Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Facyliti, C-33, Sector 62, Noida, Uttar Pradesh 201301, India (“Facyliti”, “we”, “us”) collects, uses, shares and protects personal data when you visit facyliti.com, submit a form, download content, attend a demo, or otherwise interact with our marketing website (the “Site”). It is written to satisfy the Digital Personal Data Protection Act, 2023 (India) and the rules made under it (“DPDP Act”), and the EU/UK General Data Protection Regulation (“GDPR”). [LEGAL REVIEW REQUIRED]

This policy does not cover personal data processed inside the Facyliti product on behalf of our customers (for example, employee attendance or visitor records). For that processing Facyliti acts as a Data Processor (GDPR) / processes on behalf of a Data Fiduciary (DPDP) under our customer agreements; the customer’s privacy notice applies. [LEGAL REVIEW REQUIRED]

2. Personal data we collect

We collect the following categories of personal data. We apply data minimisation: we only ask for what we need for the purpose stated.

Category	Examples	Source
Identity & contact	Name, work email, phone, company, role, city	You (forms, emails, calls)
Business context	Company size, portfolio, modules of interest, message content	You
Marketing preferences	Newsletter subscription, consent choices, unsubscribe history	You
Technical & usage	IP address (anonymised by default), browser/device, pages viewed, referrer, approximate location derived from IP	Automatically, via cookies/analytics only after consent (see Cookie Policy)
Campaign attribution	UTM parameters, Google/Meta/LinkedIn click identifiers (gclid, fbclid, li_fat_id), landing page	Automatically when you arrive from a campaign link; persisted only with marketing consent
Anti-abuse	reCAPTCHA risk score, rate-limit counters, honeypot flags	Automatically on form submission (legitimate interest / security)
Privacy requests	Request type, verification details you provide	You

We do not knowingly collect data from children under 18 (DPDP) / under 16 (GDPR) and the Site is not directed at them. We do not collect sensitive/special-category data through the Site; please do not include it in free-text fields.

3. Why we process it and on what legal basis

Purpose	Legal basis — GDPR	Legal basis — DPDP Act
Respond to your demo/contact request and follow up on it	Art. 6(1)(b) steps prior to a contract; Art. 6(1)(f) legitimate interest	Consent given by submitting the form (s.6); legitimate use — voluntary provision for a specified purpose (s.7(a))
Send you the gated content you requested	Art. 6(1)(b)	Consent / s.7(a)
Send marketing emails and product updates	Art. 6(1)(a) consent (opt-in checkbox) — withdraw any time	Consent (s.6), withdrawable at any time (s.6(4))
Measure and improve the Site (analytics)	Art. 6(1)(a) consent via cookie banner	Consent via cookie banner
Campaign measurement and conversion tracking	Art. 6(1)(a) consent	Consent
Prevent spam, abuse and security incidents	Art. 6(1)(f) legitimate interest	Legitimate use / reasonable security safeguards (s.8(5))
Comply with law, respond to lawful requests, establish or defend legal claims	Art. 6(1)(c), 6(1)(f)	s.7 legitimate uses; applicable law

[LEGAL REVIEW REQUIRED] — confirm legal-basis mapping and whether any processing relies on contract vs. consent.

4. Consent, notice and withdrawal (DPDP Act)

Where we rely on consent, the request is presented with this notice in clear and plain language (s.5). You may withdraw consent at any time with the same ease with which you gave it (s.6(4)) — by using the unsubscribe link in any email, by changing “Cookie settings” in the footer, or via the data request form below. Withdrawal does not affect processing already carried out, and we may still process data where another legal basis or a legal obligation applies.

You have the right to nominate another individual to exercise your rights in the event of death or incapacity (s.14). Use the data request form and select “Nominate a person”.

5. Who we share data with (sub-processors)

We do not sell personal data. We share it only with service providers that process it on our instructions under written contracts, and with authorities where the law requires. Current categories and providers:

Provider	Purpose	Location	Safeguard
Amazon Web Services (Lightsail, ap-south-1)	Hosting the Site and its database	Mumbai, India	Processor terms; encryption at rest and in transit
Amazon SES (Amazon Web Services) — planned transactional e-mail provider	Sending notification and acknowledgement emails	Mumbai, India	Processor terms
CRM — to be appointed; this table will be updated before the integration goes live	Lead management and sales follow-up (via webhook)	—	Processor terms; SCCs where outside India/EEA
Google (Tag Manager, Analytics 4, reCAPTCHA)	Analytics (with consent), spam protection	Global (US)	Google Ads Data Processing Terms / SCCs; IP anonymisation
Meta Platforms (Meta Pixel)	Campaign measurement (with consent)	Global (US)	Meta Business Tools Terms; SCCs
LinkedIn (Insight Tag)	Campaign measurement (with consent)	Global (US)	LinkedIn Page Insights / Business Terms; SCCs
Cloudflare (if enabled)	CDN, WAF, DDoS protection	Global	Processor terms; DPA

[LEGAL REVIEW REQUIRED] — finalise the sub-processor list, regions and contractual safeguards before go-live.

6. Cross-border transfers

Our primary hosting is in India (AWS Mumbai). Some providers above process data in the United States or other countries. DPDP Act: we transfer personal data outside India only to countries not restricted by the Central Government under s.16. GDPR: where personal data of EU/UK residents is transferred outside the EEA/UK, we rely on adequacy decisions or Standard Contractual Clauses (and the UK Addendum) together with supplementary measures. [LEGAL REVIEW REQUIRED]

7. How long we keep data

Data	Retention
Demo / contact / whitepaper leads	Until the enquiry is closed plus 24 months, unless a customer relationship begins (then per contract) [LEGAL REVIEW REQUIRED]
Marketing subscriptions	Until you unsubscribe or after 24 months of no engagement
Analytics data (GA4)	14 months (Google Analytics retention setting)
Attribution cookie	30 days
Consent preference cookie	180 days
Anti-abuse counters	10 minutes – 1 hour (transient)
Privacy request records	3 years from closure, to evidence compliance [LEGAL REVIEW REQUIRED]
Server/security logs	90 days

When data is no longer needed for its purpose — or when you withdraw consent and no other basis applies — we erase it or irreversibly anonymise it, and instruct our processors to do the same (DPDP s.8(7)).

8. Your rights

Under the DPDP Act you have the right to: access a summary of your personal data and the processing activities (s.11); correction, completion, updating and erasure (s.12); grievance redressal (s.13); and to nominate (s.14). You also have duties under s.15 — for example, not to impersonate another person or file false grievances.

Under GDPR/UK GDPR you have the right to access, rectification, erasure, restriction, data portability, to object (including to direct marketing at any time), to withdraw consent, not to be subject to solely automated decisions with legal effect, and to lodge a complaint with a supervisory authority (for EU residents: your local data protection authority; UK: the ICO).

To exercise any right, use the data request form below or email hello@facyliti.com. We will acknowledge within 72 hours, may verify your identity, and respond within the period required by law (GDPR: one month, extendable by two; DPDP: the period prescribed under the DPDP Rules) [LEGAL REVIEW REQUIRED]. There is no fee unless requests are manifestly unfounded or excessive.

9. Grievance Officer & Data Protection contact

Grievance Officer (DPDP Act s.13 / IT Rules): The Grievance Officer, Facyliti, C-33, Sector 62, Noida, Uttar Pradesh 201301, India. Email: hello@facyliti.com. Hours: Mon–Fri, 9:30–18:30 IST. [LEGAL REVIEW REQUIRED]

GDPR: We have not appointed a Data Protection Officer, as our core activities do not require one under Art. 37; hello@facyliti.com is the contact for all data-protection matters. An EU (Art. 27) or UK representative will be appointed if and when our processing of EU/UK residents’ data requires one. [LEGAL REVIEW REQUIRED]

If you are not satisfied with our response, you may approach the Data Protection Board of India (DPDP) or your EU/UK supervisory authority (GDPR).

10. How we protect data

We use encryption in transit (TLS 1.2+) and at rest, role-based access on a need-to-know basis, multi-factor authentication for administrators, security headers, a web application firewall, rate limiting, logging and regular patching (minor updates are applied automatically). Personal data breaches are handled under our incident response process; where required we notify the Data Protection Board of India and affected Data Principals (DPDP s.8(6)) and/or the relevant supervisory authority within 72 hours and affected individuals without undue delay (GDPR Arts. 33–34). [LEGAL REVIEW REQUIRED]

11. Cookies and similar technologies

We use strictly necessary cookies without consent and analytics/marketing cookies only after you opt in via the banner. Full details, including each cookie, its purpose and lifetime, are in our Cookie Policy. You can change your choice any time via “Cookie settings” in the footer.

12. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Lead-scoring used by our sales team is assistive and reviewed by humans. Anti-spam scoring (reCAPTCHA) may block automated submissions; if you believe a genuine submission was blocked, email hello@facyliti.com.

13. Changes to this policy

We will post changes here with a new “Last updated” date and, for material changes, notify subscribers by email or a notice on the Site. Continued use after the effective date constitutes acknowledgement of the updated policy to the extent permitted by law.

14. Submit a data request

Use this form for access, correction, erasure, portability, consent withdrawal, nomination or grievances. It is routed to hello@facyliti.com and logged with a reference number.