Privacy Policy

1. Introduction

IDA Tech-Solutions ("IDA", "we", "us", "our") respects the privacy of everyone who contacts us, applies to us or visits this website. This policy explains what we do with personal data, and applies to www.idatechsol.com and to our business contacts, prospective clients and candidates.

It does not replace the data processing terms agreed with a client in an engagement contract. Where those terms and this policy differ in respect of data we process for a client, the engagement terms apply.

2. Who is responsible for your data

For the personal data described in this policy, the controller (the "data fiduciary" under India's Digital Personal Data Protection Act, 2023) is IDA Tech-Solutions, Kasturi Garden, SSM Marg, Bhayander-West, Thane 401101, Maharashtra, India.

Our privacy contact for all requests, questions and complaints is support@idatechsol.com. Requests from the United Kingdom and Europe may also be sent to kpj@idatechsol.com, and from the United States to rssingh@idatechsol.com; all of them reach the same team.

3. What we collect

We collect only what we need, and most of it comes directly from you.

• Enquiry details — when you submit the contact form: your name, work email address, company, phone number (optional), the area of interest you select, the message you write and the consent you give. We record the date and time of the submission.
• Career applications — where you apply for a role: the details in your application and any CV or supporting information you choose to send us, including your work history, qualifications and right-to-work information where relevant to the role.
• Business contact data — names, roles, business email addresses and phone numbers of people at client and prospective client organisations, collected in the course of meetings, proposals, events and engagement delivery.
• Technical data — our web server records the IP address, request time, URL requested, HTTP status, referring page and browser user agent for each request, in standard server logs used for security and diagnostics.
• Cookies — strictly necessary first-party cookies only, described in our Cookie Notice. This site sets no analytics, advertising or social media tracking cookies.

We do not knowingly collect special category data (such as health, religion or biometric data) through this website, and ask that you do not send it to us. We do not buy personal data from data brokers, and we do not sell personal data to anyone.

4. Why we use it, and our lawful basis

We use personal data for the purposes below. Where the GDPR or UK GDPR applies, the lawful basis for each is shown; where India's DPDP Act applies, we rely on your consent or on the legitimate uses permitted by that Act.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and we will tell you more about that assessment on request. Where we rely on consent, you may withdraw it at any time — this does not affect processing carried out before you withdrew it.

5. Personal data we process for clients

Delivering ERP, data, AI and managed services often means our teams handle personal data held in a client's systems — employee, customer, supplier or transactional records. When we do, the client is the controller and we act as a processor on their documented instructions.

In that role we: process personal data only as the engagement contract and the client's instructions permit; impose confidentiality obligations on every person given access; apply the technical and organisational measures agreed with the client; engage sub-processors only where permitted, under written terms no less protective than our own; assist the client with data subject requests, breach notification and impact assessments; and delete or return the data at the end of the engagement.

If you believe your personal data is held in a client system we work on, please contact that organisation, as they decide how it is used. We will support them in answering you.

6. Who we share it with

We do not sell, rent or trade personal data. We share it only as follows:

• Service providers who work for us — hosting and infrastructure, email, collaboration and ticketing tools, recruitment tools, and professional advisers. They act on our instructions under written contract and may not use the data for their own purposes.
• Our offices and group personnel — staff in our India, United Kingdom and United States locations, on a need-to-know basis, to respond to you and deliver services.
• Clients and partners — where you have asked us to introduce you, or where sharing is necessary to deliver an engagement you are part of.
• Authorities and advisers — where we are required to disclose by law, court order or regulator, or to establish, exercise or defend legal claims.
• An acquirer — if our business or part of it is reorganised, sold or merged, under appropriate confidentiality terms.

7. International transfers

We are an Indian company with client offices in the United States and the United Kingdom, so personal data you give us may be accessed from, or stored in, any of those countries. Transfers out of the United Kingdom or the European Economic Area are made under the UK International Data Transfer Agreement or Addendum, or the European Commission's Standard Contractual Clauses, together with any supplementary measures the transfer requires.

Transfers of personal data out of India are made in accordance with the DPDP Act and any restrictions notified by the Central Government. You can ask us for details of the safeguards applied to a particular transfer.

8. How long we keep it

We keep personal data only as long as it serves the purpose it was collected for, then delete it or anonymise it. As a guide:

• Enquiries that do not become engagements: up to 24 months from your last contact with us.
• Client and engagement records: for the term of the engagement and then as long as needed for contractual, tax, audit and limitation-period purposes — typically eight years.
• Unsuccessful job applications: up to 12 months, so we can consider you for other roles; longer only if you ask us to keep you on file.
• Web server logs: up to 12 months.
• Data processed for a client: as instructed by that client under the engagement contract.

9. How we protect it

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit over TLS, access control on a least-privilege basis, multi-factor authentication for administrative access, network and endpoint protection, logging and monitoring, secure development practices, vendor due diligence, background verification where permitted, and confidentiality and security training for our people.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, you — without undue delay and within the timescales the law sets.

10. Your rights

Subject to the law that applies to you, you may ask us to: confirm what personal data we hold about you and give you a copy; correct data that is inaccurate or incomplete; erase data we no longer need; restrict how we use it; provide it in a portable machine-readable format; or stop using it for a particular purpose. You may object to processing based on legitimate interests, and you may opt out of marketing messages at any time using the unsubscribe link or by writing to us.

If you are in India, the DPDP Act also gives you the right to nominate another person to exercise your rights in the event of your death or incapacity, and the right to a grievance redressal process — which is the contact below.

To exercise any of these rights, email support@idatechsol.com. We will respond within 30 days, and will tell you if we need longer or need to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with our response you may complain to your supervisory authority: the Data Protection Board of India; the Information Commissioner's Office in the United Kingdom (ico.org.uk); or your national data protection authority in the European Economic Area. We would appreciate the chance to resolve it with you first.

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means alone. AI-assisted tools may help our teams draft, summarise or triage, but a person reviews and takes the decision — including in recruitment.

12. Children

This is a business website. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Other websites and embedded resources

This site loads web fonts from Google Fonts and stylesheets and icons from the jsDelivr content delivery network. Those providers receive your IP address and browser details as a technical necessity of serving the file; they set no cookies on this site. Our pages also link to third-party sites, including our LinkedIn and X profiles. Once you follow a link, that site's own privacy policy applies — we are not responsible for it.

14. Changes to this policy

We review this policy regularly and will post any updated version on this page with a new "Last updated" date. Where a change materially affects how we use your personal data, we will take reasonable steps to tell you directly.

15. How to contact us

Write to support@idatechsol.com, or to the Privacy Contact, IDA Tech-Solutions, Kasturi Garden, SSM Marg, Bhayander-West, Thane 401101, Maharashtra, India.