Privacy Policy
Version draft-1
Draft – describes how the site works today; the final wording is published after legal review.
Who is responsible
Companies Radar is operated by [PLACEHOLDER – legal name of the operating business], [PLACEHOLDER – registered address] (the “Data Fiduciary” under India's DPDP Act and the “controller” under the GDPR).
Grievance Officer: [PLACEHOLDER – Grievance Officer name and contact]
What we collect, why, and for how long
| Where | What | Why | Legal basis | Kept for |
|---|---|---|---|---|
| Account | Name, e-mail, password (only a secure hash), country, accepted document versions, sign-in times and devices | To provide your account and keep it secure | Your consent and our legitimate use to secure the service | While the account exists; sign-in history 365 days |
| Company representatives | Job title, company website, work e-mail, claim documents | To check that you represent a company and let you manage it | Your consent | Claim documents 90 days after the decision |
| Watch list, follows and notifications | Companies and products you saved, what you follow, your saved searches, your notifications and how you want to receive them | To show your watch list and tell you about new matches | Your consent (you choose each item and can remove it any time) | Until you remove it or delete your account; notifications 180 days |
| Contact and removal requests | Name, e-mail, company, message, verification of the company domain | To answer and document your request | Your consent / legal obligation | Up to 2 years after the request is closed |
| Newsletter | E-mail address, confirmation time and consent text, opens (approximate) | To send the newsletter you asked for | Your consent (double opt-in); withdraw with one click | Until you unsubscribe; the address then stays on a do-not-e-mail list |
| E-mail delivery records | Address, subject, delivery status | To deliver e-mails and stop sending to addresses that bounce | Legitimate use to run the service | 90 days |
| Visits | A daily one-way code of your network address (no cookies) for counting views; with your permission, Google Analytics | To count profile views fairly and improve the site | Legitimate use; analytics only with your consent | Detailed records 30 days; totals are anonymous |
| Security and audit logs | Actions in accounts, IP address, device | To protect the service and meet legal duties | Legal obligation (CERT-In directions) | At least 180 days |
Company profiles contain business information about companies (not about private individuals), collected from public sources and from the companies themselves. Business contact details are shown only on request, never in the page source. We never sell personal data and never send marketing e-mails to contacts collected from websites.
Who receives data
Only service providers that help us run the site, under contract and for these purposes: hosting and database, e-mail delivery (our SMTP providers), content delivery and security (e.g. Cloudflare), Google Analytics (with your consent). Some providers may process data outside India or the EU; we use them only with appropriate safeguards and where the law allows. Authorities receive data only when the law requires it.
Your rights
- Access and a copy – download your data in Privacy & your data.
- Correction – update your details there; for your e-mail address, contact us.
- Erasure – delete your account there at any time, or ask us.
- Withdraw consent – newsletter: one click in any newsletter or in your account; cookies: “Cookie settings” at the bottom of every page. Withdrawal doesn't affect what happened before.
- Grievance and nomination – complain to our Grievance Officer (contact form); under the DPDP Act you may also nominate someone to act for you, and you may complain to the Data Protection Board of India (or, in the EU/UK, your data-protection authority).
We answer requests within the time the law sets (and within 30 days at the latest).
Security, breaches and children
Passwords are stored only as secure hashes, sign-in can be protected with two-factor authentication (required for staff), connections are encrypted and stored secrets are encrypted. If a personal-data breach happens, we inform the Data Protection Board and the affected people as the law requires.
The site is not meant for children: you must be at least 18 years old to register.
More information
Cookies are explained in the Cookie Policy. We announce material changes to this policy on the site; the version number above changes with each update.