Privacy Policy

Effective: September 24, 2026 · Gandhi Tech

This Privacy Policy is published in compliance with the Digital Personal Data Protection Act 2023 (DPDP Act), India's first comprehensive data protection legislation. It explains what personal data this site collects, the lawful basis for processing, your rights as a Data Principal, and how to contact the designated Grievance Officer.

DPDP Act 2023Grievance Officer NamedUser Rights EnforceableRight to NominateNo Tracking CookiesCross-Border Disclosed

About This Policy

This Privacy Policy is published by Vimal Gandhi (operating as Gandhi Tech), the Data Fiduciary for this website, in accordance with the Digital Personal Data Protection Act 2023 (DPDP Act) enacted by the Parliament of India and published in the Gazette of India (Extraordinary) on August 11, 2023.
This website is a professional services portfolio. It does not operate user accounts, process payments, or run OTP-based authentication. Personal data is submitted voluntarily through the contact inquiry form; optional, consent-based analytics may also collect aggregate usage information.
This policy is written in plain language as required under the DPDP Act. If you have questions, you can contact the Grievance Officer named at the end of this document.

What personal data does this website collect?

Contact form submissions — When you fill out the contact form, the following data is collected: full name, email address, subject line, selected service category, and your message. This data is transmitted to Vimal Gandhi to enable a response to your inquiry.
Usage analytics — Only after you accept the analytics option in the cookie consent banner, this site may use Vercel Analytics and an optionally configured Google Analytics property to collect usage data such as pages visited, time on page, and referrer source. No contact form data is sent to analytics.
Infrastructure logs — Vercel (the hosting provider) may process request logs containing IP addresses for security, abuse prevention, and infrastructure purposes. These are processed by Vercel, Inc. as a Data Processor under a Data Processing Agreement.
Consent preference — Your analytics choice is stored in browser local storage. This site does not use advertising cookies, tracking cookies, or third-party remarketing pixels. Vercel may set a minimal session cookie for infrastructure integrity.
No sensitive personal data — This site does not collect health, biometric, financial, or government ID data at any point.

Why is personal data processed?

Under the DPDP Act 2023, all personal data processing must rest on a valid consent or a recognised lawful basis. Gandhi Tech processes your personal data on the following basis:
Contact form data — Processed on the basis of your freely given, specific, and informed consent. By submitting the contact form, you consent to your name and email being used to send you a reply to your inquiry. You may withdraw consent at any time by emailing the Grievance Officer listed below.
Analytics data — Processed only after optional analytics consent and used in anonymised or aggregate form where configured. You can change or withdraw this choice using Cookie preferences in the footer.
No "legitimate interest" basis is claimed — The DPDP Act 2023 does not recognise a "legitimate interest" lawful basis for private entities. Gandhi Tech does not rely on this basis.

How is your personal data used?

To respond to your project inquiry, question, or service request submitted via the contact form.
To understand aggregate visitor behaviour through consent-based analytics to improve website content and performance.
Your personal data is not sold, rented, or shared with third parties for marketing, advertising, or profiling purposes.
Your contact form data is not used for any purpose beyond responding to your specific inquiry unless you separately and explicitly consent to further communication.

How long is your personal data retained?

Contact form messages — Retained in the operator's email inbox for as long as is necessary to fulfil the business relationship or comply with any applicable legal obligation. The maximum default retention period is 2 years from the date of submission.
Infrastructure logs — Vercel retains server logs for a maximum period defined in its own data retention policy (typically 30–90 days). Vimal Gandhi does not control this timeline.
Analytics data — Anonymised aggregate data. No deletion request is applicable as no personal identifiers are stored.
You may request early deletion of your contact form data at any time by emailing the Grievance Officer. Deletion will be confirmed within 30 days of your request.

What rights do you have under the DPDP Act 2023?

Right to Information (Section 11) — You may request a summary of all personal data held about you, the purposes for which it is processed, the retention period, and any third parties with whom it is shared. Requests are fulfilled within 30 days.
Right to Correction (Section 12) — You may request correction of any inaccurate personal data held about you.
Right to Erasure (Section 12) — You may request deletion of your personal data at any time. Data will be purged from all systems within 30 days, subject to any legal obligation to retain specific records.
Right to Grievance Redressal (Section 13) — You may file a grievance with the Grievance Officer named below. A response will be provided within 30 days.
Right to Nominate (Section 14 — India-specific) — Under the DPDP Act 2023, every Data Principal (you) has the right to nominate another individual to exercise your data rights in the event of your death or incapacity. To register a nominee, contact the Grievance Officer by email with the nominee's name and contact details. This right is legally established under the Act even though Rules governing the process are pending notification.
Withdrawal of Consent — You may withdraw consent for your contact form data to be retained at any time by emailing the Grievance Officer. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
To exercise any of these rights, contact the Grievance Officer at the email listed at the end of this policy. You will receive a response within 30 days.

Children's Data

Under the DPDP Act 2023, any person under 18 years of age is considered a child. This website is a professional B2B services platform not directed at minors.
Gandhi Tech does not knowingly collect personal data from anyone under 18. No behavioural tracking, profiling, or targeted advertising is used at any point on this site.
If you are under 18, please do not submit the contact form without verifiable parental or guardian consent. If Vimal Gandhi becomes aware that personal data has been submitted by a person under 18 without appropriate consent, that data will be deleted promptly.
This restriction is explicitly stated in the Terms and Conditions for this website.

Which third-party services process data, and where?

Under the DPDP Act 2023, cross-border data transfers are permitted to all countries except those blacklisted by the Central Government. The current blacklist is pending notification. The following Data Processors are used by this website — all are US-headquartered companies:
Vercel, Inc. (USA) — Website hosting and infrastructure. Request logs containing IP addresses may be processed. Vercel acts as a Data Processor. Data Processing Agreement: included in Vercel's standard Terms of Service. Vercel Privacy Policy →
Calendly, LLC (USA) — If you book a discovery call via the Calendly booking link, your name, email, and calendar availability are processed by Calendly. Calendly operates as a separate Data Fiduciary under its own privacy policy. Calendly Privacy Policy →
Resend / Email Delivery (USA) — Contact form submissions are transmitted via a transactional email API to deliver inquiry notifications to Vimal Gandhi. Your name and email address are transmitted for this purpose only.
Google Fonts / Typography — Fonts are self-hosted via next/font and served from Vercel's CDN. No font requests are made to Google servers from your browser, so no data is transferred to Google for this purpose.
No personal data is shared with any Data Processor for marketing, profiling, or re-targeting purposes.

Security

This website is served exclusively over HTTPS with HTTP Strict Transport Security (HSTS) enforced.
Technical security measures include: Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer Policy, and Permissions Policy headers applied to all responses.
No raw personal data (including contact form submissions) is stored in any database operated by Vimal Gandhi. Submissions are delivered directly by email and retained only in the operator's email inbox.
Data Breach Response — In the event of a confirmed data breach affecting your personal data, Vimal Gandhi will notify affected Data Principals and, once the Data Protection Board is constituted, notify the Board within 72 hours of confirmed breach detection, as required under the DPDP Act 2023.
No method of transmission over the internet is 100% secure. While all reasonable measures are taken, Vimal Gandhi cannot guarantee absolute security.

Changes to This Policy

Vimal Gandhi may update this Privacy Policy from time to time to reflect changes in the DPDP Act Rules (once notified by the Central Government), business practices, or technical changes to this website.
The effective date at the top of this page reflects the date of the most recent revision. For material changes, a notice will be placed on the homepage for a reasonable period.
Continued use of this website after a policy update does not constitute consent to the new processing terms. You retain the right to withdraw consent and request data deletion at any time.

How can you contact the Grievance Officer?

In accordance with Section 13 of the DPDP Act 2023 and Rule 7 of Module 07 of the DPDP Technical Compliance Checklist, a named Grievance Officer has been designated for this website.
Grievance Officer
Name: Vimal Gandhi
Role: Founder & Operator, Gandhi Tech
Email: vimal.gandhi.dev@gmail.com
Phone: +91 90540 32122
Grievances will be acknowledged within 48 hours and resolved within 30 days of receipt. To submit a grievance, email the address above with subject line: "DPDP Grievance — [Your Name]".
If your grievance is not resolved satisfactorily, you may approach the Data Protection Board of India once it is constituted under the DPDP Act 2023. Monitor dpdp.gov.in and meity.gov.in for updates.

Regulatory Reference

This policy references the Digital Personal Data Protection Act 2023 (India, MEITY). Rules under the Act are pending notification by the Central Government and may alter specific compliance obligations. This site will be updated accordingly. Monitor dpdp.gov.in and meity.gov.in for official updates. For informational purposes only — consult qualified legal counsel for compliance decisions.

Back to Home Terms & Conditions