Legal
Privacy Policy
Last updated 7 October 2026 · Effective 7 October 2026
How we collect, use, share and protect personal information when you visit our website, book a call, work with us or hear from us, and the rights you have.
On this page
1. Who we are and what this policy covers
3. How we use information and our legal bases
5. Information we handle for our clients
6. Who we share information with
9. How long we keep information
10. How we protect information
11. Cookies, Do Not Track and tracking by other companies
Plain-English summary: WDLP is a one-person design studio run by Hardik Dewra in India.
We collect what you give us (for example, when you book a call or hire us), basic technical data when you visit our website, and public business details when we research companies we might contact.
We use it to run the website, talk to you, do the work, get paid and keep the records the law requires.
We do not sell personal information, and we do not use advertising or retargeting tools.
Service providers such as Framer, Cal.com, Google and payment platforms handle some of it for us, in India, the United States, the European Union and other countries.
You can ask for a copy of your information, ask us to correct or delete it, or tell us to stop contacting you, by emailing admin@wedesignlandingpages.com.
This summary does not replace the full policy below.
1. Who we are and what this policy covers
WeDesignLandingPages.com (“WDLP”, “we”, “us”, “our”) is a trading name of Hardik Dewra, a sole proprietor based in Bahadurgarh, Haryana, India. We design landing pages and websites, build them in Framer, and help businesses improve their conversion rates. We are registered as a micro enterprise on the Government of India’s Udyam (MSME) portal and registered for GST in Haryana. Registration details appear on our invoices and are available on request.
This policy explains how we handle personal information as the business that decides why and how it is used. The EU General Data Protection Regulation (“GDPR”) and its UK version (the “UK GDPR”) call this role the “controller”. India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) calls it the “Data Fiduciary”. This policy covers:
our website at wedesignlandingpages.com, including its translated pages, blog, shop and template previews (the “Site”)
calls you book with us, and messages you send us by email or on platforms such as Contra, LinkedIn and X
our work with clients, including proposals, projects, invoices and payments
research we do on businesses we may contact about our services
template purchases, once template checkout is live
Section 5 explains how we handle personal information inside client projects, which our client contracts govern. This policy does not cover other companies’ websites and services that the Site links to, such as cal.com, Contra or LinkedIn. Their own privacy policies apply when you use them.
Questions? Email admin@wedesignlandingpages.com and put “Privacy” in the subject line. Our full postal address is available on request for legal notices.
This policy explains our practices. It is not a contract. It does not limit any rights you have under the data protection law that applies to you.
This policy is in English. If you need it in Hindi, or in one of the other languages our homepages use (Arabic, Dutch, French, German, Italian, Japanese, Korean, Portuguese or Spanish), email us and we will send you a translation.
2. Information we collect
We collect personal information in three ways:
you give it to us
our host and the other services on our pages collect it automatically when you use the Site (section 11)
we receive it from other sources
Contact details
What it includes: Your name, email address, company, job title and website, and your phone number if you give it to us.
Where it comes from: You, and the platforms you contact us through.
Booking details
What it includes: Your name, email address and time zone, the time you pick, and your answers to our booking questions. The required questions currently ask about your company’s stage and revenue range, your goals for the project, the business challenge you want help with, your budget range and how you heard about us. Your company website and any guests you invite are optional. The booking also includes the video call link.
Where it comes from: You, through Cal.com.
Messages and call notes
What it includes: What you write to us, and the notes we take during calls about your business, goals and project. We use Fathom to record, transcribe and summarize some video calls so our notes are accurate. We ask you at the start of the call and record only if you agree. If you say no, we do not record.
Where it comes from: You, and us during calls.
Project information
What it includes: Proposals, contracts, approvals and feedback. Files you send, such as brand assets and content. Names and contact details of team members you introduce. Access you give us to your tools, such as Framer, your CMS, analytics, ad accounts or online store, including any login details you share (section 2.1).
Where it comes from: You and your team.
Billing and payment information
What it includes: Billing name and address, company and tax details, invoices, payment history and payment references, such as the payer’s name, the amount, the date and the payment method. Bank account or UPI details when you pay by bank transfer or UPI, or when we refund you that way (section 2.1). Card payments go straight to the payment provider, so we do not see your full card number.
Where it comes from: You, and the platforms and payment providers you pay through (section 6).
Template orders
What it includes: Your name, email address, what you bought and your order details.
Where it comes from: Our checkout provider, once template checkout is live.
Testimonials and reviews
What it includes: Your name, role, company, photo and words, if you agree to give us a testimonial.
Where it comes from: You, or a platform where you reviewed us, such as Contra.
Device and usage information
What it includes: IP address, browser and device type, operating system, pages you visit, the page you came from, links you click, time zone and language settings, country-level location, and performance and error data about how our pages load.
Where it comes from: Collected automatically by our host, Framer, and by Google and Cal.com when their services load on our pages (section 11).
Public business information
What it includes: Your name, job title and company, your work email or phone number where published, public profile links (such as LinkedIn), information about your company and website, and notes about our contact with you.
Where it comes from: Public sources such as LinkedIn and company websites, job platforms where you posted a project, tools that find published work contact details, and people who introduce us (section 4).
2.1 Sensitive information
We do not ask for health information, biometric data, card details or government ID documents, and we ask you not to send them to us.
India’s Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”) treat two other kinds of information as sensitive, and both can come up in our work:
a password, if you share a login with us instead of inviting us as a user
bank account or UPI details, when you pay us by bank transfer or UPI, or when we refund you that way
We use them only for the purpose you gave them for: accessing your tool for your project, or making, checking or refunding a payment. We do not share them with anyone else, except a subcontractor who works on your project, needs that access to do it and is bound by confidentiality, the providers that store our email and files (section 6), the banks and payment providers that handle a payment, our accountant for our tax records, anyone you ask us to share them with, or where the law requires it. We protect them as section 10 describes. When you send them to us in writing, for example by email, you agree to that use. You can withdraw that agreement at any time by telling us in writing, but we may then be unable to finish the work or the payment.
If we need access to your accounts for a project, please invite us as a user or collaborator where your tool allows it, instead of sending a password. If you share a password, change it when the project ends.
For clients in India, our tax invoices must show your GST number (GSTIN) if you are registered for GST, so we collect it for that purpose.
2.2 Information about other people
If you give us information about someone else, such as a colleague you invite to a call or a team member who will send us feedback, please let them know about this policy.
2.3 Do you have to give us information?
Giving us personal information is not a legal requirement for you, but some of it is needed to enter into or perform a contract with us. To book a call, you need to give your name, your email address and answers to the booking questions our form marks as required (see the table above). To work with you, we need contact and billing details, and tax law requires us to put some billing details on our invoices. Without the required details, we cannot schedule a call, send a proposal or invoice you. Everything else is optional.
3. How we use information and our legal bases
We use personal information only for the purposes below. The GDPR and UK GDPR require a legal basis for each one, so the table shows the basis we rely on for people in the European Economic Area (the “EEA”) and the United Kingdom.
Show you the Site and keep it secure
Information we use: Device and usage information
Legal basis (EEA and UK): Our legitimate interests in running a secure website that works and looks the way we designed it, including the fonts it uses.
Show our booking calendar on our homepages
Information we use: Device and usage information, which your browser sends to Cal.com when the calendar loads
Legal basis (EEA and UK): Our legitimate interests in letting visitors see our availability and book a call from our homepages.
Measure how the Site is used, in aggregate
Information we use: Device and usage information, through Framer Analytics (no cookies)
Legal basis (EEA and UK): Our legitimate interests in learning which pages help visitors, so we can improve the Site.
Answer your messages and hold the calls you book
Information we use: Contact details, booking details, messages and call notes
Legal basis (EEA and UK): Steps you ask us to take before entering into a contract. If you contact us for your company, our legitimate interests in answering business inquiries.
Record, transcribe and summarize a call, if you agree
Information we use: Messages and call notes
Legal basis (EEA and UK): Your consent, which you give at the start of the call and can withdraw at any time.
Prepare proposals and deliver our services
Information we use: Contact details, project information, messages and call notes
Legal basis (EEA and UK): Performing our contract with you. If the contract is with your company, our legitimate interests in working with its team.
Invoice, take payments, send refunds and handle payment disputes
Information we use: Billing and payment information and project records
Legal basis (EEA and UK): Performing our contract, and our legitimate interests in getting paid and in defending payment disputes and chargebacks.
Sell and deliver templates and support buyers
Information we use: Template order details and messages
Legal basis (EEA and UK): Performing our contract with you.
Find and contact businesses that may need our services
Information we use: Public business information and contact details
Legal basis (EEA and UK): Our legitimate interests in finding and contacting businesses likely to need our services, and in keeping in touch with clients and contacts about our work.
Show testimonials and reviews
Information we use: Testimonials and reviews
Legal basis (EEA and UK): Your consent when you give us a testimonial, which you can withdraw at any time. For reviews you posted publicly on a platform such as Contra, our legitimate interests in showing real feedback about our work.
Show our work in our portfolio, case studies, award entries and pitches
Information we use: The names and roles of client contacts we mention, and screenshots of our clients’ launched websites, which can show the names, photos and words of people on them, such as published testimonials
Legal basis (EEA and UK): Our legitimate interests in showing our real work to potential clients. If you appear in our portfolio and object, we remove or blur your details.
Keep business, tax and accounting records
Information we use: Billing and payment information, contracts and project records
Legal basis (EEA and UK): Our legitimate interests in complying with the Indian tax and accounting laws that apply to us.
Comply with the law, answer privacy requests and handle legal claims
Information we use: Any information relevant to the request or claim
Legal basis (EEA and UK): Legal obligations under EU or UK law, where they apply to us. Otherwise, our legitimate interests in complying with the law, protecting our rights and defending legal claims.
Where we rely on legitimate interests, you can ask us how we balanced our interests against yours, and you can object (section 12).
India. Today, India’s main rules for businesses that handle personal information are in the Information Technology Act, 2000 and the SPDI Rules (section 2.1), and this policy follows them. Most of the DPDP Act and the Digital Personal Data Protection Rules, 2025 are scheduled to apply from 13 May 2027. Under them, we will use the information you voluntarily give us for the purpose you gave it for, such as answering your message, holding your call or carrying out your project. We will stop when you tell us to, except where a law, such as tax law, requires us to keep records. Where the DPDP Act requires your consent, we will ask for it clearly, and you will be able to withdraw it as easily as you gave it.
Brazil. If you are in Brazil, we rely on the matching legal bases in Article 7 of Brazil’s General Data Protection Law (the “LGPD”): performing a contract, legitimate interests, complying with legal obligations, exercising rights in legal proceedings, and consent.
3.1 New purposes
If we want to use your information for a new purpose that does not fit the purposes above, we will tell you first and, where the law requires, ask for your consent.
3.2 Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
3.3 Newsletters and marketing emails
We do not send a newsletter. If we start one, we will ask for your consent before adding you to it, and every email will include a way to unsubscribe.
4. If we contacted you first
Your right to object: You can object at any time to us using your details to contact you about our services. Reply “stop” to any message from us, or email admin@wedesignlandingpages.com with “Stop” in the subject line, and we will stop contacting you. You do not need to give a reason, and it costs nothing.
We look for businesses that may need a landing page, a Framer website or help with conversion rates, including businesses that post projects on job platforms. We sometimes contact them with a LinkedIn connection request, a direct message or an email. If we contacted you this way, this section explains what we hold and why.
Where we got your details. Usually from public professional sources, such as your LinkedIn profile, your company’s website or your posts on X. We may also find you through a project you posted on a job platform such as Contra, Upwork or Wellfound, through a tool that finds published work contact details, or through someone who introduced us. If you ask, we will tell you where we found your details.
What we hold. Your name, job title and company, your work email or phone number where published, public profile links, information about your company and website, and notes about our contact with you.
Why, and on what basis. To tell you about services that may help your business, or to follow up on a project you posted. For people in the EEA and the UK, we rely on our legitimate interests in finding and contacting businesses likely to need our services. Where the law requires your consent before we email you, we do not email you without it.
Tools we use. We sometimes use software, including AI tools, to help us find and research businesses and to decide whom to contact. These tools do not make decisions that have legal or similarly significant effects on you.
What we do not do. We do not sell your details.
How long we keep it. 24 months after our last contact or, if we never contacted you, 12 months after we added your details, unless you become a client. If you ask us to stop, we delete the details we hold about you, except anything the law requires us to keep. Messages on platforms such as LinkedIn stay there under the platform’s rules, but we stop using them. We keep only a short note (your name, the email address or profile link we used, and the date) for as long as we contact businesses, so that we do not contact you again.
5. Information we handle for our clients
Clients sometimes give us access to personal information about their own customers, website visitors, subscribers or staff. This can be inside the client’s Framer site, content management system (CMS), form submissions, analytics, ad accounts or online store. We handle that information only on the client’s behalf and on its instructions. The client is the controller (or Data Fiduciary) for it, and the client’s own privacy policy applies. We act as the client’s “processor” (or Data Processor).
Our contract with the client governs this work, including the data processing terms in Part B of our Terms and Conditions.
We do not use a client’s customer data for our own purposes, and we do not add the people in it to our contact lists. Our portfolio and case studies show work as it appears publicly. They never include non-public personal information from a client’s systems, such as form submissions, customer lists or analytics data.
If you are a customer of one of our clients and want to use your privacy rights, please contact that client. If you contact us, we will pass your request to the client when we can tell which client it concerns.
7. AI tools
We use AI tools, for example Anthropic’s Claude and image-generation tools, to help us draft copy, write and review code, research, translate content and create images. We review what these tools produce before we use it in client work. Some content on the Site, such as machine translations of our blog articles, is only partly reviewed, as our Disclaimer explains.
When we use these tools, we give them the context a task needs. Where a provider offers it, we choose plans and settings that limit how it uses our inputs, for example by turning off the use of our inputs to train its models. We avoid putting client confidential information into tools that would use it for training. We do not put personal data from our clients’ own systems, such as their customer lists, form submissions or analytics exports, into an AI tool unless its provider handles that data for us under data processing terms. Each provider handles what we send under its own terms and privacy policy.
If you are a client, you can ask us in writing not to put your confidential material into AI tools. Our Terms and Conditions explain how this works for projects.
8. International transfers
We are based in India. When you contact us, book a call or work with us, we handle your information in India. Our service providers handle it in other countries, mainly the United States and the European Union, as listed in section 6. We use providers outside India because we need them to run the Site and provide our services.
Under India’s SPDI Rules, we transfer sensitive personal data or information, such as a password or bank details, outside India only where this is needed to perform our contract with you or you have agreed to it. We transfer it only to providers that protect it to at least the standard those Rules require.
The European Commission and the UK have not issued an adequacy decision for India. EU or UK law may treat sharing your information with a recipient outside the EEA or the UK as a restricted transfer. Where it does, we rely on the safeguards in that recipient’s terms. Examples are the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the recipient’s certification under the EU-U.S. Data Privacy Framework and its UK Extension. Sometimes no such safeguard applies, for example when you choose to work with us or pay us through a platform or payment provider. We then share only what is necessary to perform our contract with you or to take steps you ask for.
If you are in Brazil, we rely on the mechanisms the LGPD allows for international transfers, such as standard contractual clauses or a transfer that is necessary to perform our contract with you.
You can ask us for a copy of the relevant safeguard.
9. How long we keep information
We keep personal information only as long as we need it for the purposes in this policy. These are the periods we use:
Inquiries, bookings and messages that do not lead to a project
How long we keep it: 24 months after our last contact with you.
Why: To follow up, and to understand our history if you come back.
Call recordings, transcripts and summaries
How long we keep it: Kept with the inquiry or project they belong to, for the same period as those records.
Why: To keep an accurate record of what we discussed and agreed.
Prospecting information
How long we keep it: 24 months after our last contact or, if we never contacted you, 12 months after we added your details, unless you become a client. If you ask us to stop, we keep only a short “do not contact” note, for as long as we contact businesses.
Why: To contact businesses that may need us, and to make sure we do not contact you again after you say stop.
Project records: proposals, contracts, approvals, messages, files and client contact details
How long we keep it: For the length of the project, then 6 years after it ends.
Why: To support the work we delivered and to handle any legal claim. In some countries where our clients are based, contract claims can be brought for up to 6 years.
Invoices, payment and tax records, including the client and contact details on them
How long we keep it: 8 years after the end of the Indian financial year (April to March) they relate to.
Why: Indian tax law requires us to keep them for several years. For example, India’s GST law requires records to be kept for 72 months from the due date of the annual return for that year. If an appeal or other proceeding about them is open, they must be kept until one year after it is finally decided, if that is later. We keep them for 8 years so that we also allow for income tax time limits.
Template order details
How long we keep it: 8 years after the end of the financial year of the purchase.
Why: To confirm your license, support you and keep tax records.
Testimonials and reviews
How long we keep it: Until you ask us to remove them.
Why: We then remove them from the Site and stop using them in new materials.
Portfolio and case studies
How long we keep it: For as long as we show the work, unless you ask us to remove your details.
Why: To show our past work to potential clients.
Privacy requests and complaints
How long we keep it: 3 years after we close the request.
Why: To show how we handled it and to answer any follow-up.
Website logs and analytics
How long we keep it: Under Framer’s own retention practices. We see aggregated statistics only.
Why: To run and secure the Site and understand how it is used. Framer says it deletes, every day, the key it uses to count daily unique visitors.
If a claim, dispute, audit or investigation is open, we keep the relevant information until it is resolved.
From 13 May 2027, India’s Digital Personal Data Protection Rules, 2025 will also require us to keep personal data, related traffic data and logs of our processing for at least one year from the date of that processing. This is for purposes set by the Government of India, such as answering lawful requests from authorities. Where that rule applies and a period above, or your request to delete, would end sooner, we will keep the information until that year is up. We will use it during that extra time only for those purposes, and then delete it.
When a period ends, we delete the information or anonymize it. Deleted items can stay in our providers’ systems for a short time, for example in trash folders or backups, until those are cleared on the provider’s normal schedule. Messages you send us on platforms such as Contra, LinkedIn or X stay on those platforms under their own rules, and we cannot delete them there. When our period ends, we stop using them and delete the copies we keep ourselves.
10. How we protect information
We use security measures that fit a one-person business, including:
full-disk encryption and an automatic screen lock on the computer we use for client work
card payments handled by payment providers, so we do not see full card numbers
reputable providers with their own security programs, such as Framer, GoDaddy, Google and Cal.com
giving subcontractors access to client information only when they need it for a specific project and are bound by confidentiality
We ask clients to give us access to their tools through user invitations where possible, and to remove our access when a project ends.
No method of sending or storing information is completely secure, so we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and the relevant authorities where the law requires it.
11. Cookies, Do Not Track and tracking by other companies
Our own domain sets no cookies and stores nothing in visitors’ browsers, and our analytics (Framer Analytics) does not use cookies. On our homepages, the embedded Cal.com booking calendar loads as soon as the page opens, and it sets Cal.com’s own cookies and stores a few items in your browser. Google receives your IP address when our fonts load. Our Cookie Policy lists these items, what they do and how long they last.
Do Not Track and Global Privacy Control. We do not track visitors across other websites, and our analytics does not use cookies or persistent identifiers. The Site does not currently change how it works when your browser sends a Do Not Track or Global Privacy Control signal. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising.
Tracking by other companies. We have not added advertising, retargeting or cross-site tracking tools to the Site. Some companies whose services load on our pages do receive information about your visit: Framer (our host), Google (fonts) and Cal.com (the booking calendar, with Cloudflare and Sentry). Cal.com’s cookies sit on the cal.com domain, so Cal.com can also receive them when you visit other websites that use Cal.com. Google receives information when you visit other websites that use its services. We decide which of these services appear on our pages, and so what your browser sends them when they load. They decide what they do with that information afterward, under their own privacy policies.
12. Your rights
Your rights depend on where you are and which law applies. Wherever you are, you can contact us with a request, and we will handle it in line with the law that applies to you. Section 13 explains how to make a request.
Your right to object: You can object at any time to us using your information to contact you about our services, and we will stop. If you are in the EEA or the UK, you can also object to any other use we base on legitimate interests. We will then stop, unless we have compelling grounds that override your interests or we need the information for legal claims. Our analytics sets no cookie and gives you no identifier, so we cannot switch it off for one visitor. To stop it, block requests to events.framer.com with a content blocker or your browser’s privacy settings, as our Cookie Policy explains.
12.1 Everyone
Wherever you are, you can ask us to:
stop contacting you
delete your information
correct information that is wrong or incomplete
tell you what personal information we hold about you
stop using information you gave us with your consent (withdrawing consent does not affect what we did before)
12.2 If you are in the EEA or the UK
Under the GDPR and UK GDPR, you have the right to:
get a copy of your personal information (access)
have inaccurate information corrected (rectification)
have your information deleted in some cases (erasure)
ask us to limit how we use it in some cases (restriction)
receive information you gave us in a portable format, where we use it based on your consent or a contract and by automated means (portability)
object to uses based on legitimate interests, and to marketing at any time (objection)
withdraw your consent at any time, without affecting what we did before
complain to a data protection authority (section 14)
12.3 If you are in India
Today, you can review the information you gave us and ask us to correct it if it is inaccurate or incomplete. You can choose not to give us information, though we may then be unable to provide what you asked for. You can withdraw any consent you gave us by writing to us, and email counts.
From 13 May 2027, under the DPDP Act, you will also be able to:
get a summary of the personal data we hold about you and how we use it
learn who else we shared it with, and what we shared
have it corrected, completed, updated or erased
use our grievance process (section 14), and then complain to the Data Protection Board of India
nominate another person to use your rights if you die or become unable to use them
12.4 If you are in Brazil
Under Article 18 of the LGPD, you have the right to:
confirmation that we process your data
access to your data
correction of incomplete, inaccurate or outdated data
anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the LGPD
portability of your data to another provider, under the rules of Brazil’s National Data Protection Authority (ANPD)
deletion of data processed with your consent
information about the public and private entities we share your data with
information about your option not to give consent, and what happens if you refuse
withdrawal of your consent
object to processing based on a legal basis other than consent, if it does not comply with the LGPD
complain to the ANPD (section 14)
12.5 If you are in Canada
You can ask to access and correct the personal information we hold about you, and withdraw your consent, subject to legal and contractual limits. You can also complain to the Office of the Privacy Commissioner of Canada.
12.6 If you are in the United States
You can ask us to review the personal information you have given us, and to correct or delete it. We do not sell personal information or share it for cross-context behavioral advertising.
12.7 Limits on your rights
Some rights have limits. For example, we may need to keep information that tax law requires us to keep, or that we need for a legal claim. If a limit applies to your request, we will tell you.
13. How to make a request
Email admin@wedesignlandingpages.com with “Privacy” in the subject line, and tell us:
what you want us to do
the country you live in, so we apply the right law
the email address you used with us, or the profile link we contacted you on, so we can find your information
We may ask you to confirm your identity, for example by replying from the email address we have on file. We use that information only to verify your request. Someone else can make a request for you if you authorize them in writing, and we may ask for proof.
Requests are free. Where the law allows, we may charge a reasonable fee for, or refuse, a request that is clearly unfounded or excessive, and we will tell you why.
13.1 How quickly we respond
We reply within the time set by the law that applies to you.
EEA or UK
How quickly we respond: Within one month. We can extend this by up to two more months for complex or numerous requests, and we will tell you within the first month if we do.
Brazil
How quickly we respond: Within the period set by the LGPD and the ANPD’s rules.
Canada
How quickly we respond: Within 30 days under PIPEDA, Canada’s privacy law. This can be extended in limited cases.
India
How quickly we respond: Within one month of receiving your request or grievance.
Everywhere else
How quickly we respond: Within a reasonable time, usually within one month.
14. Our Grievance Officer and complaints
14.1 Who to contact
Hardik Dewra
Role: Founder. Our Grievance Officer under India’s SPDI Rules, our contact person for questions about our processing of personal data (a role India’s DPDP Act requires from 13 May 2027), and our privacy contact for people in Brazil under the LGPD.
Email: admin@wedesignlandingpages.com, with “Grievance” or “Privacy” in the subject line.
Location: Bahadurgarh, Haryana, India. Our full postal address is available on request for legal notices.
14.2 How we handle grievances and complaints
Email us about any concern with how we handle personal information. We look into it, keep you informed, and aim to resolve it within one month of receiving it. If you are in India, we resolve your grievance within one month of receiving it.
If you are in the UK, we acknowledge your data protection complaint within 30 days of receiving it, look into it without undue delay, keep you informed, and tell you the outcome.
14.3 Complaining to a regulator
You can also complain to a data protection authority. We would welcome the chance to address your concern first.
EEA: the authority in the country where you live or work, or where the issue happened (list of EEA authorities)
Switzerland: the Federal Data Protection and Information Commissioner
Brazil: the National Data Protection Authority (ANPD)
Canada: the Office of the Privacy Commissioner of Canada
India: from 13 May 2027, the Data Protection Board of India, after you have used our grievance process
15. Children
The Site and our services are for businesses and adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you think a child has given us personal information, please contact us. If we learn that we hold personal information from someone under 18, we will take steps to delete it.
16. Changes to this policy
We update this policy when our practices or the law change. When we do, we post the new version here and change the dates at the top of this page. The “Effective” date shows when the current version took effect.
If a change is material, we will also tell clients we are working with by email. We will not apply a material change to information we collected before the change without your consent where the law requires it. We expect to update this policy when more of India’s DPDP Act comes into force, which is scheduled for 13 May 2027.
We keep previous versions of this policy. Ask us for a copy.