Privacy Notice

1 · Who I am

I am Amit Verma, an independent technology, operations and assurance consultant based in Pune, India. For the purposes of India's Digital Personal Data Protection Act, 2023 and the Rules made under it, I am the Data Fiduciary: the person who decides why and how personal data is processed.

You can reach me about anything in this notice, including any question about your personal data, at amit@nvirex.com. That address is the correct route for a personal-data query, and I will respond to it.

2 · What I collect

Everything I handle is business personal data. This is professional correspondence between adults about work: it is not consumer data, and I do not collect data about children or run any service aimed at them.

I do not knowingly collect personal data from children, I do not process personal data with the consent of a parent or guardian, and nothing on this site is directed at children.

• Contact details you give me: name, work email, phone number, organisation and role.
• Correspondence: emails, messages, call notes and meeting notes, including any documents you attach.
• Engagement information: what we agreed to do, what I found, and what I advised. Where an engagement involves reviewing a client's own systems and records, I work on that data under the client's instructions and do not keep a separate copy beyond the engagement record.
• Job application material: if you approach me about a role or send a CV, I hold that material for the purpose of the recruitment conversation.
• Website request logs: my hosting provider records standard server information, which can include an IP address, when a page is requested.

3 · Where it comes from, and on what basis I hold it

I process personal data on three bases, and I would rather state them precisely than imply a consent I do not hold.

3.1 Data you give me directly

Where you write to me, request a conversation or privacy-policy review, or engage me, the basis is your voluntary provision of the data for the purpose you provided it (Section 7(a) of the Act). I use it to answer you and to deliver what we agreed.

3.2 Data from publicly available professional sources

I sometimes reach out to people about my consulting services. Some of those contacts come from publicly available professional sources, such as LinkedIn profiles and company websites. Where that is the case, I rely on the legitimate-use basis for publicly available data (Section 7(a)), not on consent, because I do not have your consent and will not pretend otherwise.

If you would prefer not to hear from me, tell me once and I will stop. I record that request and honour it (see sections 7 and 8).

3.3 Engagement data

Where you engage me, I process the personal data needed to deliver the engagement under our contract (Section 7(b)). Where an engagement involves me reviewing your systems or records, I act on your written instructions, I process that data only for the agreed purpose, and I do not repurpose it.

4 · Notice under Section 5

This section sets out the notice the Act requires when personal data is processed.

• The personal data: as described in section 2.
• The purpose: answering enquiries, delivering engagements, maintaining business records, recruitment conversations, and outreach about my services.
• How to exercise your rights: write to amit@nvirex.com. Section 8 lists what you can ask for.
• How to complain: the Data Protection Board of India. You may also raise it with me first, and I would prefer that you did, because I can usually resolve it faster.

5 · What I do not do

• I do not sell, rent or trade personal data.
• I do not share personal data for anyone else's marketing.
• I do not use automated decision-making or profiling, and I make no decision about you by machine alone.
• I do not collect more than I need for the purpose in front of me.

6 · Who I share it with

I share personal data only with service providers I use to run the practice, and only as much as each needs. They fall into these categories:

• Email hosting, for correspondence and mailbox storage.
• Cloud storage, for documents and records.
• Outreach and contact management tooling, for prospect records.
• Website hosting and build platform, which processes standard request logs.
• Professional advisers, where I need accounting, tax or legal input, and only as relevant.

Each of these acts as a Data Processor under Section 2(k): they process personal data only on my written instruction and only for the purposes I set. I keep written terms with each of them, and I review those terms and this list once a year.

I may also disclose personal data where the law requires it, such as a lawful request from a regulator, a court or a tax authority.

7 · How long I keep it

These are the periods I actually apply. Where a purpose ends sooner, or where you withdraw or object, I erase sooner rather than later. I keep data longer only where a legal obligation requires it.

On the suppression record: if you tell me to stop contacting you, I keep your name and a flag that says so, and nothing else. I keep it indefinitely so that you are not contacted again by mistake. That is minimal processing to honour an objection under Section 6(6), and it is the one record I retain rather than erase.

8 · Your rights

Under the Act you can, in relation to the personal data I hold about you:

• Ask for access, and for a summary of the data I hold and how I process it (Section 11).
• Ask me to correct, complete, update or erase it (Section 12).
• Raise a grievance with me, which is the route to try first (Section 13).
• Nominate someone to exercise your rights if you die or become incapable of doing so (Section 14).
• Withdraw any consent you gave me, as easily as you gave it (Section 6(4)).

To use any of these, write to amit@nvirex.com. I do not need a form and I do not need a reason. I will tell you what I did, and if I cannot do what you asked I will tell you why.

9 · If you have a grievance, or want to complain

Start with me. Write to amit@nvirex.com and I will look into it and respond. Raising it with me is the route the Act expects you to try first (Section 13).

If you are not satisfied with my response, you can complain to the Data Protection Board of India. The Board is the statutory authority that hears complaints about the handling of personal data under the Act, and the Board's route ordinarily follows a genuine attempt at the internal one.

10 · Cookies, analytics and tracking

This website does not set cookies on your device, does not run analytics, and does not use advertising or tracking pixels. There is no cookie banner because there is nothing to consent to.

My hosting provider records standard server logs when a page is requested, which can include an IP address. Those logs exist for security and for keeping the site working. I do not use them to build a profile of anyone, and I do not combine them with anything else.

11 · Security

I apply reasonable security safeguards to the personal data I hold. In practice that means encryption of data at rest including backups, multi-factor authentication on every account that can reach personal data, access restricted to me as the only person who needs it, confidence that server logs are retained for at least a year, and monitoring for unauthorised access.

Because this is a sole practice, the practical controls are a mailbox and cloud storage protected by multi-factor authentication, encrypted devices, and encrypted backups. If I ever find a security failure that affects your personal data, section 12 explains what happens.

12 · If there is a data breach

If a personal data breach occurs that affects you, I will notify you and the Data Protection Board of India without delay. My notice to you will describe what happened, what it may mean for you, what I have done about it, and how to reach me to follow up. A detailed report follows to the Board within 72 hours of my becoming aware, unless the Board allows longer.

I would rather tell you promptly and imperfectly than wait for a complete picture. That is what the requirement asks for, and it is what I would want if the positions were reversed.

13 · Changes to this notice

If I change how I handle personal data, I will update this notice and change the date at the top. If the change is significant, I will say so plainly rather than bury it. This notice is reviewed once a year as a matter of routine.

This notice is available in English. If you would like it in another language listed in the Eighth Schedule to the Constitution, ask me and I will provide it.