Your privacy matters to us. This policy explains what personal data Gooseroot collects, why, how we protect it and the rights you have under Indian law (including the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000) and, where it applies, the GDPR.
1. Who we are
This website and our services are operated by [REGISTERED COMPANY NAME] ("Gooseroot", "we", "us"). For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary, and for the EU/UK General Data Protection Regulation ("GDPR") we are the data controller for the personal data described in this policy.
You can contact us about privacy at privacy@gooseroot.com.
2. Scope of this policy
This policy explains how we handle personal data when you visit www.gooseroot.com or www.gooseroot.in, contact us, join our product updates list, or work with us as a client. When we process personal data on behalf of a client inside software we build or operate for them, we act as a processor (Data Processor) under that client's instructions and our agreement with them, and the client's own privacy notice applies.
3. Personal data we collect
Information you give us
- Contact and project enquiries: your name, email address, company, the service you are interested in, budget range and the message you send.
- Product updates list: your email address.
- Clients: business contact details, billing information and communications needed to deliver a project.
Information collected automatically
- Server logs: our hosting provider records technical data such as IP address, browser type, pages requested and the date and time of each request, to deliver the site and keep it secure.
- Cookies: this website does not use advertising or analytics cookies, and our fonts are served from our own server rather than a third party. If we add analytics in future we will update this policy and, where required, ask for your consent first.
We do not ask for sensitive personal data (such as financial account details, health or biometric data) through this website. Please do not include it in messages.
4. How we use your data and our legal bases
| Purpose | Legal basis (GDPR) | Basis (DPDP Act) |
|---|---|---|
| Replying to your enquiry and preparing a proposal | Steps at your request before a contract; legitimate interests | Your consent, given when you submit the form |
| Sending product launch updates you asked for | Consent | Consent |
| Delivering client projects, invoicing and support | Performance of a contract | Consent and legitimate uses under Section 7 |
| Keeping the website secure and preventing misuse | Legitimate interests | Legitimate uses under Section 7 |
| Meeting legal, tax and accounting obligations | Legal obligation | Compliance with law under Section 7 |
We do not sell your personal data, and we do not use it for automated decision-making that has legal or similarly significant effects on you.
6. International transfers
We are based in India and some of our service providers may process data in other countries. Where personal data of people in the EU, EEA or UK is transferred outside those regions, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum). Transfers of personal data from India are made in line with Section 16 of the DPDP Act and any restrictions notified by the Government of India.
7. How long we keep it
- Enquiries that do not lead to a project: up to 24 months after our last contact, then deleted.
- Product updates list: until you unsubscribe or ask us to remove you.
- Client records: for the length of our relationship and afterwards for as long as tax, accounting and other laws require.
- Server logs: for a short period set by our hosting provider, normally no more than 90 days, unless needed to investigate a security incident.
8. How we protect it
We use reasonable security practices and procedures, as required by Section 43A of the Information Technology Act, 2000 and the related rules, and appropriate technical and organisational measures under the GDPR. These include encrypted connections (HTTPS), access controls, least-privilege access and reputable providers. No method of transmission or storage is completely secure, but if a personal data breach occurs we will notify affected people and the relevant authorities where the law requires.
9. Your rights
Everyone can ask us to access, correct, update or delete their personal data, and can withdraw consent at any time (this does not affect processing that happened before withdrawal).
Under the DPDP Act you also have the right to a summary of the personal data we process and who we share it with, the right to grievance redressal, and the right to nominate another person to exercise your rights in the event of death or incapacity.
Under the GDPR (if you are in the EU, EEA or UK) you also have the right to restrict or object to processing, the right to data portability, and the right to complain to your local data protection authority.
To use any of these rights, email privacy@gooseroot.com. We may need to verify your identity. We respond within one month, or sooner where the law requires.
10. Children
Our website and services are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
11. Grievance Officer
In line with the Information Technology Act, 2000, its rules and the DPDP Act, our Grievance Officer is:
[NAME]
[REGISTERED COMPANY NAME]
Email: privacy@gooseroot.com
We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is able to accept complaints, or, if you are in the EU, EEA or UK, to your local data protection authority.
12. Links to other websites
Our website may link to other websites and services. We are not responsible for their privacy practices, so please read their policies.
13. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If changes are significant, we will make that clear on this page or contact you directly.
14. Contact us
Questions about this policy or your personal data? Email privacy@gooseroot.com or use our contact page.