Privacy Notice
What personal data we process, why, on what basis, who receives it, how long we keep it, and how to exercise your rights. Written as plainly as we would advise a client to write theirs.
- Data Fiduciary
- Vedhacon
- Version
- 2.1
- Effective
- Reading time
- 14 min
On this page
- Who we are
- What this notice covers
- When we work on a client’s behalf
- Personal data we collect, and why
- Where data comes from, and what is required
- Legal basis
- Consent and withdrawal
- How we use data, and what we never do
- Who receives it
- International transfers
- How long we keep it
- Security safeguards
- Personal data breaches
- Your rights
- Your duties
- Children and persons with disability
- Grievances and the Data Protection Board
- GDPR, UK GDPR and readers outside India
- Changes and version history
- Contact
Who we are
Vedhacon (“Vedhacon”, “we”, “us”) provides privacy and GRC education, consultancy and implementation services and operates www.vedhacon.com. For the personal data described in this notice, Vedhacon decides why and how it is processed. Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary and you are the Data Principal.
Questions about how we process your personal data are answered by our privacy contact at enquiry@vedhacon.com. Vedhacon has not been notified as a Significant Data Fiduciary, so the DPDP Act does not require it to appoint a Data Protection Officer. If that changes, we will name the DPO here.
| Data Fiduciary (DPDP Act) / controller (GDPR, UK GDPR) | Vedhacon |
|---|---|
| Location | Kolkata, West Bengal, India |
| Privacy contact (DPDP s. 8(9), rule 9; GDPR art. 13(1)(a)) | enquiry@vedhacon.com, who can answer questions about the processing of your personal data on our behalf |
| Data Protection Officer | Not appointed. Vedhacon is not a Significant Data Fiduciary under the DPDP Act and does not meet the conditions in GDPR article 37 |
| EU / UK representative (GDPR art. 27) | Not appointed. Our processing of EU and UK residents’ data is occasional, does not include special-category data on a large scale and is unlikely to result in a risk to individuals (art. 27(2)(a)). If that changes, we will name a representative here |
What this notice covers
This notice is given under section 5 of the DPDP Act and rule 3 of the DPDP Rules, 2025. It covers personal data processed when you:
- browse www.vedhacon.com;
- use the browser-based tools, such as the readiness checker, DPIA, RoPA, vendor and audit templates;
- send an enquiry through the contact form or by email, including enquiries about the GRC Academy or Community.
Client engagements are governed by the engagement agreement and any engagement-specific notice. If you contacted us before this version took effect, this notice now applies to that data as well, as section 5(2) requires.
When we work on a client’s behalf
During consultancy, DPO-as-a-service, audit and implementation work, clients may share documents such as contracts, policies, records of processing, audit evidence and incident files. These can contain the names, business contact details and roles of the client’s staff, customers and suppliers.
- For that data the client is the Data Fiduciary (controller) and Vedhacon acts as its Data Processor (processor) under the engagement agreement (DPDP Act section 8(1) and 8(2); GDPR article 28).
- We use it only to deliver the agreed work, on a need-to-know basis, and never for any unrelated purpose.
- We return or erase it at the end of the engagement, as the agreement sets out.
- If your data appears in a client’s documents, please send requests to that organisation first. We will help it respond.
Personal data we collect, and why
The tables below list, item by item, the personal data we process at each touchpoint and the specific purpose for each item. We collect only what the purpose needs. We do not ask for financial account details, health, biometric or genetic data, government identifiers or passwords.
Contact form and email enquiries
| Data item | Status | Purpose | Legal basis |
|---|---|---|---|
| Full name | Required | Addressing you and recording who made the enquiry | s. 6 Consent |
| Work email | Required | Replying to you and continuing the conversation | s. 6 Consent |
| Organisation | Optional | Understanding the context of your request | s. 6 Consent |
| Country or region | Optional | Identifying the laws relevant to your request | s. 6 Consent |
| Topic | Optional | Routing your enquiry to the right practitioner | s. 6 Consent |
| Message, and anything you attach to an email | You choose | Understanding and answering your request | s. 6 Consent |
| Consent record (checkbox, time of submission) | Required | Showing that you agreed to us using your details to respond | s. 6 Consent |
Please do not include personal data about other people, sensitive personal data or confidential incident details in a first message. If you need to share them, we will agree a secure channel first.
Visiting the website
| Data item | Status | Purpose | Legal basis |
|---|---|---|---|
| IP address, browser and device type, page requested, date and time | Automatic | Delivering the pages you ask for, preventing abuse and investigating security events | s. 7(a) Voluntarily provided and the security duty in s. 8(5) and rule 6 |
| Form spam check (a hidden honeypot field) | Automatic | Filtering automated spam submissions. No personal data is collected by it | s. 7(a) Voluntarily provided |
Browser storage
| Item | Status | Purpose | Legal basis |
|---|---|---|---|
vedhaconConsent: your consent choices, policy version, time and method | Automatic On your device | Remembering and evidencing your cookie and storage choices. Re-asked after 180 days or when the policy changes | Strictly necessary; no consent required |
vxGeo, vxGeoFlag: the jurisdiction you selected | Optional On your device | Keeping guidance relevant between visits. Set only if you allow preferences | s. 6 Consent |
vx_dpia, vx_ropa, vx_vendor, vx_audit: tool drafts | Optional On your device | Keeping a draft you choose to save in a tool. Stays on your device and is never sent to us | Your own action; not processed by Vedhacon |
These are the technical names your browser shows in its developer tools. The vx prefix is simply Vedhacon’s short label for its own first-party items, so they do not clash with other sites. None is a third-party cookie, and none is read by anyone but this website on your device.
Third-party content
Fonts are delivered by Google Fonts and icons by the cdnjs network (Cloudflare). When they deliver those files they receive standard request data, such as your IP address and browser type. We do not use them to identify or track you.
What we do not collect
- No advertising, retargeting or social-media tracking pixels.
- No third-party analytics. If analytics are ever introduced, they will run only if you opt in, and this notice will be updated first.
- No accounts or logins on this website.
- The AI Assistant is not active. Before it is switched on, this notice will describe what it processes.
Other relationships with us
If you deal with us beyond this website, we process the following, each for the stated purpose only. A separate, engagement-specific notice may add detail.
| Relationship | Data items | Purpose | Basis (DPDP / GDPR) |
|---|---|---|---|
| Clients and their contacts | Name, role, business email and phone, engagement correspondence, invoices | Delivering the agreed service, billing, keeping records the law requires | s. 7(a) voluntarily provided and s. 7 legal obligations / art. 6(1)(b) contract, 6(1)(c) legal obligation |
| Training and Academy participants | Name, email, organisation, attendance, assessment results, certificate details | Running the course, issuing and verifying certificates | s. 6 consent / art. 6(1)(b) contract |
| Updates you sign up for | Name, email, topics chosen, sign-up record | Sending the updates you asked for. Every message has an unsubscribe link | s. 6 consent / art. 6(1)(a) consent |
| Job and associate applicants | CV, contact details, interview notes, references you give us | Assessing your application | s. 6 consent / art. 6(1)(b) steps before a contract and 6(1)(f) legitimate interest in recruiting |
Where data comes from, and what is required
Sources. We collect personal data directly from you. The only exceptions are: business contact details a client gives us so that we can work with its staff, a referee you name in an application, and technical request data your browser sends automatically. We do not buy personal data or collect it from data brokers. Where we receive data about you from someone else, we tell you within one month at the latest, as GDPR article 14 requires, unless you already have this information.
Is providing data required? No law requires you to give us personal data. Name and work email are needed to answer an enquiry, and some details are a contractual requirement for an engagement or a course. If you do not provide them, we may be unable to respond or to deliver the service. Optional fields can be left blank with no consequence.
Sensitive data. We do not ask for special-category data under GDPR article 9, such as health, biometric, genetic, religious or political data, or data about criminal convictions. Please do not send it to us.
Legal basis
Section 4 of the DPDP Act allows personal data to be processed only for a lawful purpose, with consent or for a “certain legitimate use” under section 7.
| Basis | Where we use it | What it means for you |
|---|---|---|
| Consent, s. 6 | Enquiries, optional form fields and preference storage | Free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. You can withdraw it at any time |
| Voluntarily provided, s. 7(a) | Technical data you send when you request a page | Used only for the purpose it was provided for: delivering and securing the page |
| Compliance with law, s. 8 and the Rules | Security logs, breach records, records of processing | Kept because the DPDP Act and Rules require it, and only for as long as they require |
Lawful bases under the GDPR and UK GDPR
Where the GDPR or UK GDPR applies (articles 6 and 13(1)(c) and (d)), we rely on the following.
| Lawful basis | Where we use it |
|---|---|
| Consent, art. 6(1)(a) | Preference storage, updates you sign up for, optional enquiry fields. You can withdraw at any time (art. 7(3)) |
| Contract, art. 6(1)(b) | Answering enquiries about our services at your request, delivering engagements and courses |
| Legal obligation, art. 6(1)(c) | Tax and accounting records, breach records, responding to lawful requests |
| Legitimate interests, art. 6(1)(f) | Keeping the website secure and preventing abuse; answering correspondence that is not about a service; defending legal claims. We have balanced these interests against your rights, and you can ask for a copy of that assessment or object at any time |
Consent and withdrawal
You can withdraw your consent at any time, as easily as you gave it (section 6(4)):
- Storage preferences: , or clear this site’s data in your browser settings.
- Enquiry data: email enquiry@vedhacon.com with the subject “Withdraw consent”.
Withdrawing consent does not affect processing that took place before it (section 6(5)). Once you withdraw, we will, within a reasonable time, stop processing and have our Data Processors stop processing that data, unless the law requires us to keep it (section 6(6)). The only consequence is that we may not be able to respond to an open enquiry. Where a registered Consent Manager is available to you, you may also give, manage or withdraw consent through it (section 6(7) to 6(9)).
How we use data, and what we never do
We use personal data only for the purposes listed in the tables above: to respond to you, to deliver and secure the website, and to remember choices you ask us to remember.
- We never sell or rent personal data.
- We never use it for profiling, behavioural monitoring or targeted advertising.
- We make no decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects (GDPR article 22).
- We do not add you to a mailing list because you made an enquiry.
- We do not use your enquiry to train AI models.
Who receives it
We share personal data only with Data Processors who act on our instructions under a contract, as section 8(2) requires, and only for the purposes in this notice.
| Recipient | Role | Data | Location |
|---|---|---|---|
| Netlify | Hosting and form handling (Data Processor) | Technical request data, contact form submissions | United States and global edge network |
| Our email provider | Email hosting (Data Processor) | Enquiry correspondence | May be outside India |
| Google Fonts | Font delivery (independent provider) | IP address and browser data when fonts load | Global |
| cdnjs (Cloudflare) | Icon delivery (independent provider) | IP address and browser data when icons load | Global |
We may also disclose personal data where Indian or other applicable law requires it, for example to a court, regulator or law-enforcement agency acting within its powers. We will tell you before we add a new category of recipient.
International transfers
Some of our providers process data outside India. Section 16 of the DPDP Act permits transfers except to countries the Central Government restricts by notification; we will not transfer personal data to a restricted country, and we will follow any requirements set under rule 15. Where the GDPR or UK GDPR applies, India does not currently have an adequacy decision. We therefore transfer personal data only to countries with an adequacy decision (article 45), or under appropriate safeguards (article 46): the European Commission’s standard contractual clauses and, for UK data, the UK International Data Transfer Agreement or Addendum. For a one-off enquiry you send us from the EU or UK, the transfer is necessary to answer you (article 49(1)(b)). You can ask for a copy of the safeguards we rely on by writing to enquiry@vedhacon.com.
How long we keep it
We keep personal data only for as long as its purpose needs, and erase it when you withdraw consent or when the purpose is no longer served, unless the law requires us to keep it (section 8(7)).
| Data | How long | Why |
|---|---|---|
| Enquiries that do not lead to an engagement | Up to 12 months after our last exchange, then erased | Answering follow-up questions about the same request |
| Enquiries that lead to an engagement | For the engagement, then as the agreement and the law require | Contract, accounting and legal obligations |
| Logs of processing and associated traffic data | At least one year | Required by the DPDP Rules (rules 6 and 8) to detect and investigate misuse |
| Consent record in your browser | Until you change or clear it; re-asked after 180 days | Evidencing your choice |
| Preferences and tool drafts in your browser | Until you clear them | They stay on your device |
Training and certificate records are kept for up to 5 years so that certificates can be verified. Applications that do not lead to an engagement are erased within 12 months. Accounting records are kept for the period Indian tax law requires. If you unsubscribe from updates, we keep only your email address on a suppression list so that we do not contact you again.
Where the DPDP Rules require it for the class of Data Fiduciary we belong to, we will tell you at least 48 hours before erasing your data for inactivity, so that you can log in or contact us to keep it (rule 8).
Security safeguards
We take reasonable security safeguards to prevent personal data breaches (section 8(5) and rule 6). They include:
- Encrypted in transitEvery page and form is served only over HTTPS. HTTP Strict Transport Security (one year, including subdomains) stops browsers falling back to an unencrypted connection.
- Strict Content Security PolicyScripts, styles and fonts load only from our own domain and two approved font and icon sources. Forms can submit only to our own domain.
- No third-party trackingNo advertising, analytics or social-media tracking code runs on this site.
- Browser hardeningClickjacking protection, MIME-type sniffing blocked, a limited referrer policy, and camera, microphone and location access switched off for the site.
- Tools run in your browserAnswers you enter in the readiness checker and other tools stay on your device, so there is no copy on our servers to protect or lose.
- Need-to-know accessOnly the people who need to respond to an enquiry can see it.
- Processor contractsOur hosting, form and email providers are bound by contracts that require equivalent safeguards.
- Logs and reviewLogs are kept to detect and investigate unauthorised access, and these safeguards are reviewed when the site changes.
Personal data breaches
If a personal data breach affects you, we will tell you without delay, in plain language: what happened, when, the likely consequences, what we are doing about it, what you can do to protect yourself, and who to contact (section 8(6) and rule 7). We will also inform the Data Protection Board of India without delay and send it a detailed report within 72 hours of becoming aware of the breach, or within any longer period the Board allows.
To report a suspected security issue affecting this website, email enquiry@vedhacon.com with the subject “Security incident report”.
Where the GDPR or UK GDPR applies, we will notify the competent supervisory authority within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk to you (article 33), and we will tell you without undue delay if it is likely to result in a high risk (article 34). We keep a record of every breach and the action taken.
Your rights
Under sections 11 to 14 of the DPDP Act you have the following rights. Each link opens an email with the subject already filled in.
- s. 11Access
A summary of the personal data we process about you, the processing activities, and the identities of the Fiduciaries and Processors we have shared it with.
Make this request - s. 12Correction, completion and updating
Fix inaccurate or misleading data, complete incomplete data, or update it.
Make this request - s. 12Erasure
Erase data that is no longer needed, unless the law requires us to keep it.
Make this request - s. 6(4)Withdraw consent
Stop processing based on consent, as easily as you gave it.
Make this request - s. 13Grievance redressal
Complain about any act or omission in how we handle your data.
Make this request - s. 14Nominate
Name another person to exercise your rights if you die or become incapable.
Make this request
How to make a request
- Email enquiry@vedhacon.com from the address you used with us, or tell us which address that was.
- Say which right you are exercising and, for correction, what should change.
- For a nomination, give the nominee’s name and contact details.
We will confirm receipt, may ask for reasonable information to verify your identity, and will not charge a fee. We will acknowledge every request within 48 hours and respond as soon as we can, and grievances within the period the Rules prescribe, not exceeding 90 days.
Your duties
Section 15 of the DPDP Act asks Data Principals to comply with applicable law, not impersonate anyone, not suppress material information, not register a false or frivolous grievance, and provide only verifiably authentic information when asking for correction or erasure.
Children and persons with disability
This website is intended for professionals and is not directed at children, meaning anyone under 18. We do not knowingly process children’s personal data, and we do not track or behaviourally monitor children or target advertising at them (section 9). If you believe a child has contacted us, write to us and we will erase the data. Where a lawful guardian acts for a person with disability, we will seek verifiable consent from the guardian as rule 11 requires.
Grievances and the Data Protection Board
Please raise any grievance with us first at enquiry@vedhacon.com, subject “Privacy grievance”. We will acknowledge it within 48 hours, investigate, and reply within the period prescribed under rule 14, not exceeding 90 days.
If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India through the Board’s official digital platform (section 13(3) and section 27). You must first raise the grievance with us before approaching the Board. Decisions of the Board can be appealed to the Telecom Disputes Settlement and Appellate Tribunal (section 29).
GDPR, UK GDPR and readers outside India
If the GDPR, the UK GDPR or another privacy law applies to you, you have the rights it gives you in addition to those above. Under the GDPR and UK GDPR these are:
| Right | What it means |
|---|---|
| Access, art. 15 | Confirmation that we process your data, a copy of it, and the information in this notice |
| Rectification, art. 16 | Correction of inaccurate data and completion of incomplete data |
| Erasure, art. 17 | Deletion where there is no longer a lawful reason to keep the data |
| Restriction, art. 18 | Limiting use of your data while a dispute about it is resolved |
| Data portability, art. 20 | Your data in a structured, machine-readable format, where processing is based on consent or contract and carried out by automated means |
| Objection, art. 21 | Objecting to processing based on legitimate interests. You can object to direct marketing at any time, and we will stop |
| Automated decisions, art. 22 | Not to be subject to decisions based solely on automated processing. We make none |
| Withdraw consent, art. 7(3) | At any time, without affecting earlier lawful processing |
| Complain, art. 77 | To the supervisory authority where you live or work, or where the alleged infringement took place |
Requests are free. We will acknowledge your request within 48 hours and respond within one month, which may be extended by two further months for complex or numerous requests, in which case we will tell you why within the first month (article 12(3)). We may ask for information to confirm your identity.
You can find your supervisory authority through the European Data Protection Board member list. In the UK, it is the Information Commissioner’s Office. We would appreciate the chance to resolve your concern first.
Residents of California and other US states: we do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information.
Changes and version history
When our processing changes, we will update this notice before the change takes effect. If a change requires fresh consent, we will ask for it, and the consent banner will ask again whenever the cookie policy version changes.
| Version | Effective | Summary of change |
|---|---|---|
| 2.1 | 8 Oct 2026 | Added GDPR and UK GDPR information: controller details, lawful bases and legitimate interests, sources of data, whether data is required, other relationships, transfer safeguards, GDPR rights and timelines, supervisory authority complaints, art. 22, art. 33 and 34 breach notice, TDSAT appeal and the rule 8 erasure notice, summaries in all 22 Eighth Schedule languages, a quick-contacts bar, our Data Processor role for client documents, a security safeguards grid, and a 48-hour acknowledgement commitment |
| 2.0 | 28 Sep 2026 | Rewritten to meet section 5 of the DPDP Act and rule 3 of the DPDP Rules, 2025: itemised data and purposes, legal basis for each item, withdrawal, retention, breach, grievance, nomination, children and language options |
| 1.0 | Earlier | Original website privacy notice |
Contact
- Privacy questions
- enquiry@vedhacon.com
- Rights requests
- enquiry@vedhacon.com
Subject: Privacy request - Grievances
- enquiry@vedhacon.com
Subject: Privacy grievance - Security incidents
- enquiry@vedhacon.com
Subject: Security incident report
- Digital Personal Data Protection Act, 2023, sections 4 to 9, 11 to 16, 27 and 29.
- Digital Personal Data Protection Rules, 2025, rules 3, 4, 6, 7, 8, 9, 10, 11, 14 and 15.
- GDPR (EU) 2016/679 and UK GDPR, articles 5, 6, 7, 9, 12 to 22, 27, 33, 34, 37, 44 to 49 and 77.
Last reviewed .