Privacy Policy

This policy explains what personal data we collect on this website, why we collect it, who receives it, and what you can do about it. It is written to be read without a lawyer.

We process personal data under India's Digital Personal Data Protection Act, 2023. Under that Act we are the Data Fiduciary and you, the person the data is about, are the Data Principal.

This policy describes only the processing that actually happens on this website. We run no newsletter, no mailing list, no user accounts, no login area and no online shop.

Who we are

The Data Fiduciary responsible for the personal data described in this policy is:

Oncademy India Private Limited 9th floor, RMZ Latitude, Hebbal 560024, Bangalore India

Email: [email protected]

Phone and WhatsApp: +91 9740507560

Website: https://www.on7-india.com/

What we collect and why

We collect personal data in three situations, described below.

When you send us an enquiry

Our contact form collects the following:

We also record the page of our website you sent the enquiry from.

We use this data to read your enquiry, reply to you, and continue the conversation you started, by email, phone or WhatsApp where you have given us those details.

To send the form you must complete first name, last name, email address, country and your message, and tick the consent box. The other fields are optional, and you choose what to write in your message. Please do not send us financial account details, government identification numbers, health data or other sensitive information through this form. We do not ask for it and do not need it to answer you.

Website statistics

On the live version of this website we use Umami, an analytics tool we host ourselves at https://analytics.on7.de. Umami sets no cookies of its own and does not track you across other websites. It records page views and referral information so that we can see which pages are used and how visitors find us.

When you submit the contact form, an analytics event is recorded for that submission. It carries the form identifier, the page you submitted from, any campaign parameters in the link you arrived through (utm_source, utm_medium, utm_campaign, utm_term, utm_content, fbclid), and Meta advertising identifiers read from the _fbp and _fbc cookies if those cookies are present in your browser. This event relates to your individual submission rather than to aggregate totals. It does not contain your name, email address or phone number.

This event data exists so that enquiries can be matched to the campaign or referral that led to them. We do not use it to build a profile of you, and we do not use it to make decisions about you.

Server logs

Like any web server, ours records technical details of each request, such as the IP address, the date and time, the page requested, the browser type and version, the operating system and the referring page. We use these logs to deliver the website, keep it stable and secure, investigate faults, and detect misuse or attacks. We do not use them to identify individual visitors and we do not combine them with contact form data.

Cookies

This website sets no cookies of its own. It uses no cookies for analytics, advertising or profiling.

If Meta advertising cookies (_fbp or _fbc) are already present in your browser because you visited another site, our contact form reads their values and sends them with the analytics event for your submission, as described above. We do not create these cookies. You can remove them and control future cookies through your browser settings.

Advertising and tracking tools

Google Tag Manager and the Meta Pixel are prepared in our website code but are not activated. No container or pixel identifier is configured, so no Google or Meta advertising script is loaded when you visit this site, and no enquiry data is transmitted to Google or Meta.

If we activate either tool in future, we will update this policy before the change takes effect and obtain your consent where the law requires it.

Consent

Our lawful basis for processing the data you enter in the contact form is your consent. You give it by ticking the consent box, which links to this policy, before you send the form. The box is never ticked for you, and the form cannot be sent without it.

Your consent is free, specific, informed, unconditional and unambiguous, and it covers only the purposes described in this policy.

Server logs are different. We keep them because the website cannot be delivered, kept secure or defended against misuse without them.

The Act allows consent to be given and withdrawn through a Consent Manager registered with the Data Protection Board of India. We do not use one at present. Consent for this website is given directly to us through the form and can be withdrawn directly by contacting us. If we begin working with a registered Consent Manager, we will update this policy and explain how to use it.

Withdrawing your consent

You can withdraw your consent at any time. Send an email to [email protected] saying that you withdraw it. You do not have to give a reason.

Please send it from the email address you used in the form, or tell us which address you used, so that we can find your enquiry and act on your request.

Once you withdraw, we stop processing your personal data for that purpose and erase it within a reasonable period, unless a law requires us to keep it. Processing we carried out lawfully before you withdrew remains lawful.

If you withdraw consent for your enquiry data, we may no longer be able to answer your enquiry or continue an ongoing conversation with you.

Where your data is stored and who can see it

Contact form submissions are transmitted to and stored in a database operated for us by our database and hosting service provider, which acts as our Data Processor under contract. It may process the data only on our instructions and must keep it confidential and secure.

Within our company, access is limited to staff who need the data to answer your enquiry.

Our analytics run on a server we operate ourselves. The analytics data described above is stored on that server and is not passed to a third-party analytics company.

We do not sell personal data and we do not share it with data brokers or for the marketing purposes of others.

We share personal data only where it is necessary: with our Data Processors for hosting, database, email and IT services; with professional advisers such as lawyers or auditors under confidentiality obligations; and with courts, regulators or public authorities where the law requires it or where it is needed to establish, exercise or defend legal claims.

Some of our service providers operate infrastructure outside India, so your personal data may be stored or processed outside India. We make such transfers only to countries that the Central Government has not restricted under the Act, and we require appropriate contractual and technical safeguards so that your data remains protected to the standard described here.

How long we keep it

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as a law requires us to keep it.

We keep contact form data while we deal with your enquiry and any follow-up. If no business relationship results, we erase it once the enquiry is closed and no further correspondence is expected. If a contract or an ongoing relationship follows, we keep the data for as long as the applicable statutory retention periods require and erase it afterwards.

Server log entries are erased or anonymised once they are no longer needed for the purposes described above. Entries relevant to a security incident may be kept until that incident is resolved.

We erase personal data sooner if you withdraw your consent or ask us to erase it, unless retention remains necessary to comply with a legal obligation.

How we protect it

We take reasonable technical and organisational security safeguards to prevent personal data breaches, as the Act requires of a Data Fiduciary. These include:

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and each affected Data Principal as the Act requires.

Your rights

As a Data Principal you have the right to:

To exercise any of these rights, write to [email protected] and tell us what you want. Please give us enough information to find your data, such as the name and email address you used when contacting us. We may ask you to confirm your identity so that we do not disclose your data to someone else.

There is no charge for exercising these rights. We aim to acknowledge your request within 72 hours and to respond within 30 days, and in any case within the period prescribed under the Act.

Your duties

The Act also places duties on you. Please give us information that is authentic and accurate, do not impersonate another person when providing personal data, and do not raise a false or frivolous grievance.

Children and persons with a guardian

This website and our services are intended for adults. We do not knowingly collect the personal data of anyone under the age of eighteen through this website, and we ask children not to submit personal data to us.

Where we learn that we hold the personal data of a child, or of a person with a disability who has a lawful guardian, we will process it only with verifiable consent from the parent or lawful guardian as the Act requires, or erase it.

We do not carry out tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has given us personal data, write to [email protected] and we will erase it.

Automated decisions and profiling

We do not use your personal data to make automated decisions that produce legal or similarly significant effects for you, and we do not use it to build profiles about you.

Links to other websites

This website links to websites operated by others. This policy covers only this website. We are not responsible for the privacy practices of other sites, and we recommend reading their privacy notices before giving them personal data.

Grievance redressal

If you are unhappy with how we handle your personal data, or with the way we have answered a request, contact our grievance channel first. We take grievances seriously and will work with you to resolve the matter.

Grievance Officer, Oncademy India Private Limited

Email: [email protected]

Phone and WhatsApp: +91 9740507560

Oncademy India Private Limited 9th floor, RMZ Latitude, Hebbal 560024, Bangalore India

Please write "Data protection grievance" in the subject line so that your message reaches the right person quickly. We aim to acknowledge within 72 hours and to respond within 30 days.

If we do not resolve your grievance to your satisfaction, you may complain to the Data Protection Board of India in accordance with the Act.

What this website does not do

To be clear about what is not happening here:

Changes to this policy

We may update this policy, for example when we change how the website works, when we add or replace a service provider, or when the law changes. The current version is always published on this page.

Where a change materially affects how we process your personal data, we will take reasonable steps to inform you and, where the law requires it, obtain fresh consent before the change takes effect.

Last updated:

Imprint

Company identification details for the operator of this website are on our Imprint page.