PRIVACY
What we collect when you contact us, why we are allowed to hold it, who else sees it, how long we keep it, and how you get it removed.
Last updated
01
Who we are
Geekholic Solutions is an engineering practice that designs and builds websites, applications and mobile products, and operates the infrastructure that runs them. We work from India and our clients are in India.
Our place of business is Mangal Murti Bunglow, Navrang Colony, Shivaji Nagar, Jail Road, Nashik Road, Nashik, Maharashtra 422101, India. Geekholic Solutions is a trading name used by Prathamesh Devhare, a sole proprietor, not an incorporated company; Prathamesh Devhare is the Data Fiduciary named in this notice.
For the personal data described here we are the Data Fiduciary: we decide what is collected and why, and you are the Data Principal it belongs to. Reach us at hello@geekholic.com for anything in this notice, including a request to exercise your rights. That address is also our grievance contact.
This notice is published in English. Ask us at hello@geekholic.com and we will send it in any language listed in the Eighth Schedule to the Constitution of India.
02
What we collect
We collect the minimum needed to answer an enquiry and to keep the site available. We do not buy contact lists, and we do not build profiles for advertising.
- Enquiry details
- Your name, work email address and message, and where you provide them your company, role, what you need, project stage, budget range and timeline. All of it comes from the form on the contact page or from an email you send us.
- Technical data
- Your IP address, user agent and the time of the request, recorded by the web server and used to apply rate limits, block abuse and diagnose faults.
- Anti-spam check
- A token issued by Cloudflare Turnstile when the enquiry form is submitted, which tells us the submission came from a browser rather than a script. Turnstile does not track you across sites.
- Site analytics
- Pages you view, roughly where in the world you are, and what browser and device you use — measured with Google Analytics 4. It stores a randomly generated identifier in a cookie on your device so repeat visits can be recognised as the same browser, and it processes your IP address to derive an approximate location. We never upload your name, email address or enquiry to it. The site works normally if you block it.
- Correspondence
- Emails, meeting notes and documents exchanged while we discuss or deliver a project.
03
Why we collect it, and what makes it lawful
The Digital Personal Data Protection Act 2023 gives a Data Fiduciary two routes: your consent for a stated purpose, or one of the “legitimate uses” the Act itself lists. There is no general balancing test to fall back on, so each purpose below names the route it takes.
Where the route is consent, it is asked for by a clear tick on the enquiry form, never bundled with anything else, and it covers only the data needed for the purpose stated next to it.
- Answering your enquiry — legitimate use, section 7(a)
- You voluntarily gave us these details for one obvious purpose: getting a reply about work. We process them for that purpose and no other. Tell us to stop and we stop.
- Confirming the enquiry reached us — consent
- The tick on the form is your consent to us holding the enquiry and writing back to the address you gave. You can withdraw it at any time, as easily as you gave it, by emailing us; we then stop processing and erase, unless a law requires the record to stay.
- Preparing and delivering a project — consent
- Where the conversation turns into a proposal, a statement of work or a delivered project, the engagement agreement sets out what we process to do the work and you agree to it in signing.
- Keeping the site up and abuse out — legitimate use, section 7(a), and section 8(5)
- Rate limiting, bot checks, server logs and error reports are how the enquiry you sent actually arrives, and the Act separately obliges us to protect the personal data we hold with reasonable security safeguards.
- Accounting and tax records — legitimate use, section 7(b)
- Invoices and the records behind them are kept because Indian company and tax law compel us to keep them, for the periods those laws set.
- Anything else — consent, asked for first
- If we ever want to use your details for something not listed here, we will describe it and ask, and you can say no or change your mind later.
05
Who else processes it
A Data Fiduciary stays answerable for the Data Processors it engages, so we keep the list short and hold each provider to a written contract. Nobody on it may use your data for their own purposes.
- Hosting and network
- Our own servers, and Cloudflare as the network in front of them for DNS, TLS, caching and the Turnstile bot check.
- Email provider
- A transactional email service that delivers the notification of your enquiry to us and the acknowledgement to you.
- Analytics
- Google Analytics 4, operated by Google. It receives the pages you view, your approximate location derived from your IP address, and a random identifier stored on your device. Google processes this outside India, including in the United States, under its own terms as our Data Processor.
- Performance measurement
- Cloudflare Web Analytics, which records how quickly pages loaded for you and which page you were on. It sets no cookie, stores no identifier on your device and cannot follow you to another site; we use it to find pages that are slow on real connections rather than on a test machine.
- Business tools
- Where an enquiry becomes a project, the usual working tools: a customer record system, a source-code host and a document store, each restricted to the people on the engagement.
06
Where your data goes
Our team works from India and enquiry data is held on servers in India by default.
Some of the providers above run outside India, so a copy may be processed abroad. Section 16 of the DPDP Act allows that transfer to any country the Central Government has not restricted by notification, and we check that list before we add a provider. Our obligations to you under this notice travel with the data, backed by contract, encryption in transit and at rest, and access limited to named engineers.
07
Visitors from the EU, the UK and elsewhere
We market our work in India, but a website is reachable from anywhere and people outside India do write to us. If you are one of them, everything in this notice applies to you as written.
Where the GDPR or the UK GDPR applies to a particular enquiry, we honour the equivalent rights — access, correction, erasure, objection, portability and withdrawal of consent — through the same address, and you keep the right to complain to your own supervisory authority. We do not offer goods or services in those markets, and nothing here is a claim to a representative or a lead supervisory authority there.
08
How long we keep it
The Act says personal data must go once its purpose is served, so we delete on a schedule rather than when someone remembers to. Ask us to erase your data sooner and we will, unless a law requires us to keep the record.
- Enquiries that do not become projects
- 24 months from our last exchange, then deleted.
- Project and client records
- For the life of the engagement and 8 years after it ends, matching the book-keeping periods Indian company and tax law require.
- Server and security logs
- 30 days, then rotated out.
- Backups
- 35 days. A deletion request is applied to live systems immediately and works through the backup cycle within that window.
09
How we protect it
Section 8(5) of the Act requires reasonable security safeguards. The same controls we build for clients apply to our own systems: TLS 1.3 in transit, encryption at rest, multi-factor authentication on every account, access granted on least privilege and reviewed, secrets held in a vault and rotated, dependency and image scanning in the release pipeline, and point-in-time recovery backups with a restore drill we actually run.
If personal data we hold is breached we will tell the Data Protection Board of India and every affected person, in the form and within the time the DPDP rules set, and we will say what happened, what it means for you and what we have done about it.
10
Your rights
Write to hello@geekholic.com and we will answer within 30 days. We do not charge for this, and we will not ask you for more identification than we need to be sure it is you.
- Access
- A summary of the personal data we hold about you, what we are doing with it, and who else we have shared it with.
- Correction and completion
- Correction of anything inaccurate, and completion of anything partial.
- Updating
- A change of the details on file when yours change.
- Erasure
- Deletion, unless keeping the record is required by law or is still needed for the purpose you gave it for.
- Withdraw consent
- At any time, and as easily as you gave it. It does not undo processing that was lawful before you withdrew.
- Grievance redressal
- A complaint to us about how we have handled your data or your request, answered by a person and not a form letter.
- Nominate
- Name someone to exercise these rights on your behalf if you die or lose the capacity to do it yourself.
11
What the Act asks of you
The DPDP Act puts a short list of duties on Data Principals too, and they are the obvious ones: give details that are genuine and your own, do not impersonate anyone, and do not file a complaint you know to be false. We mention them because the Act does, not because we expect trouble.
12
Complaints
Tell us first at hello@geekholic.com and we will try to put it right — the Act asks you to exhaust our grievance route before going further, and we would rather fix it than be told to. If you are not satisfied with our answer, or we do not answer, you can complain to the Data Protection Board of India, which is the regulator for this notice. Complaining does not affect any other remedy you have.
13
Children
This is a business-to-business site. It is not directed at children, and we do not knowingly collect data from anyone under 18. Under the Act a child’s data may only be processed with verifiable parental consent, and we never track or advertise to children. If you believe a child has sent us personal data, contact us and we will delete it.
14
Changes to this notice
When we change what we collect or why, we update this page and the date at the top of it. Material changes affecting an existing enquiry or client are sent by email as well.