Privacy Notice

1. Who is responsible

Imayan Digital LLP ("IDAI", "we", "us", or "our") determines why and how personal data described in this notice is used. We operate from Chennai, India and serve an international institutional audience.

This notice applies to imayandigital.com, IDAI inquiry forms, direct email correspondence, and interactions with IDAI accounts on third-party platforms. It does not govern personal data processed for a client under a separate engagement, where the relevant agreement and project notice apply.

2. Information we collect

3. Do not send sensitive or restricted data

The public inquiry form and ordinary email are intended for high-level institutional context. Do not submit customer or account-level data, financial or payment credentials, government identifiers, health data, authentication secrets, raw portfolio files, source code, legally privileged material, trade secrets, or information that your institution has not authorised you to share. Contact us first if a discussion requires a secure channel or confidentiality agreement.

Organisational problem statements may contain personal data, but often also include non-personal confidential business information. This notice governs the personal-data element. Our Website Terms explain the pre-engagement confidentiality boundary for other information.

4. Why we use information

We use personal data only as reasonably necessary to:

• receive, evaluate, route, and respond to an inquiry;
• verify institutional affiliation or authority where appropriate;
• arrange discussions and take requested steps toward a possible engagement;
• maintain a record of professional correspondence and decisions;
• operate, secure, diagnose, and improve the website and forms;
• measure aggregate readership and content usefulness;
• prevent spam, impersonation, fraud, and other misuse; and
• meet legal obligations and establish, exercise, or defend legal claims.

Submitting an inquiry permits us to reply directly about that inquiry. We do not currently operate a general marketing newsletter through this form. If we introduce one, we will provide a separate choice and an unsubscribe method where required.

5. Legal grounds

The legal ground depends on your location and the context. Where laws such as the EU or UK GDPR apply, we generally rely on steps requested before a possible contract, our legitimate interests in professional correspondence, website security, and business development, compliance with legal obligations, and consent where a law specifically requires it. We balance legitimate interests against the effects on individuals and do not use inquiry data for unrelated advertising.

In India, we process data in accordance with applicable law, including provisions of the Digital Personal Data Protection Act, 2023 and Rules as they come into force. Regardless of phased commencement, the practical request options in section 10 are available now.

6. Where information goes

We do not sell or rent personal data and do not use it for targeted advertising.

We may disclose only what is reasonably necessary to:

• Vercel, which hosts the website, provides delivery and technical logs, and supplies aggregate Web Analytics and sampled Core Web Vitals measurements;
• Resend, which transmits website inquiry emails and processes message content and delivery metadata;
• Cloudflare, when Turnstile is enabled, which processes browser and network signals to distinguish people from bots;
• professional advisers, contractors, or service providers under appropriate duties of confidentiality and data protection;
• regulators, courts, law enforcement, or other parties when required by law or reasonably necessary to protect rights, safety, and the integrity of our services; or
• a successor in a merger, financing, reorganisation, or transfer of business, subject to appropriate confidentiality and notice where law requires it.

Current website inquiries are delivered through Resend to an IDAI-managed email inbox; we do not currently place them in a separate website lead database. If we introduce a CRM or database that materially changes this processing, we will update this notice before or when the change takes effect.

7. International processing

We and our providers may process information in India, the United States, and other countries where they operate. Those countries may have different data-protection laws. Where applicable law requires a transfer mechanism, we use or rely on contractual or other recognised safeguards provided for the relevant service. You may contact us for further information about a transfer affecting your personal data.

8. Retention

We generally retain inquiry and related correspondence for up to 24 months after the last substantive interaction so that we can manage follow-up, avoid duplicated outreach, and maintain an accountable business record. If an engagement begins, relevant records are retained under the engagement terms and legal, tax, audit, professional, and dispute requirements. We may retain a minimal suppression or security record where necessary to honour an objection or prevent abuse.

In-memory form rate-limit records expire after approximately one hour. Hosting, email, security, and analytics providers retain service data under their own configured periods and legal obligations. We delete, anonymise, or minimise information when it is no longer reasonably needed, unless law or a legal claim requires longer retention.

9. Security and email ownership

We use proportionate administrative and technical measures, including access controls, transport encryption supplied by our providers, input validation, rate limiting, and optional bot verification. No internet transmission or storage system is completely secure, and ordinary email can be forwarded, misaddressed, or accessed outside our control.

We validate form structure and reject common consumer email domains, but this does not prove that a submitter owns an address or speaks for the named institution. We may request verification before sharing substantive information. If your address was submitted without permission or you received a message in error, contact us so we can restrict or delete the record where appropriate.

10. Your choices and rights

Subject to applicable law and necessary verification, you may ask whether we hold your personal data and request access, correction, completion, deletion, restriction, portability, or withdrawal of consent. You may object to processing based on legitimate interests and ask us to stop non-essential contact. Some rights are limited where we must retain information for law, security, another person's rights, or legal claims.

Send a request from the relevant email address where possible and describe the interaction or record. We may ask for proportionate evidence of identity or authority, especially for an institutional address. We aim to respond within 30 days, although the period may vary where applicable law permits or requires it. You may also complain to the data-protection or supervisory authority available in your jurisdiction.

11. Automated screening

The inquiry form automatically checks required fields, submission speed, common consumer-email domains, request frequency, and, when configured, a Turnstile result. These checks may delay or reject a submission. They are used only to protect an institutional inquiry channel and do not make a decision that produces legal or similarly significant effects. If a legitimate inquiry is blocked, contact us directly.

12. Provider notices

The following official notices provide further detail about provider processing:

• Vercel Web Analytics privacy information →
• Vercel Speed Insights privacy information →
• Resend Privacy Policy →
• Cloudflare Turnstile Privacy Addendum →

13. Children

This website is designed for institutional professionals and is not directed to anyone under 18. We do not knowingly seek personal data from children. If you believe a child has submitted information, contact us so we can assess and remove it as appropriate.

14. Changes to this notice

We may update this notice as our website, providers, products, or legal obligations change. We will change the effective date and, for a material change, provide additional notice where reasonably possible or legally required. We will not use previously collected data for a materially incompatible new purpose without the notice or choice required by law.