Privacy, in plain words

Only what you type into the enquiry form: your name, email address, and optionally your company, phone number, the practice you are interested in, an indication of team size, and your message. Nothing else on this site collects personal data.

We do not set advertising or tracking cookies. We do not embed third-party trackers, social widgets or remote fonts — every asset on this site is served from our own domain. Our web host records standard server logs (IP address, user agent, requested URL) for security and diagnostics.

To reply to your enquiry and, if it goes further, to scope and price the work. That is the only purpose. We do not add form submissions to a marketing list, and we do not send unsolicited sequences.

Our lawful basis is your consent when you submit the form, and our legitimate interest in responding to a business enquiry addressed to us.

The three founders and, where relevant to your enquiry, the team lead who would run the work. Enquiries may be stored in our email system and CRM, which are operated by established third-party providers under their own data-protection terms.

We do not sell personal data, and we do not share it with anyone for their own marketing.

Enquiries that do not become engagements are deleted within 24 months. Records connected to an actual engagement are retained for as long as the contract requires and for the period Indian tax and company law obliges us to keep business records.

Data you give us as part of delivering a service — your customers’ records, your documents, your systems — is governed by the contract and data-processing terms signed for that engagement, not by this page. Under those terms you remain the data controller and we act as processor on your documented instructions.

Our operational controls are described on the quality and security page: named individual accounts, least privilege, individual NDAs, managed devices and a quarterly access review.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email hello@depra.in and we will act within 30 days. If your data is covered by the GDPR, you also have the right to object to processing, to request portability and to complain to your supervisory authority.

Where the Digital Personal Data Protection Act, 2023 applies, you may exercise the equivalent rights through the same address.

We operate from India and deliver to clients worldwide, so data you send us is processed in India. Where an engagement requires data to stay in a particular jurisdiction, say so during scoping — it is a solvable constraint, but it must be agreed before work starts.

If this policy changes, the date at the top of the page changes with it. Material changes affecting an active engagement are notified to the client directly rather than only published here.