Privacy Notice

1. Organization Identity

This Privacy Notice applies to the website https://thinkasol.com operated by Thinkasol Technology Pvt. Ltd. (operating under the brand name THINKASOL). For the purposes of applicable data protection law, including the Digital Personal Data Protection (DPDP) Act 2023, we act as the Data Fiduciary regarding personal data collected directly through this website.

Official contact email for privacy matters: privacy@thinkasol.com.

2. Categories of Personal Data Collected

We collect personal data only when voluntarily provided by you or automatically generated for technical communication:

• Enquiry Information: When you complete our Talk to Our Team form, we collect your full name, work email address, company or organization name (optional), the discussion topic or intent, and your message.
• Workflow Context: Depending on your chosen discussion topic, you may optionally provide details regarding your sales processes, recurring tasks, or technical integration requirements.
• Verifiable Consent Records: When you submit an enquiry, we record a server-side consent event in an access-restricted JSONL file containing a unique submission identifier, timestamp in UTC, the policy version active at submission time, the stated processing purpose, and a privacy-preserving pseudonymized network identifier.
• Technical & Security Logs: When connecting to our website, standard web server headers and network attributes (including IP addresses, browser user agent, and requested paths) may be processed in transient origin server and CDN logs strictly for DDoS mitigation, incident response, and security event audit under CERT-In Directions 2022.

3. Purposes & Lawful Basis of Processing

We process personal data under clear, lawful bases recognized by the DPDP Act 2023:

• Responding to Inquiries: Processing your contact information and message content to respond to your specific questions, schedule exploratory discussions, or arrange product demonstrations. Lawful Basis: Consent (Section 6, DPDP Act 2023).
• Verifiable Consent Management: Maintaining access-restricted records of when consent was provided to demonstrate compliance with applicable statutory obligations. Lawful Basis: Legal obligation and compliance defense.
• System Security & Incident Monitoring: Detecting unauthorized access, preventing spam and automated abuse, and maintaining technical logs for cybersecurity incident reporting. Lawful Basis: Legitimate operational interest and compliance with CERT-In Directions 2022.

We do not sell, rent, or lease your personal information to third parties, and we do not use enquiry details for automated third-party ad profiling.

4. Consent & Consent Withdrawal

Consent for enquiry communication is collected through an affirmative, initially unticked checkbox on our contact form. Enquiry consent is never preselected, bundled with unsolicited marketing newsletters, or made a condition for accessing public marketing pages.

Right to Withdraw Consent: Under Section 6(4) of the DPDP Act 2023, you have the right to withdraw your consent at any time with ease comparable to the manner in which consent was given. To withdraw consent:

• Send an email to privacy@thinkasol.com with the subject line "Consent Withdrawal"; or
• Submit a request through our enquiry form selecting the Privacy & Data Rights topic.

Upon receiving and verifying your withdrawal, we will cease processing your personal data for enquiry communication within reasonable operational timelines, unless retention is legally required for compliance or dispute resolution.

5. Storage & Third-Party Infrastructure

The technical infrastructure supporting thinkasol.com is structured as follows:

• Hosting & Edge Network: Web hosting and edge routing are provided by Hostinger International Ltd. Edge requests are routed through CDN edge nodes (including nodes in Mumbai, India) with TLS encryption.
• Email Transmission: Form submissions are transmitted via server-side mail transport directly to our designated internal monitoring mailbox (contact@thinkasol.com). Submissions are accessed only by authorized personnel responsible for client engagement.
• Audit Storage: Verifiable consent records and security event logs are maintained in restricted, non-public storage inaccessible from public web browsers. These JSONL files do not provide cryptographic tamper evidence or integrity verification.

Hosting location alone does not establish where all processing occurs. CDN routing, email delivery, provider support and subprocessors may involve locations outside India; we do not claim that every processing activity takes place in India.

6. Retention & Erasure

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required for legal compliance and defense of legal claims in accordance with Section 8(7) of the DPDP Act 2023:

• Enquiry Correspondence: Retained in authorized business email accounts for the duration of active commercial communication and up to 24 months following the conclusion of communication to support operational continuity, unless earlier erasure is requested by the data principal.
• Consent & Rights Audit Records: Retained strictly as necessary to demonstrate compliance, substantiate consent validity, and support legal defense under applicable limitation periods and the DPDP Rules 2025 as their relevant provisions commence.
• Security & Network Logs: Retained for a minimum period of 180 days in alignment with CERT-In Direction requirements, after which logs are automatically rolled over or purged in accordance with hosting system maintenance.

7. Security Safeguards

We implement technical and organizational controls to safeguard personal data against unauthorized access, loss, or alteration:

• Strict HTTPS transport security enforced with HTTP Strict Transport Security (HSTS) headers.
• Content Security Policy (CSP) restricting resource origins and blocking unauthorized external script execution.
• Frame-ancestors and X-Frame-Options protection preventing clickjacking attacks.
• Server-side rate limiting and honeypot validation mitigating automated form abuse.
• Strict directory access control prohibiting direct browser fetching of internal configurations and logs.

8. Data Principal Rights (DPDP Act 2023)

The DPDP Rules 2025 (G.S.R. 846(E)) have been notified. Commencement is phased: Rules 1, 2 and 17–21 apply on publication, Rule 4 after one year, and Rules 3, 5–16, 22 and 23 after eighteen months. Notification does not make every provision immediately enforceable.

We accept the following requests now. Statutory enforceability under the DPDP Act 2023 depends on commencement of the relevant provisions:

• Right to Access: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Completion: You may request correction of inaccurate data or completion of incomplete records.
• Right to Erasure: You may request deletion of your personal data where continued retention is no longer necessary.
• Right to Nominate: You have the right to nominate another individual to exercise your privacy rights in the event of death or incapacity.
• Right of Grievance Redressal: You may file a grievance regarding our data processing practices as described below.

To prevent unauthorized disclosure, all data rights requests require reasonable identity verification (such as confirming ownership of the originating email address) before records are disclosed or modified.

9. Cookies & Tracking

Our website uses strictly necessary infrastructure cookies (specifically the Hostinger CDN session cookie hcdn) to maintain secure edge routing, traffic balancing, and DDoS protection.

We do not execute third-party advertising cookies, behavioural retargeting pixels, or cross-site tracking scripts. For a comprehensive breakdown of cookies, please review our Cookie Policy.

10. Contact & Grievances

For questions regarding this Privacy Notice, data rights requests, or privacy concerns, please contact our privacy desk:

If a data grievance remains unresolved following internal escalation, Data Principals may seek redressal through the Data Protection Board of India subject to commencement of the relevant DPDP Act 2023 provisions and availability of the complaint mechanism.