Data Protection Policy
Download this document as a PDF
Scope
This policy sets out how SENZAIT handles personal data, meaning any information about an identifiable person, in every part of our business: the people who write to us, the clients and suppliers we deal with, the visitors to our website, and our own staff. It applies to everyone who works for SENZAIT and to anyone who processes personal data on our behalf. Our Privacy Policy tells the people whose data we hold what we do with it; this policy tells our own people how to behave.
We comply with the Digital Personal Data Protection Act 2023 and the rules under it, and with the Information Technology Act 2000 and its rules on sensitive personal data and reasonable security practices. Where a client in another country requires us to meet a standard such as the EU General Data Protection Regulation for the data they share with us, we do so by contract.
Principles
- We collect only what we need, for a stated purpose. An enquiry needs a name, an organisation and a way to reply. A contract needs the details the law and the invoice require. We do not collect data because it might be useful later.
- We say what we do. The people whose data we hold are told, in plain language, what we hold, why, for how long, and how to ask us to correct or delete it. Consent, where we rely on it, is asked for clearly and can be withdrawn as easily as it was given.
- We keep it accurate and no longer than needed. Enquiry records are kept for as long as the conversation and any resulting work require, then deleted. Contract and tax records are kept for the period the law requires, then deleted. Staff records are kept as employment law requires.
- We keep it secure. Personal data lives on systems we control, on our own mail server and website, protected by access controls, encryption in transit, backups and updates. It is not stored on personal devices or free consumer accounts. Paper records are locked away. Access is limited to the people who need it for their work.
- We do not sell it, and we share it only when necessary. Personal data goes to a third party only when a contract, the law or the person concerned requires it: a courier needs a delivery address, our accountant needs an invoice, a regulator may need a record. Each such party is bound to protect it.
- We do not use it to profile or to market without permission. Nobody who writes to us is added to a mailing list they did not ask for.
- Clients’ data is theirs. Data a client gives us for a project, including personal data about their own staff, is processed only for that project, on their instructions, and returned or deleted when the work ends, as our Code of Business Conduct and Ethics requires for all confidential information.
People’s rights
Anyone whose personal data we hold can ask us what we hold, ask us to correct it, ask us to delete it where the law allows, and withdraw consent. Requests go to [email protected] with the subject line “PERSONAL DATA”, and are answered within thirty days. If a person is not satisfied with our answer, they may complain to the Data Protection Board of India under the Digital Personal Data Protection Act 2023.
If something goes wrong
A loss, theft, unauthorised access or accidental disclosure of personal data is reported to the Director immediately. We contain it, assess who is affected and how, notify the Data Protection Board and the affected people as the Act requires, record what happened and change what allowed it.
Responsibility
The Director is responsible for this policy and is the contact for data protection matters. Everyone who handles personal data for SENZAIT is trained in this policy when they join and reminded of it yearly.
Mr. Vishalkumar Suthar, Director · SENZAIT PRIVATE LIMITED · Gandhinagar, 1 October 2026