Privacy policy

Who we are and scope

Ascentspark Software Private Limited (Ascentspark, we, us) is a software company registered in India with its office at PS Srijan Corporate Park, Sector V, Kolkata, West Bengal. This Privacy Policy explains how we handle personal data when you visit ascentspark.com and related sites, contact us, apply for a role, or work with us as a client, prospect, partner or supplier.

It does not cover the products we build for clients or the products we operate under their own brands, each of which has its own privacy notice. Where we process personal data inside a client's system on the client's instructions, the client is the controller (or data fiduciary) and we act as processor; see the section on client project data.

For the personal data described here, Ascentspark is the controller under the EU and UK GDPR, the data fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act), and a business under the California Consumer Privacy Act (CCPA).

What we collect

You give us. Name, work email, phone, company, role, country and the content of your message when you contact us, request a review, book a call or subscribe. CVs, portfolios, links and interview notes when you apply for a role. Billing details, signatories and correspondence when you become a client or supplier. Files you upload for a cost review, such as invoices or architecture documents, which may contain personal data of your staff.

We collect automatically. IP address, approximate location derived from it, device and browser type, pages viewed, referring page, time on page and interaction events, through cookies and similar technologies described below. Server logs record requests for security and debugging.

From others. Business contact details from public professional profiles or your colleagues when they introduce you, and fraud or sanctions screening data where the law requires it.

We do not knowingly collect special-category data (health, biometrics, beliefs, sexual orientation) or data about children through the Site, and we ask you not to send it.

How we use it

• To reply to enquiries, prepare proposals and cost reviews, and run engagements: contracts, delivery, invoicing, support.
• To assess job applications and manage recruitment, and to keep suitable candidates on file where they agree.
• To operate, secure, measure and improve the Site, including fixing errors, preventing abuse and understanding which content is useful.
• To send service communications, and, with your consent or where permitted for existing business contacts, occasional updates about our work. Every marketing message has an unsubscribe link, and we honour it immediately.
• To comply with legal obligations such as tax, accounting, export-control and anti-money-laundering rules, and to establish or defend legal claims.

We do not sell personal data, and we do not use it to train artificial-intelligence models. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Legal bases

Under the GDPR we rely on: contract (to respond to your request and deliver services), legitimate interests (running and securing our business, B2B marketing to existing contacts, portfolio references, defending claims), consent (non-essential cookies, newsletters, keeping your CV on file), and legal obligation (tax, accounting, regulatory duties). Where we rely on legitimate interests we have balanced them against your rights and you can object at any time.

Under the DPDP Act we process personal data for the specified purpose you consented to, or for legitimate uses recognised by the Act such as responding to a request you voluntarily made, employment purposes and compliance with law. Consent may be withdrawn as easily as it was given.

Cookies and analytics

The Site uses a small number of cookies and browser storage:

• Strictly necessary. Session state, security tokens, remembering your cookie choice and preferences such as light or dark mode. These cannot be switched off.
• Analytics. Privacy-respecting, aggregated measurement of visits and page performance. Where analytics uses identifiers that count as personal data we ask for your consent first and IP addresses are truncated.
• Embedded content. Maps, videos or forms from third parties may set their own cookies under their own policies when you interact with them.

You can control cookies through the banner, your browser settings, or by clearing site data. Blocking necessary cookies may break parts of the Site. We honour Global Privacy Control signals as an opt-out where the law gives them effect.

Who we share it with

We share personal data only as needed, under contracts that restrict its use:

• Service providers acting on our instructions: cloud hosting and storage, email and communications, analytics, CRM and support tooling, payment and accounting, recruitment platforms and background-check providers where legally permitted.
• Professional advisers such as lawyers, auditors, accountants and insurers.
• Authorities where required by law, court order or to protect rights, safety and property; we push back on requests that are over-broad and tell you where the law allows.
• Business transfers. If we merge, are acquired or sell assets, personal data may transfer to the successor under the same protections, and we will notify you.

Within an engagement, the people you work with at Ascentspark and any vetted subcontractors bound by confidentiality will see the data needed to do the work, and no one else.

International transfers

We operate from India and serve clients worldwide, so personal data may be processed in India, in your country, and in the countries where our service providers run their infrastructure, including the United States and the European Union.

Where data leaves the EEA, the UK or Switzerland we rely on adequacy decisions where available, and otherwise on the European Commission's Standard Contractual Clauses (and the UK Addendum) together with transfer-impact assessments and supplementary measures such as encryption. Transfers of Indian personal data outside India are made to countries not restricted by the Central Government under the DPDP Act. You can request a copy of the relevant safeguards.

How long we keep it

We keep personal data only as long as needed for the purpose it was collected, then delete or anonymise it. Typical periods:

• Enquiries and prospects: 24 months from last contact, unless a relationship begins.
• Client and supplier records, contracts and invoices: the life of the relationship plus 8 years, to meet Indian companies, tax and limitation requirements.
• Recruitment data: 12 months after the process ends, or longer only with your consent to be considered for future roles.
• Cost-review uploads: deleted within 90 days of the review unless an engagement follows, and earlier on request.
• Server and security logs: up to 12 months. Analytics: aggregated after 14 months.

Where a legal hold, dispute or statutory duty applies we keep data for as long as that requires.

Security

We apply technical and organisational measures proportionate to the risk: encryption in transit (TLS) and at rest, role-based access on a need-to-know basis, multi-factor authentication for internal systems, hardened cloud configurations, logging and monitoring, secure development practices and code review, regular dependency and vulnerability management, staff confidentiality agreements and security training, and tested backups.

No system is perfectly secure. If a personal-data breach occurs that is likely to result in risk to you, we will notify the relevant supervisory authority (the Data Protection Board of India, and the competent EU or UK authority where applicable) and affected individuals without undue delay, as the law requires, and tell you what we are doing about it.

Your rights

Depending on where you live you have some or all of the following rights, which we honour for everyone regardless of location where we reasonably can:

• Access a copy of the personal data we hold about you and a summary of how it is processed.
• Correction of inaccurate or incomplete data, and erasure where there is no longer a lawful reason to keep it.
• Restriction or objection to processing based on legitimate interests, and objection to direct marketing at any time.
• Portability of data you provided, in a structured, machine-readable format.
• Withdraw consent at any time, without affecting processing already done.
• Nominate a person to exercise your rights if you are incapacitated or deceased (DPDP Act).
• Non-discrimination for exercising your rights, and the right to opt out of sale or sharing of personal data (CCPA). We do not sell or share personal data for cross-context behavioural advertising.
• Complain to a supervisory authority: the Data Protection Board of India, your local EU authority, the UK Information Commissioner's Office, or the California Privacy Protection Agency. We would appreciate the chance to resolve the matter first.

To exercise a right, contact us using the details in the last section. We will verify your identity, respond within 30 days (extendable where the law allows for complex requests), and never charge for a reasonable request.

Children

The Site and our services are intended for business users aged 18 and over. We do not knowingly collect personal data from children under 18 (or the age of digital consent in your country). If you believe a child has provided us data, contact us and we will delete it promptly. Where we build products for clients that serve minors, verifiable parental consent and age-appropriate design are handled within that product's own privacy notice and our client's instructions.

Client project data

When we build, host or maintain systems for a client, we may have access to personal data of the client's customers, students, patients, viewers or staff. In that role we are a processor. We process such data only on the client's documented instructions and under a data-processing agreement that covers purpose limitation, confidentiality, security, sub-processors, assistance with rights requests and breach notification, audit rights, and return or deletion at the end of the engagement.

For regulated domains we build to the applicable standard, including HIPAA-aligned safeguards for protected health information, PCI DSS scoping for payment flows, and DPDP Act and GDPR requirements for consent, notice and rights handling. Individuals whose data is processed in a client system should direct requests to that client; we will assist the client in responding.

Third-party links and tools

The Site links to third-party websites, our open-source repositories on GitHub, social networks and our other product sites. Those services have their own privacy policies and we are not responsible for their practices. Social sharing and embedded content only send data to the provider when you interact with them.

Changes to this policy

We review this policy at least annually and whenever our practices or the law change. The effective date at the top shows the current version. For material changes we will give notice on the Site and, where we hold your contact details and the change affects you, by email. Continued use of the Site after the effective date means the updated policy applies.

Contact and grievance officer

Questions, requests and complaints about privacy can be sent through our contact page, marked for the attention of the Data Protection and Grievance Officer, or by post to Ascentspark Software Private Limited, PS Srijan Corporate Park, Sector V, Salt Lake, Kolkata 700091, West Bengal, India.

Under the DPDP Act our Grievance Officer will acknowledge your grievance and respond within the time the law prescribes. If you are in the EU or UK and prefer to contact a local representative, ask us and we will provide the current details.