Effective 16 August 2026. This is a standalone privacy notice. It is not buried in our Terms of Use.
1. Who we are
Northbeam Consultancy (“Northbeam”, “we”, “us”) is an applied AI consultancy. For this website we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”).
If you write to us, you are the Data Principal for the personal data you send.
This site is a brochure and an enquiry form. It is not an account product, a marketplace, or a consumer app. A signed statement of work or engagement letter, if we work together, will name the contracting party and may add engagement-specific data terms. Those terms control the engagement. This notice controls the website.
2. What this notice covers
This notice applies to digital personal data we process when you:
- visit this website;
- send the contact form (name, email, company, message);
- apply for a published role through that same form;
- email or otherwise write to us about the same enquiry.
It does not cover:
- personal data we process as a Data Processor inside a client system under a separate contract — that work follows the client’s instructions and agreement;
- public pages or tools we do not control;
- information that is not personal data (for example, anonymous aggregate counts).
This notice is written in English, which is the language of this site. If you cannot understand it, write to us through the contact form and we will explain the relevant part in plainer language.
3. Personal data we collect
We collect only what the form and the conversation need. We do not collect government IDs, payment cards, biometrics, health data, or precise location on this website.
You send us
| Data | Required? | How we get it |
|---|---|---|
| Name | Yes, to address you | Contact form |
| Email address | Yes, to reply | Contact form |
| Company or organisation | Optional | Contact form |
| Message and any facts you include in it | Yes, so we know why you wrote | Contact form |
Do not put secrets, credentials, health information, or other people’s personal data in the message unless they have asked you to send it.
The server sees when you submit
When the form is posted, our application server receives the request. That typically includes the time of submission and ordinary technical metadata of an HTTP request (for example, IP address and user-agent as seen by the host). We use this only to run the form, keep the service stable, and look into abuse or faults. We do not use it to build a marketing profile.
We do not collect on this site
- account passwords or login data — there is no account;
- payment or card data — there is no checkout;
- advertising identifiers, pixel events, or analytics user IDs;
- fonts or scripts from Google, Meta, or other ad networks;
- data scraped from third parties about you.
4. Why we process it
Each use is a separate purpose. We do not bundle “marketing and analytics” into the same ask.
| Purpose | Data used | What it enables |
|---|---|---|
| Reply to your enquiry | Name, email, company, message | A written reply, and if useful a working conversation, within about two business days |
| Evaluate a role application | Name, email, message, and any follow-up you send | Decide whether to start a hiring conversation, or write a no |
| Decide whether we can take the work | What you wrote, and any follow-up you send | A yes, a scoped next step, or a no |
| Keep a record of the conversation | The enquiry and our reply | Continuity if you write again; a trail if there is a dispute |
| Run and protect the website | Technical request metadata | Uptime, debugging, and blocking abuse |
| Meet a legal demand | Only what the demand requires | Compliance with a court, government, or Data Protection Board order |
We do not send marketing newsletters from this form. We do not sell personal data. We do not use your enquiry to train a public model.
5. On what basis we process it
Under the DPDP Act we process personal data only with consent, or for a “legitimate use” listed in Section 7.
- Voluntary provision (Section 7(a)). You choose to send the form for a specified purpose: that we read it and reply. We use the data only for that purpose unless you later agree to more.
- Consent (Section 6). Where we need consent, it must be free, specific, informed, unconditional, and unambiguous. We will not pre-tick a box or hide a new purpose inside this notice.
- Legal obligation or process (Section 7). We may keep or disclose data if Indian law, a court, or a competent authority requires it.
There is no “legitimate interests” basis of the kind used in the GDPR. We do not rely on one.
6. How long we keep it
We keep personal data only as long as the purpose needs, then delete or irreversibly anonymise it, unless a longer hold is required by law.
| Record | How long | Why |
|---|---|---|
| Contact-form enquiry or application, and our reply | Up to 24 months after the last message in that thread, on the application server (and in our notification inbox if one is configured) | So we can resume a conversation and show what was said |
| Enquiry that becomes an engagement | As the statement of work and applicable law require | Contract, tax, and professional records |
| Technical server logs | Up to 90 days, unless needed for an incident | Operations and security |
| Data you ask us to erase | Deleted without undue delay, subject to the exceptions below | Your right to erasure |
We may keep a record longer if we must: for example a tax or accounting duty, an ongoing dispute, or a lawful request. We will tell you if we refuse an erasure request for one of those reasons.
8. Transfers outside India
The DPDP Act allows processing outside India unless the Central Government notifies a restricted country. We do not send your enquiry to a restricted country.
If our host or a processor stores or accesses data outside India, we will still apply this notice and the safeguards we owe you under Indian law. We will name that fact here when it applies.
10. Security
We take reasonable security safeguards appropriate to a small consultancy website: submissions are stored on the application server, rate-limited, and visible only to people who need to reply. There is no public inbox endpoint.
No internet transmission is perfectly safe. Do not send passwords, private keys, or regulated secrets through the public form.
If a personal data breach is likely to affect you, we will follow the DPDP Act and DPDP Rules — including notifying the Data Protection Board of India and affected Data Principals in the manner and time those rules require.
11. Children
Under the DPDP Act a child is anyone who has not completed eighteen years. This site is for adult operators and organisations. It is not directed at children.
Do not send us a child’s personal data. We do not knowingly process it. If you believe we have, write to us and we will delete it. We do not track, target, or advertise to children.
12. Your rights
As a Data Principal you have the rights below under the DPDP Act. They are free to exercise. We will not refuse the website or a conversation because you used them, except where we cannot provide the thing you asked for without the data.
| Right | What it means here |
|---|---|
| Access (Section 11) | A summary of the personal data we hold about you, the processing activities, and the identities of any other Data Fiduciaries or Data Processors with whom it has been shared |
| Correction and completion (Section 12) | We correct or complete inaccurate or incomplete data you point out |
| Erasure (Section 12) | We erase data that is no longer needed for the stated purpose, unless the law requires us to keep it |
| Grievance redressal (Section 13) | You can complain to us first. See the grievance section below |
| Nominate (Section 14) | You may nominate another person to exercise these rights on your behalf in the event of your death or incapacity. Write to us with the nominee’s name and how we should reach them |
| Withdraw consent (Section 6) | Where we rely on consent, you may withdraw it as easily as you gave it. Withdrawal does not undo processing already done lawfully |
To use a right, send the contact form and name the right in the message (for example, “erasure request”). Tell us the email you used so we can find the record. We may ask only what we need to confirm it is you.
We will respond within the time the DPDP Rules allow. As a working standard we aim to complete an access, correction, or erasure request within 30 days, and a grievance within 90 days of receiving it.
13. Withdrawing consent
You gave the enquiry by sending the form. To withdraw that, write through the same contact form and say you withdraw consent or want the enquiry deleted. That is the same channel you used to send it.
After withdrawal we stop using the data for that purpose, except where a legitimate use or a legal duty still applies (for example, we may keep a short note that you asked us not to contact you).
14. Grievance redressal
You have a right to readily available grievance redressal for any act or omission of ours in relation to your personal data or these rights.
Grievance Officer. Grievance Officer, Northbeam Consultancy.
How to reach them. Use the contact form and start the message with “Privacy grievance”. Include what happened, the email you used, and what you want us to do.
What we will do. We will acknowledge the grievance and close it within 90 days of receipt, as required under the DPDP Rules. If we need more from you to investigate, the clock still runs on us — we will say what is missing.
15. Data Protection Board of India
If you are not satisfied after using our grievance process, you may complain to the Data Protection Board of India, the authority established under the DPDP Act.
File through the Board’s official complaint process as published by the Board from time to time. You should generally come to us first so we have a chance to fix the issue.
16. Changes to this notice
We will change this notice when our practices change — for example a new processor, a new purpose, or a change in law. The date at the top is the date this version took effect.
A material change will be posted here. If we already hold your email from an enquiry and the change affects that processing, we will also tell you at that email where we still have it.
17. Contact
Questions about this notice, a rights request, or a grievance: use the contact form. We reply within two business days on ordinary messages, and we handle privacy requests on the timelines above.
Using this website is also subject to our Terms of Use.