Privacy & data protection

The short version

This website collects personal data in one place: the contact form. What you type there is emailed to the directors and stored on our own server so we can find it again when we reply. It is deleted after twelve months, or sooner if you ask. There are no advertising pixels, no mailing list, and no data sold or shared with anyone. There is one analytics tool, Google Tag Manager, and it does not load unless you accept it — refuse, or simply ignore the question, and your browser never contacts Google at all. Everything below is the same statement said precisely enough to satisfy two regulators.

Who is responsible

Verhelm Advisory Private Limited, trading as Verhelm Advisory, of C-64, First Floor, East of Kailash, New Delhi - 110065, is the data controller for the purposes of the UK and EU GDPR and the Data Fiduciary for the purposes of the Digital Personal Data Protection Act, 2023.

For any question about this notice, or to exercise a right described below, contact dhirajkhanna@verhelm.com.

Our Grievance Officer for the purposes of section 13 of the DPDP Act is Dhiraj Khanna, Director, audit and engineering, reachable at dhirajkhanna@verhelm.com or by post at the registered office above. We aim to respond within seven working days and will not exceed the statutory periods. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India, or — where the GDPR applies to you — to your local supervisory authority.

What we collect, and why

Contact form submissions

Your name, email address, optional company name, and the message you write. Collected so we can read your enquiry and reply to it: nothing else. Providing a company name is optional and the form works without it. Each submission is emailed to the directors and written to a database on our own server, which only the directors can reach, behind a password.

Technical detail attached to a submission

Alongside your message we record the time you sent it, the time you gave consent, your IP address and your browser’s user-agent string. These are kept to identify and block abuse of the form, which is a legitimate interest, and for no other purpose. They are never used to profile you and are deleted with the rest of the enquiry.

Analytics, only if you accept it

If you accept analytics, Google Tag Manager loads on the public pages of this site. Google then receives your IP address, your browser’s user-agent string and the page you are reading, and the tags in the container set a cookie holding a randomly generated identifier so that repeat visits from the same browser can be recognised. We use it to see which pages are read. If you refuse, or have not answered, none of this happens and no request is made to Google. The cookie page sets out exactly what is set and how to withdraw.

Email correspondence

If you email us, that correspondence sits in our mailboxes for as long as the business relationship or enquiry reasonably requires.

Server logs

Our hosting produces standard access logs, which include IP addresses, for security and to keep the service running. These are not used to build a profile of you and are not combined with anything else.

Client engagement data

Where you become a client, we process the material you share with us under a separate written agreement, which governs in place of this notice for that data.

What we deliberately do not do

• We set no advertising or profiling cookies, and run no remarketing or audience tags. The single analytics container is opt-in, off until you say otherwise, and refusable in one click. See the cookie page.
• Fonts are served from our own origin rather than a font CDN, so loading a page transmits nothing to a third party until and unless you accept analytics.
• We use no third-party CRM or marketing platform. Enquiries are held on our own infrastructure and are not uploaded anywhere else.
• We do not sell, rent or share personal data, and we run no automated decision-making or profiling that produces legal or similarly significant effects.

Lawful basis and consent

Under the GDPR we rely on your consent (Art. 6(1)(a)) for the contact form, given by the unticked checkbox you complete when you send it, and on legitimate interests (Art. 6(1)(f)) for keeping our systems secure and our correspondence in order.

For analytics we rely on your consent as well, given by the banner and withdrawable at any time from the cookie page. Storing and reading information on your device additionally requires consent under the ePrivacy Directive, which is why nothing is loaded before you answer rather than merely disabled afterwards. Withdrawing is as easy as consenting, takes effect immediately, and does not affect anything collected while your consent stood.

Under the DPDP Act we process contact-form data on your consent, which is requested with an itemised description of the purpose, is not bundled with anything else, and can be withdrawn at any time by replying to us and saying so. Withdrawing consent is as easy as giving it, and does not affect anything done before you withdrew it.

How long we keep it

• Analytics, if you accepted it:two months, which is the shortest period Google Analytics allows, for both event-level and user-level data. We have also turned off the setting that restarts that clock every time you come back, so the two months runs from when the data was collected rather than from your last visit. Aggregate counts — how many people read a page — are not governed by that setting and are kept by Google for longer.
• Enquiries that do not become engagements: deleted within 12 months. Every stored enquiry carries its own deletion date, set when it arrives, and a scheduled job deletes the record once that date passes. Deletion means the row is removed, not hidden or flagged.
• Client correspondence and records: kept for the life of the engagement and then for the period our professional and statutory obligations require, after which it is deleted.
• Server logs:rotated on the host’s standard schedule, which is measured in weeks, not years.

Who else sees it

We use a small number of service providers, each acting on our instructions under a data processing agreement:

• Resend delivers the email generated by the contact form.
• Google Workspace hosts our email.
• Google also receives analytics data through Google Tag Manager, but only from visitors who have accepted it, and it acts as a controller in its own right for that data rather than purely on our instructions. Refusing, or ignoring the banner, means Google receives nothing.
• Sanity stores the articles published under Resources. It holds no visitor data.
• A virtual private server at Hetzner, Finland, managed with Coolify — runs this website and the database that holds contact-form enquiries. It serves pages, writes short-lived request logs, and stores enquiries for us until their deletion date. No other provider receives contact-form content.

Some of these operate outside the UK, EEA and India. Where personal data is transferred internationally we rely on adequacy decisions where they exist and on Standard Contractual Clauses where they do not, with transfer risk assessed. Under the DPDP Act, transfers are permitted except to territories the Central Government restricts by notification.

Your rights

If the GDPR applies to you, you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, to withdraw consent at any time, and to complain to a supervisory authority. In the UK that is the Information Commissioner’s Office.

If the DPDP Act applies to you, as a Data Principal you have the right to access a summary of your personal data and our processing of it, to correction, completion, updating and erasure, to grievance redressal through the contact above, and to nominate another individual to exercise your rights in the event of your death or incapacity. If we do not resolve your grievance, you may complain to the Data Protection Board of India.

To exercise any of these, email dhirajkhanna@verhelm.com. We will not charge you and we will not make it difficult.

Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect the personal data of anyone under 18, and we do not undertake any tracking, behavioural monitoring or targeted advertising directed at children, which the DPDP Act prohibits outright.

AI and this website

Where AI is used in producing this site or in delivering our services, we describe it on the AI disclosure page. Nothing you submit through the contact form is used to train any model.

Changes

We date this notice at the top and revise it when what we do changes. If a change is material we will say so here rather than quietly amending the text.