[Draft prepared with reference to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Have it reviewed by counsel and complete the bracketed fields before publishing.]
Who we are
This website is operated by [legal entity name, CIN, registered office] ("XCo", "we", "us"). For the purposes of the Digital Personal Data Protection Act, 2023, XCo is the Data Fiduciary for personal data collected through this website.
What we collect
- Details you enter in our forms: name, designation, organisation, email, mobile number, city, and anything you write in a message.
- Your scorecard answers, only if you request a debrief. Otherwise they stay in your browser and are not sent to us.
- Basic technical data such as pages visited and device type, if website analytics are enabled. [Name the analytics tool, or delete this line if none is used.]
Why we use it
We use your details only for the purpose you gave them for: to arrange a diagnostic or debrief, to respond to an enquiry, or to send The Execution Brief if you subscribed. We do not sell personal data or use it for unrelated marketing.
Consent and withdrawal
We process your data on the basis of the consent you give when you submit a form. You can withdraw consent at any time by writing to the contact below or using the unsubscribe link in our emails. Withdrawal does not affect processing that took place before it.
Who we share it with
We share data only with service providers who help us run this website and respond to you, such as our form-handling, email and hosting providers, under confidentiality obligations. [List the providers used.] We may disclose data where the law requires it.
How long we keep it
Enquiry data is kept for up to [24] months after our last contact with you, unless you become a client, in which case contract and statutory retention periods apply. Newsletter data is kept until you unsubscribe.
Your rights
You may ask for a summary of the personal data we hold about you, ask us to correct, complete, update or erase it, nominate another person to exercise your rights, and raise a grievance. We will respond within the time the law allows.
Grievance contact
[Name / designation], XCo, tirthankar@xcogroup.in. If you are not satisfied with our response, you may approach the Data Protection Board of India.
Security
We use reasonable technical and organisational safeguards, including encrypted connections (HTTPS) and restricted access, to protect personal data.
Children
This website is intended for professionals. We do not knowingly collect personal data from anyone under 18.
Changes
We may update this notice. The date at the top shows the latest version.