This Privacy Policy explains how Bits N Pixels ("we", "us", "our"), a company registered in India with its office at SCF 08, 2nd Floor, The Eminence Plaza, VIP Road, Zirakpur, Punjab 140603, India, collects, uses, discloses and protects personal data.
We process personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 together with the rules made under it. Where we provide services to clients or handle data relating to individuals in the European Economic Area or the United Kingdom, we also apply the standards of the UK and EU General Data Protection Regulation.
1. Who this policy applies to
This policy covers personal data relating to:
- visitors to this website;
- people who contact us or request a quotation;
- candidates who apply for a role with us;
- representatives of our clients, suppliers and partners.
Where we process personal data on behalf of a client while delivering a project, that client is the Data Fiduciary (or Controller) and we act as a Data Processor under their instructions. In those cases the client's own privacy notice governs, and our processing is defined by the agreement between us. This policy covers the data we determine the use of ourselves.
2. Personal data we collect
2.1 Data you give us
- Enquiry and quotation forms: name, email address, telephone number, company name, country, and the content of your message or requirement.
- Job applications: name, contact details, current location, work experience, current and expected remuneration, notice period, links you provide, your CV and anything else you include.
- Newsletter subscription: email address and, optionally, your name.
- Correspondence: the content of emails, calls and messages you exchange with us.
2.2 Data collected automatically
- Technical data: IP address, browser type and version, device type, operating system, and referring page.
- Usage data: pages viewed, time spent and navigation paths, where you have consented to analytics cookies.
- Security data: request logs retained to detect and investigate abuse.
We do not use third-party advertising networks or cross-site tracking on this website, and we do not sell personal data.
2.3 Data we do not want
Please do not send us sensitive personal data — such as health information, financial account details, government identity numbers or biometric data — through our website forms. We do not require it to respond to an enquiry, and we will delete it if received unnecessarily.
3. Why we process personal data, and on what basis
Under the DPDP Act we process personal data either with your consent or for a legitimate use permitted by the Act. Where the UK or EU GDPR applies, the corresponding lawful basis is shown.
| Purpose | Data used | Basis |
|---|---|---|
| Responding to your enquiry or quotation request | Contact and enquiry details | Consent; steps taken at your request prior to a contract |
| Assessing a job application | Application and CV data | Consent; steps taken at your request prior to employment |
| Delivering services and administering contracts | Client contact and account data | Performance of a contract |
| Sending our newsletter | Email address, name | Consent, withdrawable at any time |
| Securing the website and preventing abuse | IP address, request logs | Legitimate use / legitimate interests |
| Understanding how the site is used | Analytics data | Consent, given through the cookie banner |
| Meeting tax, accounting and statutory obligations | Transaction and invoice data | Legal obligation |
4. Consent and how to withdraw it
Where we rely on consent, you may withdraw it at any time and as easily as you gave it. Withdrawing consent does not affect processing carried out before withdrawal, and it may mean we can no longer provide something you asked for — for example, we cannot answer an enquiry if you withdraw consent to hold your contact details.
To withdraw consent, email privacy@thebitsnpixels.net, or use the unsubscribe link in any newsletter.
5. Sharing personal data
We share personal data only where necessary, and only with:
- Service providers who support our operations — cloud hosting, email delivery, error monitoring and payment processing — under contracts requiring them to protect the data and use it only on our instructions;
- Payment gateways where you make a payment to us. Card and bank details are collected directly by the gateway and are never stored on our systems;
- Professional advisers such as our accountants and lawyers, where required;
- Authorities where disclosure is required by law or by a valid legal process.
We do not sell, rent or trade personal data, and we do not disclose it for third-party marketing.
6. International transfers
We are based in India and our primary systems are hosted in Indian data centres. Some service providers may process data outside India. Where that happens, we transfer data only to countries not restricted by the Central Government under the DPDP Act, and we put appropriate contractual protections in place.
For clients in the EEA or UK, transfers out of those regions are made under Standard Contractual Clauses or the UK International Data Transfer Addendum, together with any supplementary measures required.
Where a client requires data to remain in a specific jurisdiction, we can deploy to a region of your choosing. This should be agreed at the start of an engagement, since it affects architecture.
7. How long we keep personal data
- Enquiries that do not become projects: up to 24 months, then deleted.
- Client records: for the duration of the engagement and 8 years thereafter, to meet limitation periods and statutory record-keeping requirements under Indian tax and company law.
- Job applications: 12 months from the decision, so we can contact you about other roles. Tell us if you would prefer immediate deletion.
- Newsletter subscriptions: until you unsubscribe.
- Security and request logs: up to 180 days.
We review retention periodically and delete personal data once the purpose it was collected for no longer applies and no legal obligation requires us to keep it.
8. Your rights
Subject to the conditions in the applicable law, you have the right to:
- Access — obtain confirmation of whether we process your personal data and a summary of that data;
- Correction — have inaccurate or incomplete data corrected or completed;
- Erasure — request deletion where the data is no longer needed for its purpose and no legal obligation requires retention;
- Withdraw consent — as described in section 4;
- Grievance redressal — raise a complaint with us and receive a response;
- Nominate — nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.
Where the UK or EU GDPR applies, you additionally have rights to restriction of processing, data portability, and to object to processing based on legitimate interests.
To exercise any of these, email privacy@thebitsnpixels.net. We will respond within 30 days. We may need to verify your identity before acting, which is a protection for you rather than an obstacle.
9. Grievance officer
In accordance with the DPDP Act and the Information Technology Act, 2000, complaints about how we handle personal data may be addressed to our Grievance Officer:
- Email: privacy@thebitsnpixels.net
- Post: Grievance Officer, Bits N Pixels, SCF 08, 2nd Floor, The Eminence Plaza, VIP Road, Zirakpur, Punjab 140603, India
We acknowledge complaints within 48 hours and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India, or to your local supervisory authority where the UK or EU GDPR applies.
10. Children's data
This website is not directed at children, and we do not knowingly collect personal data from anyone under 18. Under the DPDP Act, processing a child's data requires verifiable consent from a parent or lawful guardian, and we do not carry out behavioural tracking or targeted advertising directed at children. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Security
We apply reasonable security safeguards appropriate to the risk, including:
- encryption of data in transit using TLS, and encryption at rest for sensitive fields;
- role-based access control, so staff access only what their role requires;
- hashed and salted credentials — we never store passwords in a readable form;
- logging and monitoring sufficient to detect unauthorised access;
- regular patching of systems and dependencies;
- confidentiality obligations binding all personnel.
No system can be guaranteed completely secure. In the event of a personal data breach, we will notify the Data Protection Board of India and affected individuals as required by the DPDP Act, and any other regulator where obliged to do so.
12. Cookies
We use a small number of cookies, described in our Cookie Policy. Non-essential cookies are set only after you consent, and you may change your choice at any time.
13. Changes to this policy
We may update this policy to reflect changes in our practices or in the law. The date at the top shows when it was last revised. Where a change materially affects how we use personal data we already hold, we will take reasonable steps to notify you.
14. Contact
Bits N Pixels
SCF 08, 2nd Floor, The Eminence Plaza, VIP Road, Zirakpur, Punjab 140603, India
Email: privacy@thebitsnpixels.net
This document is provided for transparency about how we operate. It is not legal advice, and it does not replace the terms of any signed agreement between us, which take precedence where they differ.