01Who we are
Yashmitra Global Solutions (“Yashmitra”, “we”, “us”) is a business based in India providing IT services, technology consulting, software and SaaS development, AI and automation, digital marketing and managed services.
For personal data described in this policy, we act as the Data Fiduciary under the DPDP Act (the “controller” under the GDPR). Our contact details and Grievance Officer are listed at the end of this policy.
02What this policy covers
This policy applies to personal data we process about:
- visitors to this website;
- people who contact us or request a proposal;
- clients, prospective clients and their staff, as business contacts;
- suppliers and partners;
- job applicants.
When we process personal data on behalf of a client as part of a project (for example, customer records inside software we build or manage), the client decides how that data is used and their privacy notice applies. Our role in that case is described in Processing for our clients and our Data Processing Agreement.
03Personal data we collect
| Category | Examples | How we get it |
|---|---|---|
| Contact and identity details | Name, email address, phone number, company, job title | From you, when you email us, use our enquiry form or speak with us |
| Enquiry and project information | Your message, the services you are interested in, requirements, files you send us | From you |
| Business relationship records | Proposals, contracts, invoices, billing contact, GST details, correspondence | From you or your organisation |
| Job application data | CV, portfolio, work history, qualifications, links you share | From you, when you apply |
| Technical data | IP address, browser type, device information, pages requested, date and time | Automatically, through our hosting provider's server logs and when your browser loads web fonts |
| Preferences | Your cookie choices | Stored in your own browser (see our Cookie Policy) |
We do not ask for sensitive personal data such as financial account passwords, health information or biometric data through this website. Please do not send it to us unless we have specifically agreed a secure method with you.
04How and why we use your data
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries and preparing proposals | Contact, enquiry information | Your consent, given when you contact us (DPDP Act s.6); steps prior to a contract (GDPR Art. 6(1)(b)) |
| Delivering services and managing our contract with you | Contact, business relationship records, project information | Performance of a contract and your consent; legitimate uses under DPDP Act s.7 |
| Invoicing, accounting and tax compliance | Billing and business records | Compliance with law (DPDP Act s.7; GDPR Art. 6(1)(c)) |
| Recruitment | Job application data | Your consent, given when you apply |
| Keeping our website secure and working | Technical data | Legitimate uses and our legitimate interest in security (GDPR Art. 6(1)(f)) |
| Sending updates or marketing about our services | Name, email | Only with your consent, which you can withdraw at any time |
| Meeting legal obligations, responding to lawful requests and enforcing our rights | Any relevant data | Compliance with law; legitimate uses under DPDP Act s.7 |
We do not sell personal data, and we do not use it for automated decision-making that has legal or similarly significant effects on you.
05Cookies and similar technologies
This website does not currently use analytics or advertising cookies. We store your cookie preferences in your browser so we can respect them. Details are in our Cookie Policy, and you can change your choices on the Cookie Preferences page.
07International transfers
Some of our service providers store or process data outside India (for example, web font services operated by Google). The DPDP Act permits such transfers except to countries the Government of India restricts; we will not transfer personal data to any restricted country. Where the GDPR applies to your data, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses.
08How long we keep data
| Data | Retention period |
|---|---|
| Enquiries that do not lead to a contract | Up to 24 months after our last contact, then deleted |
| Client contracts, invoices and accounting records | As long as required by tax and company law, typically up to 8 years after the financial year ends |
| Project communications and deliverables | For the duration of the engagement and up to 3 years afterwards, unless the contract states otherwise |
| Job applications | Up to 12 months after the role is filled, unless you ask us to keep your details for future roles |
| Server and security logs | Up to 180 days, or longer if required for an investigation or by CERT-In directions |
When data is no longer needed, or you withdraw consent and no other lawful reason applies, we delete or anonymise it.
09How we protect data
We follow reasonable security practices consistent with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, including encrypted connections (HTTPS), multi-factor authentication on business accounts, least-privilege access, regular updates and backups. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as required by the DPDP Act, and report cyber incidents to CERT-In within the required timelines. More detail is on our Security page.
10Your rights
Under the DPDP Act you have the right to:
- access a summary of the personal data we process about you and the processing activities;
- correct, complete, update or erase your personal data;
- withdraw consent at any time, as easily as you gave it (this does not affect processing that took place before withdrawal);
- grievance redressal through our Grievance Officer;
- nominate another person to exercise your rights in the event of your death or incapacity.
If the EU or UK GDPR applies, you also have rights to restrict or object to processing and to data portability, and you may complain to your local supervisory authority.
To exercise any right, use our Privacy Requests page or email privacy@yashmitra.com. We may need to verify your identity before acting on a request.
11Children's data
Our website and services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, please contact us and we will delete it. Where a client project involves children's data, we process it only on the client's documented instructions and with the verifiable parental consent the law requires.
12Processing for our clients
When we build, host, test or manage systems for clients, we may process personal data on their behalf. In that case the client is the Data Fiduciary (controller), and we act as a Data Processor: we process the data only on the client's documented instructions, keep it confidential and secure, and help the client meet their obligations. These commitments are set out in our Data Processing Agreement. If your data is in a client's system and you want to exercise your rights, please contact that organisation; if you contact us, we will pass your request on.
13Third-party links and social media
Our website links to our social media pages and other websites. Those services have their own privacy policies, and we are not responsible for how they handle data. If you interact with us on social media, the platform's policies also apply.
14Changes to this policy
We may update this policy as our services or the law change. The “last updated” date shows when it was last revised. If changes are significant, we will highlight them on this page and, where appropriate, notify you directly.
15Contact and Grievance Officer
For any question, request or complaint about your personal data, contact our Grievance Officer. We will acknowledge your message and aim to resolve it within 30 days.
- Organisation
- Yashmitra Global Solutions, a business based in India
- Address
- 10-33, Main Road, Opp. Z.P.H. School, Bandarulanka, Amalapuram, Andhra Pradesh 533221, India
- Grievance Officer
- Grievance Officer name: to be confirmed, Grievance Officer
If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act, after first using our grievance process.