Privacy and Data Protection Policy

1. Purpose, scope and compliance

1.1. This Privacy and Data Protection Policy (“Policy”) sets out how ImpactPlus Ventures LLP, trading as ESSENSE® (“ESSENSE”, “we”, “us” or “the Company”), collects, uses, stores and protects personal data. It applies to the website www.essense.co.in and to the software, apps, WhatsApp, digital, ERP and AI solutions we deliver under the ESSENSE name (together, “the Services”).

1.2. The Policy is designed to comply with applicable Indian law, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000 with its rules, and with generally accepted privacy principles. Everyone at ESSENSE, and every third party handling personal data on our behalf, must follow it.

2. Relationship with other agreements

2.1. Where we have a signed quotation, Master Service Agreement (“MSA”) or similar contract with a client, the data protection terms of that contract govern if they conflict with this Policy. In particular, when we build or run a solution that processes our client’s customer or employee data, the client is usually the data fiduciary and we act as its data processor, under that contract. This Policy otherwise applies to all our processing.

3. Data protection principles

3.1. We process personal data lawfully, fairly and transparently; collect it only for specific, explicit and legitimate purposes; collect only what is adequate and relevant (data minimisation); keep it accurate; keep it no longer than necessary (storage limitation); protect it with appropriate safeguards; and, as data fiduciary, remain accountable for the processing under our control.

4. Personal data we collect

4.1. On this website. The website has no sign-in. It sets analytics cookies only if you click Accept (section 7). Its enquiry form does not send anything to us by itself: when you press Send, it opens your own email app (or Gmail, or WhatsApp if you choose) with your message filled in, and nothing reaches us until you send it from there.

4.2. When you contact us. If you email, call or message us, we receive what you choose to share: usually your name, company, email address, phone number and your message about your business.

4.3. Website delivery. The website is served by Amazon Web Services (AWS). Like every web server, AWS processes technical request data, such as your device’s IP address, the page requested, the time and your browser type, in order to deliver the pages and protect the service. We do not keep our own visit logs for this website and do not use this data to identify you.

4.3A. Analytics, only with your consent. If you click Accept, Google Analytics records how the site is used: pages viewed, approximate location (city or region), device and browser type, how you arrived, and actions such as sending the enquiry form or tapping WhatsApp, phone or email. It does not tell us who you are.

4.4. Client projects. When we deliver Services, we process the business and personal data that a client gives us or that the solution handles, only as the client’s contract sets out.

4.5. We do not ask for sensitive personal data (such as financial or health information) through this website. In client projects it is processed only when necessary, with appropriate safeguards and consents.

5. How we use personal data

5.1. We use personal data only for the purposes communicated when it was collected, or closely related purposes you would reasonably expect: replying to your enquiry and discussing the work you asked about; preparing quotations; delivering, supporting and improving the Services under contract; meeting legal obligations; and protecting our legal rights or the safety of others. We do not sell or rent personal data, and we do not use enquiry details for unrelated marketing.

6. Lawful bases for processing and consent

6.1. Our processing rests on a lawful basis: usually your consent, given by a clear action such as sending us a message, or the performance of a contract or service you requested, a legal obligation, or another legitimate use recognised by the DPDP Act. You may withdraw consent at any time; withdrawal does not affect processing that happened before it.

7. Cookies and tracking technologies

7.1. Nothing loads before you choose. When you first visit, the site asks whether you accept analytics. Until you click Accept, no analytics script runs and no analytics cookie is set. If you click Decline, none ever runs.

7.2. What we use if you accept. Google Analytics 4, to understand how visitors use the site so we can improve it. It sets first-party cookies named _ga and _ga_*. We use no advertising cookies, no advertising pixels and no session recording, and we do not sell this data. Analytics data is kept for the retention period set in our Google Analytics account, at most 14 months.

7.3. Browser local storage. The site stores your Accept or Decline choice in your browser’s local storage, so it does not ask again on every page. It stays on your device.

7.4. Change your choice at any time. Change cookie choice. You can also clear this site’s data in your browser.

7.5. The site loads no other third-party scripts and no third-party fonts. If we add another tool, we will update this section first and ask for your consent before it runs.

8. Disclosure to third parties

8.1. We disclose personal data only as this Policy and the law allow: (a) to service providers who process it on our behalf under confidentiality and data protection terms; (b) to partners where needed to deliver Services you asked for; (c) where you have consented or asked us to; (d) where required by law or by order of a competent authority, sharing only what is legally necessary; and (e) in a merger, acquisition or similar transaction, where the recipient must keep the same standards. We never sell personal data.

9. Processors and sub-processors

9.1. Before engaging a provider to process personal data for us, we check it can meet the standards of the law and this Policy, and bind it to process data only on our instructions, keep it secure and confidential, not pass it on without authorisation, and help us meet our obligations. We remain responsible for data our providers process.

9.2. This website is hosted on Amazon Web Services. If you accept analytics, Google processes analytics data for us as described in section 7. The providers used in a client project are listed in that project’s contract or available on written request.

10. Cross-border data transfers

10.1. The website’s files are stored in AWS’s Mumbai region and delivered through AWS’s global network, so a page may be served to you from a location outside India. If you accept analytics, Google may process analytics data outside India. Where personal data is transferred outside India, we do so only as permitted by the DPDP Act and any government notification, with safeguards that keep a standard of protection comparable to Indian law.

11. Data security

11.1. We use appropriate technical and organisational measures to protect personal data, including encryption in transit (this website is served only over HTTPS with HTTP Strict Transport Security), private storage that only our delivery network can read, security headers, access limited to people who need it, secure development practices and periodic review of these measures. We require similar commitments from providers who process personal data for us.

12. Data retention and deletion

12.1. We keep personal data only as long as needed for the purpose it was collected for, or as the law requires. Enquiry messages are kept while we discuss your request and during any resulting business relationship, then deleted or anonymised unless the law requires us to keep them. Client project data is retained and deleted as the client’s contract sets out. You may ask us to delete your data at any time (section 13).

13. Your rights and choices

13.1. Under the DPDP Act and this Policy you may:

• Access a summary of the personal data we hold about you and how we use it.
• Correct inaccurate or incomplete data, or erase data that is no longer needed.
• Withdraw consent at any time.
• Nominate another person to exercise your rights in the event of your death or incapacity.
• Object to direct marketing, or ask us to restrict processing while a request is reviewed.
• Seek grievance redressal from us and, if not satisfied, from the Data Protection Board of India.

13.2. We do not charge for these requests, may need to verify your identity, and reply within 30 days or any shorter period the law sets. Contact us as shown in section 19.

14. AI, automated decision-making and profiling

14.1. This website does not use AI on its visitors. Many of the solutions we build for clients do use AI, and in that work we follow these safeguards:

• Transparency. People are told when they are interacting with an AI system rather than a person.
• A person decides what matters. AI outputs are assistive; where an output affects a customer or an important business decision, a person reviews it.
• Limits of AI. AI can produce incorrect, incomplete or biased results, so we build checks, set clear limits on what AI can see and do, and give people a way to report problems.
• No training on client data without permission. Personal data is not used to train our or anyone else’s AI models without the client’s agreement and, where required, the individual’s consent.
• No significant automated decisions without safeguards. We do not build solutions that make decisions with legal or similarly significant effects solely by automated means unless the law allows it and suitable safeguards, including human review on request, are in place.

15. Data breach notification

15.1. If a personal data breach occurs, we will contain and investigate it, notify affected individuals and the Data Protection Board of India (and CERT-In where required) in the manner and time the law prescribes, explain what happened and what you can do, and take steps to prevent it happening again. Where we act as a processor, we will inform the client without undue delay so it can meet its own obligations.

16. Third-party services and links

16.1. This website links to services run by others, such as WhatsApp, Gmail, Google Maps, LinkedIn and the ImpactPlus website. If you use them, their own privacy policies and terms apply, not this Policy.

17. Children, anonymised data and continuity

17.1. This website and our Services are intended for businesses and are not directed at children under 18. We do not knowingly collect children’s personal data through this website; if we learn we have, we will delete it.

17.2. Where we use data in anonymised or aggregated form, for example to measure how a solution performs, we remove identifying elements and apply safeguards against re-identification.

17.3. In a change of control, merger or discontinuation of a Service, we will give clients reasonable notice to retrieve their data before secure deletion, unless the law or their contract requires otherwise. We disclose data to government or law enforcement only on valid legal process and, where permitted, tell the person concerned first.

18. Governance and accountability

18.1. A designated Grievance Officer oversees compliance with this Policy and is the point of contact for individuals and regulators. People who handle personal data at ESSENSE are bound by confidentiality, access is given by role and need, and we review our data practices periodically and whenever we start new processing that carries higher risk, such as a new AI deployment.

19. Grievance redressal and contact

19.1. If you have a question, a complaint, or want to exercise your rights, contact our Grievance Officer:

Grievance Officer: Mihir Joshi
Email: growth@impactplus.co.in
Phone: +91-8401192901
Address: D 1009, Titanium City Centre, 100 Feet Ring Road, Jodhpur Char Rasta, Satellite, Ahmedabad 380015, Gujarat, India

19.2. We will acknowledge your message and aim to resolve it within 30 days or any period the law sets. If you are not satisfied, you may escalate it to the Data Protection Board of India.

20. Policy updates

20.1. We may update this Policy to reflect changes in our practices or the law. The effective date at the top shows the current version. If a change materially affects how we use personal data, we will give prominent notice on this website and seek fresh consent where the law requires.

ImpactPlus Ventures LLP. Registered office: D 1009, Titanium City Centre, 100 Feet Ring Road, Jodhpur Char Rasta, Satellite, Ahmedabad 380015, Gujarat, India. LLPIN: ACN-7020. GSTIN: 24AALFI3854M1ZY.