Privacy policy.

1. Information we collect

We collect personal information you provide directly — name, work email, company, phone, and the content of any brief you send us through the contact or careers form. We also collect limited technical information automatically — IP address, browser type, device class, referring page, and pages viewed — used in aggregate to understand how the site is used.

2. How we use information

• To respond to inquiries, route briefs to the relevant practice lead, and follow up on consultations.
• To process job applications and communicate with candidates.
• To improve the website, measure content effectiveness, and (with your consent) operate analytics.
• To send the monthly Insights newsletter, if you have opted in.
• To comply with legal, regulatory, and contractual obligations.

3. Cookies and analytics

We use a small set of cookies. Strictly necessary cookies are always active. Analytics cookies (Google Analytics 4, Microsoft Clarity) and marketing cookies (LinkedIn Insight Tag) load only when you explicitly consent through our cookie banner. You can change your preferences at any time via the “Cookie preferences” link in the footer. See our cookie policy for the full list.

4. Lawful basis (GDPR / UK DPA)

For visitors in the UK and EU, we process personal data under the following bases: (a) legitimate interest in responding to business inquiries, (b) consent for analytics and marketing cookies and newsletter subscriptions, (c) contractual necessity for engaged clients, and (d) compliance with legal obligations.

5. India DPDP Act compliance

For visitors in India, we comply with the Digital Personal Data Protection Act 2023. Personal data is processed for specified, lawful purposes; you have rights of access, correction, and erasure; and grievances can be raised with our Data Protection Officer at the contact below.

6. Data sharing

We do not sell personal information. We share information with service providers operating under written agreements (email, CRM, analytics, hosting). We may disclose information where required by law, in response to lawful requests, or to protect our rights.

7. International transfers

Vatsa operates across India, the US, and the UK. Personal information may be processed in jurisdictions other than the one where you reside. Where required, we use Standard Contractual Clauses or equivalent safeguards for transfers from the UK/EU.

8. Data retention

We retain personal information only for as long as needed to fulfill the purposes described above and to comply with our legal obligations. Inquiry data is typically retained for 24 months unless a client relationship is established; candidate data is retained per applicable employment law.

9. Your rights

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate information.
• Erasure — ask us to delete information we no longer have a lawful basis to keep.
• Objection — object to processing based on legitimate interest.
• Portability — receive your information in a portable format.
• Withdraw consent — at any time, for processing based on consent.

To exercise any of these rights, email privacy@vsplc.com.

10. Security

We apply industry-standard administrative, physical, and technical safeguards to personal information — encryption in transit and at rest where applicable, access controls, audit logging, and security review of the engineering practices we use ourselves with clients.

11. Children

The site is not directed to children under 18. We do not knowingly collect personal information from children.

12. Changes

We may update this policy from time to time. Material changes will be announced on this page with a revised effective date. The current effective date is 1 May 2026.

13. Contact

For privacy questions or to exercise your rights, contact our Data Protection Officer:

• Email — privacy@vsplc.com
• Postal — Data Protection Officer, Vatsa Solutions Pvt. Ltd., C-508 Teerth Technospace, Mumbai-Bangalore Highway, Baner, Pune — 411045, India

UK/EU residents have the right to lodge a complaint with the relevant supervisory authority. Indian residents have the right to raise a grievance with the Data Protection Board of India under the DPDP Act.