Your data,under Indian law.

Who is who

Under the Act, Yojan Online Services Private Limited is the Data Fiduciary — we decide why and how your data is handled. You are the Data Principal. Our registered office is 354, Mharal Pada, Kalyan City, Kalyan, Thane, Maharashtra 421301.

We are not a Significant Data Fiduciary. We handle a small volume of business enquiry data, we do not profile anyone, and we do not trade in personal data.

The notice we owe you (s.5)

The Act says you must be told, before or when you give your data, what is collected and why. That notice is the enquiry form itself and the privacy policy it links to. In short:

• What — your name, email, phone, company, city and whatever you type into the message box. Nothing is collected in the background.
• Why — to reply to your enquiry, price the work, and keep the records Indian tax and company law require us to keep.
• How to withdraw — email us and say so. It is one sentence, not a form.
• How to complain — the grievance route at the bottom of this page, then the Data Protection Board of India.

Consent, and the legitimate uses beside it (s.6, s.7)

You consent by choosing to send us an enquiry — a clear, informed, specific act, for the stated purpose of getting a reply. We do not treat that as permission for anything else. We do not send marketing to people who asked for a quote.

Analytics and advertising are a separate consent, asked for separately on the banner when you first arrive. The Act gives no “legitimate interest” route for this the way European law does for some processing, so it is consent or nothing — which is why these scripts do not load until you agree, and why refusing takes one click.

• Google Analytics 4 — Counts visits and shows which pages and services people actually read, so we know what to write more of. (United States and other Google data centres)
• Microsoft Clarity — Heatmaps and session replay — where people click and where they give up on a page. Typing in form fields is masked. (United States)
• Meta Pixel — Measures which adverts led to an enquiry, and lets us show adverts to people who visited but did not get in touch. (United States and other Meta data centres)

Section 6(4) requires that withdrawing consent be as easy as giving it: Cookie settings, or the same control in the footer of every page. The cookie policy lists each cookie in full.

Once you become a client, some processing continues under the Act’s legitimate uses rather than consent — issuing a GST invoice, for instance, is a legal obligation we cannot drop on request.

Your rights as a Data Principal

• Access (s.11) — ask what we hold about you and who we have shared it with. We reply with the actual records, not a summary.
• Correction and erasure (s.12) — have wrong data fixed and data we no longer need deleted. Where a statutory retention period applies, we say so and give the date it expires.
• Grievance redressal (s.13) — a published route to a person, below.
• Nomination (s.14) — nominate someone to exercise these rights if you die or become incapacitated. Tell us in writing and we will record it.

There is no charge and no form. We answer within thirty days, usually far sooner.

Your duties (s.15)

The Act also asks something of you: do not impersonate someone else when you make a request, and do not file a false or frivolous grievance. We mention it because the Act does, not because it has ever been a problem.

How long we keep it (s.8(7))

Enquiries that never became a project are erased after 24 months. Client records are kept for the eight years Indian tax and company law require, then erased. Erasure is erasure — the row is deleted, not flagged as hidden.

Who else processes it (s.8(2))

We remain accountable for these processors; each acts on our instructions and on written terms.

• Neon — The database holding enquiries, quotes and invoices. (Singapore (AWS ap-southeast-1))
• Resend — Sending the emails we reply to you with, and our own notifications. (United States)
• Ollama — Summarising and scoring an enquiry so it reaches the right person. Only the text you wrote is sent. (Configurable — self-hosted, or Ollama's own service)
• Meta (WhatsApp) — Only if you choose to message us on WhatsApp. Following the link starts a conversation with Meta, under Meta's own terms. (As set out in WhatsApp's own policy)

Security, and telling you when it goes wrong (s.8(5), s.8(6))

Access is restricted to staff who need it, traffic is encrypted, and documents and identifiers are encrypted where they are stored. If a breach affects your data we will tell you and the Data Protection Board of India, without waiting to be asked and without minimising it.

Children (s.9)

Our services are sold to businesses. We do not knowingly collect data from anyone under 18, and we do not track or advertise to children — both of which the Act prohibits outright, and neither of which any consent can authorise. If you believe a child has sent us data or been tracked here, tell us and we will erase it.

Grievance officer (s.13)

Navneet Choubey
Yojan Online Services Private Limited
354, Mharal Pada, Kalyan City, Kalyan, Thane, Maharashtra 421301
hello@yojanonline.com · +91-90760-57135

Write to us first — we would rather fix it than have it escalated. If we do not resolve it to your satisfaction, you may complain to the Data Protection Board of India.