This Privacy Policy explains how Creensight Private Limited (CIN U74999GJ2020PTC114611), a company incorporated in 2020 and registered with the Registrar of Companies, Gujarat, with its office in Ahmedabad, Gujarat, India (“Creensight”, “we”, “us” or “our”), collects, uses, shares, stores and protects personal data when you visit https://creensight.com/ (the “Website”), contact us, subscribe to our newsletter, buy a service package from our online shop, or engage us for IT services such as custom software, web and mobile development, cloud, artificial intelligence and machine learning, digital marketing or learning management system (LMS) projects.
We have written this policy to meet our obligations under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”). Because our Website is visited by people outside India, it also describes the rights available to visitors in the European Economic Area, the United Kingdom and Switzerland under the General Data Protection Regulation (“GDPR” and “UK GDPR”), and to residents of California under the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”).
By using the Website or submitting personal data to us, you acknowledge that you have read this Privacy Policy. Where the law requires your consent, we will ask for it separately and clearly, and you may withdraw it at any time.
1. Who is responsible for your data
For personal data collected through the Website, our online shop, our enquiry forms and our newsletter, Creensight Private Limited is the data fiduciary under the DPDP Act and the data controller under the GDPR. This means we decide why and how your personal data is processed.
When we build or operate software for a client and that software processes the personal data of the client’s own users, customers or employees, the client is normally the data fiduciary or controller and Creensight acts as a data processor on the client’s documented instructions. In that situation the client’s own privacy notice applies to those individuals, and our obligations are set out in the contract or data processing agreement we sign with the client.
1.1 Contact details
You can reach us about any privacy matter using the details in Section 18 of this policy. Requests sent to [email protected] with the subject line “Privacy request” are routed to the person responsible for data protection.
2. Personal data we collect
We collect only the personal data we need for the purposes described in this policy. The table below summarises the main categories.
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | Full name, email address, phone number, company name, job title | You, through the contact form, email, phone or meetings |
| Enquiry data | Service of interest, budget range, project description, files or links you share, the content of your messages | You, through the Contact Form 7 enquiry form or email |
| Newsletter data | Email address, date of subscription, unsubscribe status | You, through the footer newsletter form |
| Order and billing data | Billing name and address, GSTIN (if provided), order contents, order value, invoice details, transaction reference | You, through the WooCommerce checkout |
| Payment data | Payment status and a transaction identifier. Card, UPI or bank details are entered on the payment gateway and are not stored by us | Payment gateway provider |
| Account data | Username, encrypted password, order history (only if you create a customer account) | You |
| Technical and security data | IP address, browser type and version, device type, operating system, pages requested, referring URL, date and time of access, failed login attempts | Automatically, through our server logs and the Wordfence security plugin |
| Cookie and consent data | Your cookie preferences, session identifiers, cart contents | Automatically, through cookies (see our Cookie Policy) |
| Usage and analytics data | Pages viewed, time on page, approximate location derived from IP address | Analytics tools, only after you consent through the cookie banner |
| Recruitment data | CV, work history, portfolio links, expected salary, notice period | You, when you apply for a job |
2.1 Sensitive personal data
We do not intentionally collect sensitive personal data or information as defined in the SPDI Rules (such as passwords in plain text, financial account details, health data, biometric data or sexual orientation), or special categories of data under the GDPR. Please do not include such information in enquiry forms or messages. Passwords for customer accounts are stored only in salted, hashed form by WordPress. Payment card and bank details are processed by the payment gateway, not by us.
2.2 Data about other people
If you give us personal data about someone else, for example a colleague who should be copied on a proposal, please make sure you are entitled to do so and that the person is aware of this policy.
3. How and why we use your data
We use personal data for the following purposes:
- Responding to enquiries: reading your message, replying, scheduling a discovery call, preparing an estimate, proposal or statement of work, and following up.
- Delivering services: managing projects, sharing progress updates through our tracking system, giving developers access to the information they need, and providing maintenance and support.
- Processing orders: accepting orders for service packages in our online shop, confirming payment, issuing GST-compliant invoices, delivering the purchased service and handling refunds under our Refund & Cancellation Policy.
- Sending our newsletter: emailing articles and updates to people who have subscribed. Every email lets you unsubscribe.
- Keeping the Website secure: detecting and blocking malicious traffic, brute-force login attempts, spam and fraud, using tools such as Wordfence and WP Hide & Security Enhancer.
- Improving the Website: understanding which pages are useful and fixing errors, using aggregated analytics where you have consented.
- Recruitment: assessing applications and contacting candidates.
- Legal and compliance: keeping accounting and tax records, responding to lawful requests from authorities, enforcing our Terms & Conditions and establishing, exercising or defending legal claims.
We do not sell your personal data, we do not use it for automated decision-making that produces legal or similarly significant effects, and we do not use the content of your enquiries to train machine-learning models.
4. Legal grounds for processing
4.1 Under the DPDP Act (India)
We process digital personal data either on the basis of your consent, given through a clear affirmative action such as ticking the consent box on our enquiry form, subscribing to the newsletter or accepting cookies, or for a legitimate use permitted by Section 7 of the DPDP Act, for example where you voluntarily provide data for a specified purpose such as placing an order, or where processing is needed to comply with a law, a judgment or an order. Before or at the time we ask for consent, we tell you what data we collect and why. You can withdraw consent as easily as you gave it; withdrawal does not affect processing that happened before it.
4.2 Under the GDPR and UK GDPR
| Purpose | Legal basis |
|---|---|
| Replying to enquiries and preparing proposals | Steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Delivering contracted services and orders | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, tax and accounting records | Legal obligation (Art. 6(1)(c)) |
| Newsletter | Consent (Art. 6(1)(a)) |
| Non-essential cookies and analytics | Consent (Art. 6(1)(a)) |
| Website security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Legal claims | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can ask us for more information about that balancing test.
5. Cookies and similar technologies
The Website uses strictly necessary cookies to make pages work, keep your shopping cart, protect the login area and remember your cookie choices. Optional cookies, such as analytics cookies, are only set after you give consent through the CookieYes banner. You can change your choice at any time using the cookie settings link or button on the Website. A full list of cookies, their purposes and durations is available in our Cookie Policy.
6. Who we share your data with
We share personal data only where necessary and only with recipients who are bound to protect it. These include:
- Hosting and infrastructure providers that host the Website, our databases, backups and email.
- Payment gateway providers that process payments for WooCommerce orders. They act under their own terms and privacy policies and are regulated as payment service providers.
- Security service providers, including Wordfence (Defiant, Inc.), which receives IP addresses and request data to identify threats and maintain its threat-intelligence feed.
- Consent management: CookieYes, which records your cookie preferences.
- Email and productivity tools we use to send newsletters, communicate with you and manage projects.
- Professional advisers such as chartered accountants, auditors and lawyers, under duties of confidentiality.
- Authorities such as tax authorities, regulators, law-enforcement agencies or courts, when we are required by law or to protect our rights.
- A buyer or successor in the event of a merger, acquisition, restructuring or sale of all or part of our business, subject to equivalent protections.
Our service providers may only process personal data on our instructions and for the purposes we specify. We do not allow them to use it for their own marketing.
7. International transfers
Creensight is based in India, and personal data is primarily processed in India. Some of our service providers, such as cloud hosting, security and email providers, may store or process data in other countries, including the United States and the European Union. Under the DPDP Act, we will not transfer personal data to any country or territory that the Government of India has restricted by notification.
If you are in the EEA, the UK or Switzerland, transfers of your personal data to India or other countries that do not have an adequacy decision are protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed. You can ask us for a copy of the relevant safeguards.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a contract | Up to 24 months from the last contact, then deleted or anonymised |
| Client project and contract records | For the term of the engagement and 8 years afterwards, in line with Indian accounting and tax record-keeping requirements |
| Orders and invoices | 8 years from the end of the relevant financial year |
| Newsletter subscription | Until you unsubscribe; a suppression record is kept so we do not email you again |
| Customer account | Until you ask us to delete it, or after 3 years of inactivity |
| Security logs (Wordfence, server logs) | Normally 30 to 90 days, longer only where needed to investigate an incident |
| Job applications | 12 months, unless you agree to a longer period |
Under the DPDP Act, we erase personal data when you withdraw consent or when the purpose for which it was collected is no longer being served, unless we must keep it to comply with law.
9. How we protect your data
We implement reasonable security practices and procedures in line with Rule 8 of the SPDI Rules and the security safeguards required by the DPDP Act. These include:
- encryption of data in transit using HTTPS/TLS across the Website;
- a web application firewall, malware scanning, login-attempt limits and two-factor authentication for administrator accounts through Wordfence;
- hardening of the WordPress installation, including WP Hide & Security Enhancer to reduce exposure of default paths and a non-default database table prefix;
- role-based access, so staff and contractors can access only the data their work requires;
- regular software updates, backups and restoration tests;
- confidentiality obligations for employees and contractors;
- contractual security requirements for our service providers.
No method of transmission or storage is completely secure. If a personal data breach occurs, we will act promptly to contain it and will notify the Data Protection Board of India, affected individuals and, where applicable, the Indian Computer Emergency Response Team (CERT-In) and any relevant supervisory authority, as required by law.
10. Children’s data
The Website and our services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18 years of age. Under the DPDP Act, processing a child’s data requires verifiable consent from a parent or lawful guardian, and we do not track, behaviourally monitor or target advertising at children. If you believe a child has given us personal data, please contact us and we will delete it.
Where we build an LMS or another platform for a client that will be used by students under 18, the client is responsible, as data fiduciary, for obtaining parental consent. We help clients implement the required consent and age-verification features.
11. Your rights under Indian law
Under the DPDP Act, as a data principal you have the right to:
- access information about the personal data we process, the processing activities, and the identities of other data fiduciaries and processors with whom it has been shared;
- correct, complete or update inaccurate or incomplete data;
- erase personal data that is no longer needed, subject to legal retention requirements;
- withdraw consent at any time;
- grievance redressal through our Grievance Officer, and, if you are not satisfied, to complain to the Data Protection Board of India;
- nominate another person to exercise your rights in the event of your death or incapacity.
Under the SPDI Rules you may also review the information you have provided and ask for it to be corrected.
12. Your rights under the GDPR and UK GDPR
If you are in the EEA, the UK or Switzerland, you have the right to access your personal data, to rectification, to erasure, to restriction of processing, to data portability, to object to processing based on legitimate interests or for direct marketing, and to withdraw consent. You also have the right to lodge a complaint with the supervisory authority in your country of residence or work, although we would appreciate the chance to resolve your concern first.
13. Your rights under the CCPA/CPRA (California)
If you are a California resident, you have the right to know what personal information we collect, use and disclose; to request deletion; to correct inaccurate information; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights.
We do not sell personal information and we do not share it for cross-context behavioural advertising. In the last 12 months we have collected the categories of personal information described in Section 2 (identifiers, commercial information, internet or network activity information, and professional information), for the business purposes described in Section 3, and we have disclosed them only to the service providers described in Section 6. We honour Global Privacy Control signals as an opt-out of non-essential cookies where technically possible.
14. How to exercise your rights
Email [email protected] with the subject line “Privacy request”, describing what you would like us to do. To protect your data, we may ask you to confirm your identity, for example by replying from the email address we hold. An authorised agent may make a request on your behalf if they provide written proof of authority.
We will acknowledge your request within 72 hours and respond within 30 days. If a request is complex, we may extend this period where the law allows and will tell you why. We do not charge a fee unless a request is manifestly unfounded or excessive.
15. Grievance redressal
In accordance with the IT Act, the SPDI Rules and the DPDP Act, we have designated a Grievance Officer to address concerns about the processing of personal data:
- Grievance Officer, Creensight Private Limited
- Ahmedabad, Gujarat, India
- Email: [email protected] (subject: “Grievance”)
The Grievance Officer will acknowledge a grievance within 24 hours and aim to resolve it within 30 days of receipt (one month, as required under Rule 5(9) of the SPDI Rules). If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is operational for such complaints.
16. Third-party websites and services
The Website contains links to third-party websites, such as our social media pages on LinkedIn, Facebook, Instagram and X, and to the sources of open-licence images credited on our Image Credits page. We are not responsible for the privacy practices of those websites. Please read their privacy policies before providing personal data to them.
17. Changes to this policy
We may update this Privacy Policy to reflect changes in law, technology or our business. The “Last updated” date at the top of this page shows when it was last changed. If we make a material change, we will display a notice on the Website or email you where appropriate. Where a change requires your consent, we will ask for it.
18. Contact us
If you have any questions about this Privacy Policy or about how Creensight Private Limited (CIN U74999GJ2020PTC114611) handles your personal data, please contact us:
- Company: Creensight Private Limited
- CIN: U74999GJ2020PTC114611
- Registered with: Registrar of Companies, Gujarat (Ministry of Corporate Affairs, Government of India)
- Office: Ahmedabad, Gujarat, India
- Email: [email protected]
- Website: https://creensight.com/