Who we are
Authentcare Private Limited (CIN U74900DL2025PTC452069), registered office 307, Pragati Tower, Rajendra Place, New Delhi 110008, India, is the controller (the data fiduciary under Indian law) for the personal data described in this notice. The person to contact for any privacy question, request or grievance is Tanish Kamdar, Director, at contact@authentcare.com.
The short version
This website sets no cookies and reads nothing from your device when a page loads. Analytics are cookieless and aggregated. The only third-party service is Microsoft Bookings, which is a link that opens on Microsoft's own site only if you choose to follow it. We collect personal data when you send an enquiry, book a call, become a client or subscribe to updates, and we use it only for the purpose you gave it to us. We do not sell personal data and we do not send marketing without a separate opt-in.
What we collect and why
| Purpose | Data | Lawful basis (GDPR / UK GDPR) | Basis (India DPDP Act) |
|---|---|---|---|
| Website analytics | Page viewed, referring site, campaign parameters, event name (for example a button pressed) and whether the device is mobile or desktop, recorded to the minute by this site's own server. No IP address, browser string or identifier is stored, and nothing is set on your device. | Legitimate interests (Article 6(1)(f)): understanding which pages are useful. Assessment on file. | Not personal data as processed |
| Responding to an enquiry | Name, work email, company, device or IVD type, target markets, stage, your message, the page you sent it from, referrer and campaign parameters | Steps at your request before entering a contract (Article 6(1)(b)) | Consent given by providing the data voluntarily for the specified purpose (section 7(a)) |
| Scheduling a call | The details you enter in Microsoft Bookings: name, email, time, notes | Steps at your request before entering a contract (Article 6(1)(b)) | Section 7(a) |
| Delivering services to clients | Contact details, correspondence, documents you share, project and invoicing records | Performance of a contract (Article 6(1)(b)) | Section 7(a) and contract |
| Newsletter (when offered) | Email address, consent record | Consent (Article 6(1)(a)), double opt-in, withdrawable at any time | Consent (section 6) |
| Legal, tax and accounting records | Invoices, contracts, correspondence required by law | Legal obligation (Article 6(1)(c)) | Legitimate use for compliance with law |
Submitting the enquiry form sends the details you enter to this site's own server, which emails them to our mailbox and keeps a copy in private storage on the hosting account outside the web root. No third-party form service is involved. Your IP address is used only to limit repeated submissions, as a salted hash that changes daily, and is not stored. Submitting the form is not consent to marketing, and we do not treat it as consent to anything beyond handling the enquiry.
Cookies and device storage
No cookie, localStorage, sessionStorage or IndexedDB entry is set or read when a page of this site loads. Fonts are served from this site. Search runs in your browser from an index served by this site and stores nothing. Analytics use a script served by this site that reads no device storage and posts cookieless, identifier-free events to this site's own server, which records counts only.
Microsoft Bookings lets you choose a call time. It is not embedded in this site: the Contact page has a link, labelled with Microsoft's name, that opens Microsoft's own booking page in a new tab, beside a link to Microsoft's privacy statement. This site sets no cookie and loads nothing from Microsoft; what Microsoft's page stores is governed by Microsoft's own policies. Declining is simply not following the link; you can email to arrange a time instead. The cookie policy lists every component.
Who processes your data
| Processor | Role | Location of processing | Safeguard |
|---|---|---|---|
| Microsoft (Microsoft 365, SharePoint, Bookings) | Email, document storage, scheduling | Tenant region as configured by Authentcare; Microsoft global infrastructure | Microsoft Products and Services Data Protection Addendum, including the EU Standard Contractual Clauses and the UK Addendum |
| Hostinger | Website hosting, including the server that receives enquiry form submissions and the analytics counts | Data-centre region as configured by Authentcare | Hostinger terms and data processing agreement |
| Buttondown (when the newsletter is offered) | Newsletter delivery | United States | Buttondown data processing agreement |
We share personal data with authorities only where the law requires it. We never sell it.
International transfers
Authentcare is in India. Data you give us directly is processed in India by us and by the processors above in the locations stated. Transfers from the EU or UK to our processors outside the EEA and UK rely on the Standard Contractual Clauses and the UK Addendum incorporated in those processors' terms, and we review the processing locations and the transfer safeguards annually.
EU and UK representatives
We have assessed whether Article 27 of the GDPR and of the UK GDPR requires us to appoint a representative in the EU or the UK. Our processing of personal data of people in the EU and UK is occasional, limited to business-contact data of client companies and enquirers, and does not include special categories of data or large-scale processing; on that basis we rely on the exemption in Article 27(2)(a). We re-run this assessment annually and whenever an engagement involves more than business-contact data.
Client documents
Documents clients share with us are held in a folder created for that client on our Microsoft 365 tenant. Access requires multi-factor authentication; sharing is to named people only, verified by a one-time passcode to their email address; "anyone" links are disabled across the tenant; upload links expire after 30 days and are revoked at project close; client folders carry a confidentiality label; data is encrypted at rest and in transit. Client documents are used only for the engagement they were shared for. Where drafting tools are used, they run on hardware under our control; client documents are never sent to third-party AI services and never used to train any model. Suspected unauthorised access is assessed within 24 hours and affected clients are told within 72 hours. A mutual non-disclosure agreement is available before anything is shared.
How long we keep data
| Record | Retention |
|---|---|
| Enquiry and prospect records where no engagement follows | 24 months from last contact, then deleted |
| Engagement correspondence and final issued deliverables | 8 years after project close, for professional-liability defence and alignment with the Companies Act 2013 section 128; not deleted on request within this period, and the engagement agreement says so |
| Working files and client source documents | 3 years after project close, or returned and deleted at close on request |
| Financial and tax records | 8 financial years (Companies Act 2013 section 128); GST records for 72 months from the annual return once registered |
| Consent and suppression records | Life of the consent plus 3 years; suppression entries kept indefinitely |
| Backups | Hostinger 30-day cycle; Microsoft 365 per tenant retention policy, with deleted items purged within 93 days |
A deletion request is actioned within 30 days for records not subject to a statutory or contractual retention period or a legal hold; where a record must be kept, we tell you what is retained, why and until when. Deleted data persists in backups until the cycle above expires.
Your rights
Under the GDPR and UK GDPR you can ask for access to your personal data, rectification, erasure, restriction, portability, and you can object to processing based on legitimate interests; where processing is based on consent you can withdraw it at any time without affecting earlier processing. Under India's DPDP Act 2023 you can ask for access, correction and erasure, nominate another person to exercise your rights, and raise a grievance. Write to contact@authentcare.com; we respond within one month (GDPR) and within the period the DPDP Rules prescribe. You can also complain to your supervisory authority in the EU, to the Information Commissioner's Office in the UK, or to the Data Protection Board of India.
Indian law timeline
The Digital Personal Data Protection Rules 2025 were notified on 13 November 2025. The provisions establishing the Data Protection Board took effect on publication; the consent-manager provisions apply from 13 November 2026; the notice, consent, security-safeguard, breach-reporting and retention obligations apply from 13 May 2027. This notice is written to that 2027 standard from the outset.
Changes to this notice
We change this notice when what the website or the practice does changes, and we record the version and the effective date at the top. Material changes are noted in the changelog below.
- 2026-11-08 — Version 1.0, first publication.