Privacy Policy
I collect very little. If you use the contact form or book a call, I get your name, email and whatever you choose to tell me — and I use it to reply to you and nothing else. I don’t sell data, run ad tracking, or build profiles of visitors.
Last updated: 4 October 2026
1. Who is responsible for your data
[LEGAL ENTITY NAME] (“I”, “me”) is the data controller for personal data collected through rajdeeproy.com.
- Contact: contact@rajdeeproy.com
- Postal address: Dum Dum, Kolkata, WB – 700028
There is no Data Protection Officer. A DPO is mandatory only where processing involves large-scale systematic monitoring or special-category data at scale, neither of which applies here.
2. What I collect, why, and on what basis
| Data | Source | Why | Lawful basis | Kept for |
|---|---|---|---|---|
| Name, email, company, message | Contact form | To answer your enquiry | Art. 6(1)(b) pre-contract steps, or 6(1)(f) legitimate interest | 12/24 months after last contact |
| Name, email, meeting details, booking notes | Calendly booking | To schedule and hold the call | Art. 6(1)(b) | 12/24 months after the call |
| IP address, browser and device details, pages visited | Server logs, automatically | Security, abuse prevention, availability | Art. 6(1)(f) legitimate interest | 30/90 days |
| Consent choices | Consent banner | To honour and evidence your choice | Art. 6(1)(c) legal obligation | 12 months |
| Email address | Newsletter signup, if you subscribe | To send the newsletter | Art. 6(1)(a) consent | Until you unsubscribe |
I do not collect special-category data — health, biometrics, political opinions and the like — and this site is not directed at children.
If you are a client, personal data inside documents you send me for review is governed by our engagement agreement, where I act as processor on your instructions, not by this policy.
3. Who else sees your data
I use a small number of third parties. None are given your data for their own marketing.
| Service | What it receives | Role | Location |
|---|---|---|---|
| D2H | Everything on the site, including server logs | Hosting | United States |
| Calendly | Name, email, booking details | Scheduling | United States |
| Outbound email contents and addresses | Email delivery | India | |
| Akismet (Automattic) | Form submission metadata, including IP | Spam filtering | United States |
| Google Fonts | Your IP address, on page load | Web fonts | United States |
I also disclose personal data where legally required — a court order, a regulator, a lawful request from authorities. Where I am permitted to tell you, I will.
I do not sell personal data, and I do not share it for cross-context behavioural advertising as those terms are defined under the CCPA and CPRA.
4. International transfers
I operate from India, and several services above are in the United States. Where personal data of EU or UK residents leaves those territories, the transfer relies on [Standard Contractual Clauses / the UK IDTA / the provider’s own mechanism — confirm per provider]. You can ask me for details of the safeguards used for any specific transfer.
5. How long I keep things
The table in section 2 gives the periods. Enquiries that went nowhere are deleted once their period passes. Where a legal or tax obligation requires longer retention — invoices, engagement correspondence — that obligation wins, and I keep only what it requires.
6. Your rights
In the EU or UK: you can access your data, correct it, have it deleted, restrict or object to how I use it, receive it in a portable format, and withdraw consent at any time where consent was the basis. Withdrawing consent does not affect anything done before you withdrew it.
In California: you can know what is collected and why, delete it, correct it, opt out of sale or sharing (I do neither), limit use of sensitive personal information (I collect none), and not be discriminated against for exercising any of this.
Elsewhere: tell me what you want and I will apply the same standard unless something prevents me.
To exercise any of this, email contact@rajdeeproy.com. I respond within 30 days. I may ask you to confirm your identity — not to obstruct you, but because handing your data to someone impersonating you would be worse.
If you are unhappy with my response you can complain to your supervisory authority. In the UK that is the Information Commissioner’s Office; in the EU, the authority where you live.
7. Cookies
Which cookies are set, and how to change your mind, are covered in the Cookie Policy. You can revisit your choices any time via Opt-out preferences.
8. Security
I apply the practices I advise clients on: HTTPS everywhere, multi-factor authentication on administrative accounts, least-privilege access, maintained software, and backups held separately from the live site.
No system is perfectly secure and I will not claim otherwise. If a breach occurs that is likely to risk your rights and freedoms, I will notify the relevant supervisory authority within 72 hours of becoming aware, and tell you directly where the law requires it.
9. Changes to this policy
Material changes update the date at the top. Where a change affects how your data is used and I hold your contact details, I will tell you directly. Previous versions are available on request.
10. Contact
Questions about this policy, or about anything I hold on you: contact@rajdeeproy.com