Privacy Policy

Last updated: 8 October 2026

This policy explains what personal data I collect through gauravbhattnagar.com, why I collect it, who else handles it, how long I keep it, and the rights you have over it. I have written it to follow India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and the Digital Personal Data Protection Rules, 2025, which were notified in November 2025 and bring the main obligations for businesses into force in stages. I am following them from the start rather than waiting.

In short: I collect only what you choose to send me, I use it to reply to you, and I do not sell it.

1. Who is responsible for your data

This website is run by me, Gaurav Bhatnagar, an independent consultant based in India. For the purposes of the DPDP Act, I am the Data Fiduciary for personal data collected through this site. You can reach me at higaurav@gauravbhattnagar.com.

2. What personal data I collect, and why

I collect personal data only when you send it to me through one of the routes below.

• Enquiry forms (the Get in Touch page and the forms on service pages): your name, email address, company, your message, and which page you were on. I use this to reply to you and to talk through whether I can help.
• Find My Fit quiz: your name, email address and your answers to the quiz questions, sent to me when you choose to send them. I use this to suggest the right service and to follow up on the conversation you asked for.
• Newsletter sign-up (The Silent Noise): your email address, and your name where the form asks for it. I use this only to send you the newsletter.
• Booking a discovery call: the details you enter on the Google Calendar booking page, such as your name, email address and a short note. That page is run by Google. I use the details to schedule and hold the call.
• Technical data: when a page loads, your browser requests files from the hosting provider and from a few content providers, so your IP address, browser type and the pages requested appear in standard server logs. I do not use this to identify you.

Please do not type bank details, government ID numbers or other sensitive information into the forms or the free-text boxes. I do not need them to reply to you.

At the time of writing this site does not run analytics, advertising or tracking tools. The Cookie Policy explains this in full.

3. Why I am allowed to use it: your consent

I process your personal data on the basis of your consent, which you give by submitting a form or asking to be booked in. Each form tells you what will happen when you press the button. You can withdraw your consent at any time, as easily as you gave it, by emailing me. Withdrawing does not undo anything I lawfully did before you withdrew. Where the law requires me to keep a record, I will keep only that.

4. How I use it

• To reply to your enquiry, schedule a call, or send a proposal you asked for.
• To send you the newsletter, if you subscribed.
• To keep a record of our conversation so that I do not ask you the same questions twice.

I do not sell or rent your data. I do not use it for automated decision-making or profiling. If I ever want to use it for something new, I will ask you first.

5. Who else handles your data

I use a small number of service providers who handle data on my behalf and for the purposes described here. Each has its own privacy terms.

• Formspree (formspree.io), a US-based form service, receives form and quiz submissions and forwards them to my inbox.
• Google: my email and calendar run on Google Workspace, so messages and bookings sit there.
• Hostinger hosts the website and keeps standard server logs.
• Content providers (Google Fonts, Bootstrap, jQuery and Cloudflare cdnjs) deliver fonts and code libraries. They receive your IP address and browser details when a page loads.

I do not share your data with anyone else, except where a court or a public authority legally requires it.

6. Transfers outside India

Some of the providers above process data on servers outside India, including in the United States. The DPDP Act permits transfers of personal data abroad except to countries the Central Government restricts by notification. I will follow any such restriction.

7. How long I keep it

• Enquiries and quiz submissions: while we are in conversation and for up to 24 months after our last contact, then I delete them. If we work together, engagement records are kept for as long as the work, tax and legal requirements need.
• Newsletter details: until you unsubscribe.
• Booking details: until the call and any follow-up are done, then treated as an enquiry.
• Server logs: kept by the hosting provider under its own schedule.

When the purpose is complete, I delete the data or remove anything that identifies you.

8. How I protect it

I use reasonable security safeguards. The site is served over an encrypted (HTTPS) connection. Submissions arrive in a password-protected mailbox and a form dashboard that only I access, and I choose providers with established security practices. No system is perfectly secure, so I cannot promise absolute protection.

If a breach affects your personal data, I will tell you without delay and report it to the Data Protection Board of India as the law requires.

9. Your rights under the DPDP Act

As a Data Principal, you have the right to:

• get a summary of the personal data I hold about you and how I process it, and the names of the providers I share it with;
• ask me to correct, complete or update it;
• ask me to erase it;
• withdraw your consent at any time;
• have your grievance heard and resolved; and
• nominate another person to exercise these rights for you if you die or become unable to do so.

To use any of these rights, email higaurav@gauravbhattnagar.com from the address you used with me, with "Privacy request" in the subject line. I may need to confirm it is you before I act. I aim to respond within 30 days.

10. Grievance redressal

If you have a concern about how I handle your personal data, please write to the person responsible:

Gaurav Bhatnagar
Data Fiduciary and grievance contact
higaurav@gauravbhattnagar.com

I will acknowledge your complaint within three working days and aim to resolve it within 30 days. If you are not satisfied after going through this process, you may make a complaint to the Data Protection Board of India under the DPDP Act.

11. Children

This website is meant for business professionals. I do not knowingly collect personal data from anyone under 18. If you believe a child's data has reached me, please write to me and I will delete it.

12. Links to other sites

Pages on this site link to other services, such as LinkedIn and the Google Calendar booking page. Those services have their own privacy policies, and this policy does not cover them.

13. Cookies

See the Cookie Policy for what this site does and does not use today, and what will change before any analytics are switched on.

14. Changes to this policy

I may update this policy as the site or the law changes. The date at the top shows the latest version. If a change affects how I use data you have already given me, I will tell you directly.

15. Contact

For anything about this policy or your personal data, write to higaurav@gauravbhattnagar.com.