Jatpo Solutions & Innovations
Privacy Policy
DRAFT — for legal review before publication
Version 0.1 · [Insert effective date] · Prepared for Jatpo
Table of Contents
1. Introduction
This Privacy Policy explains how Jatpo ("Jatpo", "we", "us", or "our") collects, uses, stores, shares, and protects personal data submitted through the Solutions & Innovations page (the "Page"), including its Business Inquiry form.
This Policy is separate from, and independent of, Jatpo's Career Portal Privacy Policy, which governs candidate data collected through Jatpo's recruitment channels. It is also independent of any privacy policy published by Sarvodaya, which operates as a fully separate initiative and is not otherwise referenced in this Policy.
This Policy is written to align with the EU General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDP Act), consistent with the framework used elsewhere in Jatpo's privacy documentation.
Note: This is a working draft, not a substitute for legal advice. It should be reviewed by a qualified data protection lawyer before publication.
2. Who We Are — Data Controller / Data Fiduciary
For the purposes of the GDPR, Jatpo acts as the "Data Controller" of personal data processed through the Page. For the purposes of the DPDP Act, Jatpo acts as the "Data Fiduciary".
Field | Details |
Entity | Jatpo (sole proprietorship / Einzelunternehmen) |
Registered address | [Insert business address] |
Country of establishment | Germany |
Contact email (privacy) | [Insert privacy contact email] |
EU representative (if applicable) | [Insert, if Jatpo has no EU establishment but targets EU data subjects] |
Grievance Officer (DPDP requirement) | [Insert name, designation, and contact details] |
3. Scope of This Policy
This Policy covers the Solutions & Innovations page, which showcases Jatpo's capabilities and project work — including High-Voltage Substation Laser Scanning & Digital Twin (BIM), Digital Residency & Modernization, App & Digital Product Development, Outsourcing/Project Resourcing, and the Mental Health Research Program — and the Business Inquiry form through which visitors (typically representing businesses or organisations) can contact Jatpo about potential work.
Any "Contact Us" link elsewhere on Jatpo's site that redirects to this Page is also covered by this Policy for the purposes of that inquiry.
Note: This Policy assumes the Business Inquiry form is the only data-collection point on this Page (no newsletter sign-up, live chat, or other tool beyond what's described below). Confirm and expand if that changes.
4. Personal Data We Collect
When a visitor submits the Business Inquiry form, we collect the information they choose to provide, which is expected to include:
Contact details (e.g. name, business/organisation name, email address, and optionally phone number)
Business context (e.g. the capability or project area they are inquiring about, and their inquiry/message)
Any additional information the visitor chooses to include in their message
Note: Confirm the exact field list against the Business Inquiry Form & Brevo Integration Requirements document, so this section matches the live form precisely.
5. How and Why We Use Personal Data (Legal Bases)
Purpose | GDPR legal basis | DPDP basis |
Responding to a business inquiry | Contract steps at the visitor's request (Art. 6(1)(b)) / Legitimate interests (Art. 6(1)(f)) | Consent / legitimate uses expressly permitted by law |
Maintaining a record of business contacts and inquiries in our CRM (Brevo) | Legitimate interests (Art. 6(1)(f)) — business development | Consent |
Sending relevant follow-up communications about the inquiry | Legitimate interests / Contract steps | Consent |
Complying with legal obligations | Legal obligation (Art. 6(1)(c)) | Legal obligation |
We do not use inquiry data to send unrelated marketing unless the visitor separately opts in to that. Where processing relies on consent, visitors may withdraw that consent at any time, as described in Section 9.
6. How We Share Personal Data
Business inquiry data may be accessed by:
Authorised Jatpo team members and contributors who handle business development and follow-up on inquiries.
Brevo, the third-party email/CRM platform used to store and manage inquiry submissions and to send related communications, acting as a processor on Jatpo's behalf under a data processing agreement.
Authorities or third parties where required by law, or to establish, exercise, or defend legal claims.
We do not sell personal data. We do not share business inquiry data with third parties for their own independent marketing purposes.
Note: Confirm Brevo's current sub-processor and hosting locations (Brevo, formerly Sendinblue, is headquartered in France) so Section 7 below can name the specific safeguard relied on for any transfer outside the EU/EEA.
7. International Data Transfers
Where personal data is transferred outside the country in which it was collected — including to Brevo's hosting infrastructure — we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or transfers to countries benefiting from an adequacy decision, as required by GDPR and the DPDP Act.
[Insert specific transfer safeguard and hosting location once confirmed with Brevo's data processing terms.]
8. Data Retention
We retain business inquiry data for as long as necessary to respond to the inquiry and maintain a reasonable business record of the contact, after which it is deleted or anonymised unless a longer period is required by law or the contact becomes an active business relationship (in which case ordinary business-records retention applies).
[Insert specific retention period once finalised, e.g. "Inquiries with no follow-on engagement are deleted after 24 months."]
9. Your Rights
Depending on the applicable law, visitors have the following rights over their personal data:
9.1 Rights under GDPR
Right of access to their personal data
Right to rectification of inaccurate or incomplete data
Right to erasure ("right to be forgotten"), subject to legal exceptions
Right to restrict processing in certain circumstances
Right to data portability
Right to object to processing based on legitimate interests
Right to withdraw consent at any time, without affecting prior lawful processing
Right to lodge a complaint with a supervisory authority
9.2 Rights under the DPDP Act (as Data Principal)
Right to access information about how personal data is processed
Right to correction and completion of personal data
Right to erasure of personal data no longer necessary for the stated purpose
Right to grievance redressal via Jatpo's Grievance Officer
Right to withdraw consent at any time
To exercise any of these rights, contact us at [insert privacy contact email]. We aim to respond within the timeframe required by applicable law.
10. Data Security
We apply reasonable technical and organisational measures appropriate to Jatpo's scale and resources to protect personal data against unauthorised access, alteration, disclosure, or destruction, including restricting access to authorised team members and relying on Brevo's own security measures as our processor.
11. Cookies and Other Tracking Technologies
The Page may use cookies or similar technologies strictly necessary for the form to function. [Confirm and expand once the Page's actual cookie/analytics usage is finalised — e.g. whether any analytics cookies are used, and whether a cookie-consent banner is required for non-essential cookies under applicable law.]
12. Data Breach Notification
In the event of a personal data breach that poses a risk to visitors' rights and freedoms, we will assess the breach and, where required by law, notify the relevant supervisory authority without undue delay (within 72 hours under GDPR, where feasible) and, where the breach is likely to result in high risk to affected individuals, notify those individuals directly. Under the DPDP Act, we will intimate the Data Protection Board of India and affected Data Principals in the manner and timeframe prescribed by applicable rules.
[Insert Jatpo's internal breach-response procedure once finalised.]
13. Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, the Page's functionality, or applicable law. We will indicate the date of the latest revision at the top of this Policy.
14. Contact Us
For questions about this Policy or to exercise your rights, please contact:
Privacy contact: [Insert email]
Grievance Officer (DPDP Act): [Insert name, designation, and contact details]
Postal address: [Insert address]
If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection supervisory authority (under GDPR) or the Data Protection Board of India (under the DPDP Act).