Your rights inthe EU and the UK.

Who the controller is

Yojan Online Services Private Limited, 354, Mharal Pada, Kalyan City, Kalyan, Thane, Maharashtra 421301, India. Contact hello@yojanonline.com or +91-90760-57135.

We have no establishment in the EU or the UK. The GDPR applies to us under Article 3(2), because we offer services to people who are there. We are not required to appoint a Data Protection Officer — we do not monitor anyone on a large scale and we process no special category data — and we have not appointed one rather than name a role that does not exist.

What we collect, and why it is lawful (Article 6)

• Your enquiry — name, email, phone, company, city and your message. Lawful basis: Article 6(1)(b), steps taken at your request before entering a contract. You asked us for a price; we cannot give you one without it.
• Your project records — scope, invoices, correspondence. Lawful basis: 6(1)(b) while the contract runs, then 6(1)(c), a legal obligation, for the eight years Indian tax law requires the books to be kept.
• Job applications — your CV and what you tell us. Lawful basis: 6(1)(b), again pre-contractual steps.

We do not rely on legitimate interests for marketing, because we do not do any. There is no mailing list to unsubscribe from.

Analytics and advertising — Article 6(1)(a)

We use Google Analytics, Microsoft Clarity and the Meta Pixel. These rely on your consent and nothing else. Refusing is a single click that sits beside Accept rather than behind a second screen.

Clarity and the Meta Pixel are not loaded until you accept. Google Analytics loads on arrival in Google’s consent denied mode: it writes nothing to your device, reads no identifier, cannot recognise you across visits or sites, and sends only an anonymous page count. Accepting switches storage on; refusing keeps it off permanently.

The ePrivacy Directive governs storage on your device, and consent denied stores nothing there, so that requirement is met before you choose. We will not claim more than that: an HTTP request carrying your IP address does reach Google before you have chosen, and an IP address is personal data. Our position is that measuring our own site is a legitimate purpose and that this is the most minimised form the technology offers. If you disagree, refusing on the banner stops anything further.

• Google Analytics 4 — Counts visits and shows which pages and services people actually read, so we know what to write more of. (United States and other Google data centres)
• Microsoft Clarity — Heatmaps and session replay — where people click and where they give up on a page. Typing in form fields is masked. (United States)
• Meta Pixel — Measures which adverts led to an enquiry, and lets us show adverts to people who visited but did not get in touch. (United States and other Meta data centres)

Withdrawing is as easy as consenting, as Article 7(3) requires: Cookie settings, or the same control in the footer of every page. Withdrawal is not retrospective — it stops further processing rather than erasing what was already collected, and you can ask us to erase that too.

The cookie policy lists every cookie, what it does and how long it lasts.

Where your data goes (Chapter V)

Your data is processed in India and by the providers below. India has no European adequacy decision, so transfers of your enquiry out of the EEA or the UK rely on Article 49(1)(b) — the transfer is necessary to perform the contract you asked us to prepare. In practice: you asked an Indian company for a quote, and the quote has to be written in India.

Transfers to Google, Microsoft and Meta in the United States rest instead on Article 49(1)(a) — your explicit consent, given on the banner — and each of those companies is certified under the EU–US Data Privacy Framework. If you refuse, no data reaches Microsoft or Meta at all, and Google receives nothing beyond the anonymous, cookieless page count described above.

• Neon — The database holding enquiries, quotes and invoices. (Singapore (AWS ap-southeast-1))
• Resend — Sending the emails we reply to you with, and our own notifications. (United States)
• Ollama — Summarising and scoring an enquiry so it reaches the right person. Only the text you wrote is sent. (Configurable — self-hosted, or Ollama's own service)
• Meta (WhatsApp) — Only if you choose to message us on WhatsApp. Following the link starts a conversation with Meta, under Meta's own terms. (As set out in WhatsApp's own policy)

Automated decisions (Article 22)

An enquiry is summarised and given a priority score automatically, so that it reaches the right person quickly. It has no legal effect and it decides nothing: whether we reply, what we quote and whether we take the work are all decided by a person. You can ask us not to score your enquiry, or to tell you what the score was.

Your rights (Articles 15–21)

• Access — a copy of what we hold.
• Rectification — anything wrong, corrected.
• Erasure — deleted, unless tax law requires us to keep it, in which case we tell you which record and until when.
• Restriction — held but not used, while something is disputed.
• Portability — your data in a machine-readable file.
• Objection — to any processing you think we should not be doing.

Email hello@yojanonline.com. No form, no fee. We reply within one month, and we will tell you if we need longer and why.

How long we keep it

Enquiries that never became a project: 24 months. Client records: eight years, because Indian company and tax law requires it. Then deleted.

Complaining

Tell us first — hello@yojanonline.com. You also have the right to complain to the supervisory authority in the EU or EEA country where you live or work, or to the Information Commissioner’s Office if you are in the UK. You do not have to go through us first.