Privacy notice

Who we are

AELSHA INNOVATIONS (OPC) PRIVATE LIMITED

"Aelsha Innovations" or "we" in this notice means this company. We run aelsha.com and, for the personal data described here, we decide why and how it is used. CIN: U62099TN2024OPC175379.

Registered office: No. 25, Second Street, Bakthavatchalapuram, Avadi, Chennai 600054, Tamil Nadu, India.

This notice covers aelsha.com and the messages and calls you send us. Personal data we handle for a client during an engagement is covered by our signed agreement with that client.

We have no office or other establishment in the European Union or the United Kingdom. If you are there, write to us directly at the addresses in this notice.

What we collect

Analytics, only if you accept. Google Analytics then records, under a random identifier, which pages you visit and for how long, how you arrived (for example from a search engine or a link), your approximate country and type of device, the links you follow, when you finish an article, which button you used to reach the contact page, and, when you send an enquiry from the contact page, only its topic and how you heard about us. It does not tell us who you are, and we never send it your name, email address or anything you type. If you reject, or make no choice, nothing from Google loads. Our cookie notice lists each item.

Your settings. Your colour theme and your cookie choice are kept in your own browser’s storage and are never sent to us.

Server logs. Like any website, aelsha.com is delivered by a hosting provider that keeps standard request logs, including IP addresses, for a limited period to operate and secure the service.

Enquiries. When you send the contact form, we receive and store what you entered: your name, email address, phone number if you gave one, company, topic, how you heard about us and your message. With it we store the date, your browser’s user-agent string and a keyed one-way hash of your IP address, used only to limit abuse; we never store the address itself. We email the enquiry to our business mailboxes and send you an automatic confirmation with a reference number. If this page cannot reach us and you send the email it prepares instead, or you email us directly, we receive what you wrote and what your mail app adds, such as your name and email address, and keep it in our business mailboxes.

Newsletter sign-ups. If you sign up for our Insights emails, we store your email address, whether you have confirmed it, the dates you signed up and confirmed, and which version of this notice the sign-up form showed. We store no IP address or hash of it and no browser details with a sign-up. We first send you an email with a confirmation link, and you are on the list only after you open it and press Confirm.

Phone calls. If you call us, we see your phone number. We use it, and anything you tell us, only to answer you, and we keep any notes of the call under the same rules as an enquiry.

support@aelsha.com

Why we use it, and our lawful basis

We use an enquiry you send us, by the contact form or by email, for one purpose: to read it, reply to it and, if you ask, to discuss work with you. We do not use it for anything unrelated, and we do not sell it or share it for advertising.

Under India's Digital Personal Data Protection Act, 2023, an enquiry you choose to send us is personal data you have voluntarily provided for that purpose (section 7(a)), and we use it only for that. Most of the Act's duties, and the 2025 Rules that set them out, apply from 13 May 2027, and we are preparing for them. Until then we follow the Information Technology Act, 2000 and its 2011 rules on reasonable security practices. Where the GDPR or UK GDPR applies, our basis for answering your email is our legitimate interest in replying to people who write to us, or steps you ask us to take before a contract; for hosting logs, our legitimate interest in keeping the site working and secure; for analytics, your consent.

If you sign up for our Insights emails, we use your email address only to send you new Insights guides and the emails that confirm or end your subscription. Our basis is your consent, given when you confirm from the email we send (DPDP Act, section 6; GDPR and UK GDPR, Article 6(1)(a)), and you withdraw it by unsubscribing.

We use analytics only to learn which pages help visitors and how they find us. We look at totals, such as visits to a page or from a country; we do not build profiles of individual visitors or use analytics to make decisions about anyone. We use it only with your consent, which you can withdraw at any time with Cookie settings at the bottom of every page.

You do not have to give us personal data: you can read the whole site without it, and without an email address we simply cannot reply. We make no decisions about you by automated means, including profiling.

Who receives it

Our hosting provider, our cloud provider and our email provider process data for us: the hosting provider delivers the pages; the cloud provider runs our form service and stores enquiries and newsletter sign-ups in India; the email provider sends the emails of the contact form and the newsletter and holds our business mailboxes. If you accept analytics cookies, Google processes analytics data as our analytics provider.

We are based in India, so an email you send us from abroad comes to us in India. Our providers may process data in other countries, including the United States. Where the GDPR or UK GDPR applies, those transfers rely on each provider’s data processing terms, which include the European Commission’s standard contractual clauses or, for US providers certified under it, the EU-U.S. Data Privacy Framework and its UK extension. Write to us for details.

We do not sell personal data or share it for advertising.

How we protect it

We protect personal data with security practices suited to what we hold. The pages are static files served over HTTPS only, with the protections described on our Security and data page. Enquiries from the contact form and newsletter sign-ups are stored in a database that only our form service can write to and only we can read. Access to our business mailboxes is limited to those who need it to answer you.

If a breach affected your personal data, we would inform you and the authorities as the law requires.

How long we keep it

We keep an enquiry sent through the contact form for 24 months from the day you send it, and then it is deleted automatically, normally within a day. Emails about your enquiry are kept only as long as we need them to answer you and to work with you, and longer only where Indian law requires us to keep business records. You can ask us to delete your data sooner, and we will, unless the law requires us to keep it.

If you sign up for our Insights emails but do not confirm, the sign-up is deleted automatically 7 days later, normally within a day after that. Once you confirm, we keep your email address until you unsubscribe. Unsubscribing deletes it from our list at once. Every newsletter email has an unsubscribe link, and you can also write to us.

Our database also keeps recovery copies for 7 days so that we can restore it after a fault; anything deleted, including an unsubscribed address, is gone from those copies 7 days after it is deleted.

Google Analytics keeps visit-level data for 14 months and then deletes it. After that, our reports show only totals, such as visits to a page, which identify no one. Google explains how it uses data from sites that use its services at policies.google.com/technologies/partner-sites.

Your rights

You can ask us to do any of the following with the personal data we hold about you:

• tell you what we hold and why
• correct data that is wrong or out of date
• erase your personal data, unless the law requires us to keep it
• where we rely on your consent (analytics cookies and the newsletter), withdraw it at any time, as easily as you gave it
• nominate another person to exercise these rights for you, as the DPDP Act allows
• for visitors in the EEA or the UK: object to our use of your data, restrict it, or receive a copy of it in a usable format, and complain to your data protection authority (in the UK, the Information Commissioner’s Office)

How to use your rights

Write to us, from the address your enquiry came from if you can, and say which right you want to use. We may ask you to confirm who you are before we act.

Grievances and requests about your personal data go to security@aelsha.com, which our Grievance Officer reads; for anything else, write to support@aelsha.com.

security@aelsha.com

Grievance Officer

Our Grievance Officer is Gladys Esmeralda, Director. If you have a question or a complaint about how we handle your personal data, write to the address below, call +91 91504 54111, or write to our registered office. We will tell you the outcome.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India once its complaint process under the DPDP Act applies, from 13 May 2027; the Act asks you to raise the complaint with us first. If you are in the EEA or the UK, you may complain to your data protection authority at any time; in the UK this is the Information Commissioner’s Office.

security@aelsha.com

Children

This site is for adults acting for themselves or their organisation. It is not directed at anyone under 18. If you are under 18, please choose Reject in the cookie choice, and do not send us personal data without a parent or guardian.

Changes to this notice

If how the site handles data changes, we will update this notice and its "Last updated" date before the change takes effect. Earlier versions are available on request.