Privacy Notice
This notice explains, in plain language, what personal data Nijveda collects, why, what we do with it, who we share it with, how long we keep it, how we protect it and how you can use your rights under the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the Digital Personal Data Protection Rules, 2025 (the DPDP Rules).
The short version
This website uses no cookies, no analytics, no advertising, no tracking pixels, no sign-up and no forms. It loads no code or fonts from other companies. The readiness self-check works only inside your browser, and your answers are neither sent to us nor saved.
We only hold personal data you choose to send us, for example by email, plus the basic technical records our hosting provider needs to deliver and protect the website. We never sell personal data.
For any question, request or complaint, write to info@nijveda.com with the subject line "Privacy request".
1. Who this notice covers
This notice covers personal data about:
- people who visit nijveda.com;
- people who write to us, call us or meet us about our services;
- the individual contact persons at our clients, prospective clients, partners and suppliers; and
- people who apply for an internship or a job with us.
It does not cover personal data we handle only on behalf of a client while doing work for that client. That is explained in section 19.
2. Who we are
Nijveda is a partnership firm providing data privacy, data protection and regulatory compliance advisory services. For the personal data described in this notice, Nijveda is the data fiduciary: we decide why and how that data is used.
- Registered office
- Unit No. 725, PS ABACUS, Action Area IIE, New Town, Kolkata 700161, West Bengal, India
- info@nijveda.com
- Website
- https://nijveda.com
3. Privacy contact and Grievance Officer
Under section 8(9) of the DPDP Act and Rule 9 of the DPDP Rules, we publish the details of the person who can answer your questions about how we process your personal data. The same person handles grievances under section 13.
- Name and role
- Aditya Singhania, Partner, Privacy Contact and Grievance Officer
- info@nijveda.com (subject line: "Privacy request")
- Post
- Grievance Officer, Nijveda, Unit No. 725, PS ABACUS, Action Area IIE, New Town, Kolkata 700161, West Bengal
We include these contact details in every reply we send to a request about your rights.
4. What this website does not do
- It sets no cookies and uses no local storage, session storage or similar technology on your device.
- It has no analytics, advertising, social media plug-ins, chat widgets or tracking pixels.
- It loads all its text, images, fonts and code from nijveda.com only. No other company's servers are contacted when you view a page.
- It has no forms, accounts or log-in.
- The readiness self-check runs entirely in your browser. Your answers are not transmitted, stored or seen by us, and they disappear when you close or reload the page.
- Email links open your own email program. Nothing is sent until you choose to send it.
5. Personal data we collect
The table lists each item of personal data we collect, grouped by who you are, and where it comes from.
| Who you are | The personal data | Where it comes from |
|---|---|---|
| Website visitor | IP address; date and time of the request; the page or file requested; the referring web address, if your browser sends one; browser and operating system type (user-agent string); response status and size | Created automatically by our hosting provider when your browser asks for a page |
| Someone who writes to or contacts us | Your name; email address; any phone number, job title and organisation you include (for example, in an email signature); the content of your message and any attachments; date and time of the message | From you |
| Contact person at a client, prospective client, partner or supplier | Name; job title; organisation; business email address; business phone number; business address; notes of meetings and calls; correspondence; for billing, the name and address of the billing contact | From you, from your organisation, or from a colleague who introduces you to us |
| Internship or job applicant | Name; email address; phone number; city; your CV and cover letter (education, college, work experience, skills, and anything else you choose to include); links you share, such as a LinkedIn profile; interview notes; our assessment of your application; the stipend or salary discussed; for selected candidates, the details needed to issue an offer and certificate | From you, and from our interviewers. We contact referees only if you name them and agree. |
Please do not send us Aadhaar, PAN, passport or bank details, health information, or information about other people unless we specifically ask for it and it is necessary. If you send it anyway, we will delete what we do not need.
6. Why we use your data, on what basis, and for how long
Each row is one purpose. We do not use your data for any purpose not listed here. If we want to use it for a new purpose, we will tell you first and, where the law requires, ask for your consent.
| Purpose | Data used | Legal basis under the DPDP Act | What this enables for you | How long we keep it |
|---|---|---|---|---|
| Delivering the website and keeping it secure | Website visitor data | Needed to serve the page you asked for, and to meet our duty to take reasonable security safeguards (section 8(5) and Rule 6) | The page loads quickly and safely, and attacks can be detected and blocked | Held by our hosting provider under its own log retention schedule. We do not copy these records into our own systems. If we ever need them to investigate an incident, we keep the extract for at least one year, as Rule 8(3) requires, and no longer than needed. |
| Answering your enquiry | Contact data and your message | Legitimate use: you voluntarily gave us the data for this purpose (section 7(a)) | A reply to your question and, if you ask, a proposal | 12 months after our last exchange, unless the enquiry becomes an engagement |
| Carrying out an engagement and managing the client relationship | Client contact data, meeting notes, correspondence | Legitimate use: provided by you or your organisation for this purpose (section 7(a)) | The advisory, assessment, training or implementation services your organisation has engaged us for | For the engagement, and then 3 years after it ends, the general period for legal claims under the Limitation Act, 1963 |
| Invoicing and keeping tax and accounting records | Billing contact name and address, invoices, payment records | Legitimate use for compliance with law (section 7(a) and the record-keeping duties under the Central Goods and Services Tax Act, 2017 and the Income-tax Act) | Correct invoices and lawful tax filings for the services you receive | For the periods those laws require. For GST records, this is 72 months from the due date of the annual return for the year concerned. |
| Considering your application for an internship or job | Applicant data | Legitimate use: you voluntarily sent your application for this purpose (section 7(a)) | Assessment of your application, interviews and, if selected, an offer | If you are not selected: 6 months after the opening closes, then deleted. If you are selected: for the internship or employment, and then as long as needed to issue certificates and meet legal duties. |
| Keeping your application for future openings | Applicant data | Your consent (section 6), asked for separately by email. You can say no and it will not affect your current application. | We can contact you about suitable future openings | 12 months from your consent, or until you withdraw it, whichever is earlier |
| Establishing, exercising or defending legal claims, and responding to lawful requests from authorities | Only the data relevant to the matter | Section 7(d) and (e), and section 17(1)(a) and (c) of the DPDP Act | Protection of your rights and ours, and compliance with court orders and the law | Until the matter is finally resolved and any appeal period has ended |
Marketing. We do not send newsletters or marketing emails at present. If we start, we will send them only to people who have separately and actively agreed, and every message will include a one-step way to stop receiving them.
Deletion. When a retention period ends, or earlier if the purpose has been served and no law requires us to keep the data, we delete it or irreversibly anonymise it (section 8(7)). This includes copies held by our service providers, subject to their standard backup cycles.
7. Who we share your data with
We share personal data only when needed for the purposes above. Our service providers act as our data processors: they may use the data only on our instructions and under written contract (section 8(2)).
| Recipient | What they do for us | What they receive |
|---|---|---|
| Google (Google Workspace) | Business email, calendar, document storage and video calls | Emails, attachments, meeting details and documents you exchange with us |
| Google (Firebase Hosting) | Hosting and delivering this website, including its content delivery network | Website visitor data |
| Our chartered accountants, auditors and legal advisers | Accounting, tax, audit and legal advice, under professional confidentiality | Only the billing, contract or matter data they need |
| Banks and payment service providers | Receiving and making payments | Billing contact and payment details |
| Technology or implementation partners, only on a client project | Helping to deliver a solution your organisation has asked for | Only the client contact data needed, shared with your organisation's knowledge and under a written confidentiality and data processing agreement |
| Courts, regulators, the Data Protection Board of India and law enforcement agencies | Where the law requires or allows us to disclose data | Only what the request lawfully requires |
We do not sell, rent or trade personal data, and we do not share it with anyone for their own marketing. We will never approach or share your details with a third party because you contacted us.
8. Processing outside India
Google may store and process data in its data centres in India and in other countries, including the United States, under its published data processing terms. Section 16 of the DPDP Act allows such transfers unless the Central Government restricts transfers to a particular country or territory. We check for such notifications and will stop or change any transfer that becomes restricted. Where another Indian law requires a higher degree of protection, we follow that law.
9. How we protect your data
We take reasonable security safeguards, as section 8(5) and Rule 6 require, including:
- encryption of all website traffic using HTTPS (TLS), with HTTP Strict Transport Security so browsers always use a secure connection;
- a strict content security policy and other security headers that stop the website loading outside code or being embedded in other sites;
- encryption of stored email and documents by our service provider;
- multi-factor authentication and strong passwords on all our accounts;
- access limited to partners, staff and interns who need it, each bound by confidentiality obligations;
- records of access to systems holding personal data, kept for at least one year so that misuse can be detected and investigated (Rule 6);
- written data processing terms with every service provider; and
- regular review of these measures, and a documented plan for handling incidents.
No system is completely secure. If you think your interaction with us has been compromised, please tell us immediately.
10. If something goes wrong
If a personal data breach affects your data, we will, as section 8(6) and Rule 7 require:
- tell you without delay, in plain language, what happened, when, the likely consequences for you, what we are doing about it, what you can do to protect yourself, and whom to contact; and
- inform the Data Protection Board of India without delay, and give it a detailed report within 72 hours of becoming aware of the breach, or within any longer period the Board allows.
11. Your rights
Under the DPDP Act you have the right to:
- Access information (section 11): a summary of the personal data we hold about you and what we do with it, and the identities of the data fiduciaries and data processors we have shared it with, together with a description of the data shared.
- Correction, completion and updating (section 12): ask us to correct inaccurate or misleading data, complete incomplete data, and update data.
- Erasure (section 12): ask us to erase data we no longer need, unless we must keep it to meet a legal obligation.
- Withdraw consent (section 6(4)): where we rely on your consent, at any time. See section 13.
- Grievance redressal (section 13): have your complaint about our handling of your data dealt with by us. See section 14.
- Nominate (section 14): name one or more individuals to exercise your rights if you die or become incapable of exercising them because of unsoundness of mind or infirmity of body.
12. How to make a request
As Rule 14 requires, here is how to exercise your rights and what we need from you.
- Email info@nijveda.com with the subject line "Privacy request", or write to the Grievance Officer at the address in section 3.
- Tell us which right you want to use.
- Give us the details we need to find your data: your name and the email address or phone number you used with us. If you were an applicant, tell us the opening you applied for. If you are a client contact, name your organisation.
- To nominate someone, give the nominee's name, their relationship to you, and their email address or phone number.
- If you are acting for someone else, include proof that you are authorised.
To protect you, we may ask for information to confirm your identity. We will only ask for what is necessary and will not keep it longer than needed.
Our response times. We will acknowledge your request within 7 days and aim to complete it within 30 days. In every case we will respond within 90 days, the outer limit in Rule 14(3). If we cannot do what you ask, we will explain why and tell you how to escalate. There is no fee.
13. Withdrawing consent
Where we rely on your consent, for example to keep your application for future openings, you can withdraw it in one step: reply to our email or write to info@nijveda.com with the subject line "Withdraw consent". This is as easy as giving consent was.
Withdrawal does not affect anything we lawfully did before it. After you withdraw, we will stop the processing that relied on your consent within a reasonable time and delete the data, unless another basis in section 6 or a law requires us to keep it. If so, we will tell you which.
14. Complaints
If you are unhappy with how we have handled your personal data, please contact our Grievance Officer first (section 3). We will respond within the times in section 12, and never later than 90 days.
If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India using the digital means the Board provides. Under section 13(3) of the DPDP Act you must first use our grievance process before approaching the Board. Appeals from orders of the Board lie to the Telecom Disputes Settlement and Appellate Tribunal under section 29.
15. Your duties
Section 15 of the DPDP Act asks you, when using your rights, to comply with applicable laws, not to impersonate anyone, not to suppress material information, not to register false or frivolous grievances or complaints, and to give only information that you can verify as genuine when asking for correction or erasure. Breaching these duties can attract a penalty of up to ₹10,000.
16. Children and persons with disability
This website and our services are meant for businesses and adults. We do not knowingly collect personal data of children (persons under 18 years), and applicants must be 18 or older. We do not carry out tracking, behavioural monitoring or targeted advertising of anyone, including children. If you believe a child has sent us personal data, write to us and we will delete it. Where a person with disability has a lawful guardian, the guardian may act on their behalf under section 9 of the DPDP Act.
17. Automated decisions
We do not make decisions about you by automated means alone, and we do not profile website visitors. Applications are reviewed by people.
18. Cookies and similar technologies
This website does not place or read cookies, and it uses no local storage, session storage, device fingerprinting, tracking pixels or similar technologies. That is why you see no cookie banner. If this ever changes, we will update this notice first and, for anything not strictly necessary, ask for your consent through a banner that lets you refuse as easily as you accept, with nothing pre-selected.
19. Data we handle for our clients
When a client engages us, we may handle personal data that the client controls, such as employee or customer records reviewed during an assessment. For that data, the client is the data fiduciary and we act as its data processor, using the data only on the client's written instructions and under a contract. We apply the safeguards in section 9 to it. If you want to use your rights over such data, please contact the client organisation concerned. If you contact us instead, we will pass your request to them promptly.
20. Languages
This notice is in English. Under section 5(3) of the DPDP Act, you may ask to receive it in any language listed in the Eighth Schedule to the Constitution of India. Write to info@nijveda.com naming the language, and we will send it to you.
21. Changes to this notice
We review this notice at least once a year and whenever our practices change. The version number and effective date at the top show when it last changed. For a material change, we will display a notice on this website before the change takes effect and, where we have your email address and the change affects you, email you. Earlier versions are available on request.
The DPDP Act and the DPDP Rules were brought into force in phases starting on 13 November 2025. Most obligations apply from 13 May 2027. As a data privacy firm, we follow them now.
Version history
- Version 2.0, 17 September 2026: full notice under section 5 and Rule 3, covering visitors, enquirers, client contacts and applicants.
- Version 1.0, September 2026: first short notice at launch.