy and consent interface.
44. Do Not Track and Global Privacy Control
Assess legally required browser-based opt-out signals, including Global Privacy Control where applicable, and implement support if the business’s activities fall within those rules.
45. Record of consent
Where consent is relied upon, retain a proportionate record of what was shown, the purpose, timestamp, choice and withdrawal where required.
46. Identity verification for rights requests
Use reasonable identity verification to prevent disclosure to impostors and request only the information needed to validate the request.
47. Response periods
Respond within the statutory period applicable to the request and jurisdiction, with lawful extensions and explanations where permitted.
48. Fees for requests
Do not charge for privacy-rights requests unless the applicable law permits a reasonable fee for a manifestly unfounded or excessive request.
49. Non-discrimination
Do not unlawfully discriminate against people for exercising privacy rights. Service availability may still depend on information genuinely required to perform a requested service.
50. Third-party links
External websites and payment destinations have their own privacy practices. Review them before sharing information or paying.
51. Updates to this notice
Update this notice when processing, vendors, purposes, rights or legal requirements materially change and provide additional notice or consent where required.
52. Contact and accountability
Maintain an owner for privacy requests, a current data inventory, vendor records, retention schedules and documented review. The published notice must match actual practice, not merely aspirational policy.
Questions or requests should be sent through the website's Contact page. Do not send sensitive identity, financial, health, privileged or confidential records until the approved secure submission channel and handling arrangements are confirmed.