Privacy Policy

This policy covers truenorthtech.io (the "Site") and any personal data you share with us through it. The data controller is TrueNorth ("TrueNorth", "we", "us", or "our"), based in India. For any privacy question, use the contact form on our homepage and we will respond within a reasonable time, and in any event within the periods required by applicable law.

This policy is drafted to meet the requirements of India's Digital Personal Data Protection Act, 2023, and is additionally aligned with the EU and UK General Data Protection Regulation (GDPR) for individuals in those jurisdictions.

The Site does not require an account and does not run advertising or analytics trackers. The personal data we collect is limited to what you choose to give us:

• Enquiry details. When you submit the "Start a project" form, we collect your name, organisation, work email address, the category of need you select, and whatever you write in the situation field. The contact form is the only channel we offer for reaching us through the Site.
• Technical data. Our hosting and email infrastructure providers automatically log standard technical data, such as IP address, browser type, and request timestamps, for security and reliability purposes. We do not combine this with your enquiry data to build a profile of you.

We process the data above to respond to your enquiry, to assess whether we are the right fit for your organisation, and, if you become a client, to deliver and administer that engagement. Our legal basis under GDPR is your consent when you submit the form, our legitimate interest in running a functioning business enquiry channel, and, once an engagement exists, the performance of that contract.

We also process technical log data on the basis of our legitimate interest in keeping the Site secure and operating correctly.

We do not sell personal data. We share it only with the processors that make the Site and our enquiry channel work, currently Vercel (hosting) and Resend (transactional email delivery of form submissions), each acting under a data processing agreement, and only to the extent needed to provide their service to us. We may also disclose data where required by law, regulation, or a valid legal process.

TrueNorth is based in India, and the enquiry data described above is collected and primarily held there. Some of our processors operate infrastructure outside India, including in the United States and the European Economic Area, so your data may be processed in a country other than your own. Where that involves personal data belonging to an individual in the EU or UK, we rely on the safeguards recognised under GDPR, such as the European Commission's Standard Contractual Clauses, to keep it protected to the same standard wherever it is handled.

Enquiry data from organisations we do not go on to work with is kept for up to 24 months from your last contact with us, so we can follow up appropriately, and is then deleted or anonymised. Data tied to an active or completed client engagement is kept for as long as needed to deliver the engagement and to meet our contractual, accounting, and legal obligations afterward.

Subject to the conditions and exceptions set out in applicable law, you have the right to ask us for the following, and we will not charge you for a reasonable request:

• Access to the personal data we hold about you, and a copy of it.
• Correction of inaccurate or incomplete data.
• Erasure of your data, sometimes described as the right to be forgotten.
• Restriction of, or objection to, how we process your data.
• Portability of your data to another provider, in a structured, commonly used format.
• Withdrawal of consent at any time, where consent is our basis for processing, without affecting anything we did before you withdrew it.

To exercise any of these rights, use the contact form on our homepage. If you are in India and not satisfied with our response, you may approach the Data Protection Board of India. If you are in the EU or UK, you have the right to lodge a complaint with your local data protection supervisory authority instead.

The Site does not set analytics, advertising, or tracking cookies. Our hosting provider may set a small number of strictly necessary cookies required for the Site to load and perform correctly; these do not identify you personally and do not require separate consent because they are essential to the service you have requested.

The Site is intended for business use and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We rely on reputable infrastructure providers who maintain industry-standard technical and organisational safeguards, and we limit access to enquiry data to the people who need it to respond to you. No system is perfectly secure, but we take reasonable steps to protect what you share with us.

We may update this policy as our practices or the law evolve. The date below reflects the version in force. Material changes affecting how we handle enquiry data will be reflected here before they take effect.