Comprehensive Data Protection, Privacy Rights & Information Security Protocol
We do not sell, rent, license, or trade your personal information or contact details to third-party data brokers or marketing aggregators.
All network transmissions utilize TLS 1.3 encryption. At-rest form submissions and backups are protected via AES-256 encryption.
You maintain absolute rights to inspect, download, correct, or request the permanent deletion of your data at any time with a 48h turnaround.
All web typography is 100% self-hosted locally. We deploy zero cross-site advertising beacons or unconsented recording scripts.
This Privacy Policy governs the processing of personal data collected through the Simplicity platform, website (simplicity.co.in), and client engagement channels. Simplicity operates as the primary Data Controller for personal data submitted through this platform.
Studio Address: Simplicity Studio, 100 Feet Rd, Indiranagar, Bengaluru, KA 560038, India. Direct Privacy & Compliance Contact: simplictyhq@gmail.com.
We only collect and process personal data where we have a lawful, recognized legal basis under the European Union General Data Protection Regulation (GDPR Art. 6), UK GDPR, the California Consumer Privacy Act as amended by the CPRA, and the Indian Digital Personal Data Protection Act (DPDP Act 2023):
• Consent (Art. 6(1)(a)): Where you have provided unambiguous affirmative consent, such as opting into communication channels. • Contractual Necessity (Art. 6(1)(b)): To evaluate project feasibility, prepare statements of work, and execute client contracts. • Legitimate Interests (Art. 6(1)(f)): To ensure platform security, prevent fraudulent form submissions, and maintain technical infrastructure integrity. • Legal Compliance (Art. 6(1)(c)): Where necessary to comply with statutory accounting, anti-fraud, or legal obligations.
When you initiate contact or submit project specifications through our interactive forms, we collect: • Contact Identifiers: Full name, business email address, company name, telephone number (if provided), and project website URL. • Project Scope Data: Project classification, technical architecture requirements, target delivery timeline, and project briefs. • Age & Legal Capacity Verification: Affirmative certification that you are at least 18 years of age (or the legal age of majority in your jurisdiction). • Communication Records: Timestamped transcripts of inquiries, technical exchanges, and follow-up correspondence.
When navigating our digital workstation, our edge servers automatically capture minimal technical telemetry necessary for routing, performance optimization, and network defense: IP address (anonymized at edge), request timestamps, browser software type, operating system platform, language preferences, and referral HTTP headers.
We collect and process your personal information strictly for specified, explicit, and legitimate engineering purposes:
1. Reviewing technical project specifications and scheduling engineering discovery calls. 2. Formulating architecture roadmaps, technical sprint proposals, and statement of work documentation. 3. Delivering agreed digital products, web applications, and continuous engineering retainers. 4. Administering accounting, billing invoicing, and tax compliance records. 5. Defending our platform against denial-of-service vectors, spam bots, and malicious automated probing.
We do NOT engage in automated profiling, automated credit scoring, or behavioral algorithmic decision-making.
We maintain strict technical and organizational safeguards designed to protect personal data from unauthorized access, accidental alteration, disclosure, or destruction:
• Encryption in Transit: Enforced HTTPS with HTTP Strict Transport Security (HSTS) and modern TLS 1.3 protocols across all endpoints. • Encryption at Rest: Inquiries, project files, and repository archives are stored with industry-standard AES-256 cryptographic encryption. • Role-Based Access Controls (RBAC): Production inquiries and project data are restricted exclusively to senior engineers and legal administrators with two-factor authentication (2FA) hardware tokens. • Vulnerability Management: Regular automated code audits, dependency link verifications, and cryptographic token hygiene.
We retain personal data strictly for as long as necessary to fulfill the purposes for which it was collected:
• Prospective Project Inquiries: Retained for up to 12 months following initial submission to accommodate extended procurement cycles, after which they are irreversibly purged unless a client contract is executed. • Active Client Project Records: Retained throughout the duration of the engagement plus 5 years for statutory tax, IP warranty, and accounting obligations. • Ephemeral Server Telemetry: Raw edge access logs are truncated and deleted automatically within 30 days. • Right to Immediate Deletion: You may request the immediate, permanent purge of your prospective inquiry data at any time by emailing simplictyhq@gmail.com.
We only engage verified enterprise sub-processors who adhere to strict data protection standards and ISO/SOC2 security frameworks:
• Hosting & Edge Network: Vercel Inc. (San Francisco, CA, USA) — Global edge hosting and deployment infrastructure governed by Data Processing Agreements (DPA). • Repository & Version Control: GitHub Inc. (San Francisco, CA, USA) — Enterprise source code version control and CI/CD pipelines. • Communication Infrastructure: Google Workspace / Gmail (Mountain View, CA, USA) — Encrypted transactional correspondence and engineering calendar synchronization.
As a modern digital engineering studio, data may be processed on secure infrastructure located in the European Union, India, or the United States. Where personal data originates in the European Economic Area (EEA), United Kingdom, or Switzerland and is transferred internationally, we ensure adequate protections through European Commission Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendums.
Depending on your residency, you possess comprehensive statutory rights regarding your personal information:
• Right of Access (Art. 15): Request confirmation and a copy of all personal data held about you in a structured, commonly used format. • Right to Rectification (Art. 16): Request the immediate correction of inaccurate or incomplete personal data. • Right to Erasure / Right to be Forgotten (Art. 17): Request permanent deletion of your personal data where retention is no longer justified. • Right to Restrict Processing (Art. 18): Restrict processing during ongoing disputes or verification procedures. • Right to Data Portability (Art. 20): Obtain your data in machine-readable JSON format for transfer to another provider. • Right to Object (Art. 21): Object to processing based on legitimate interests or direct commercial communications. • Non-Discrimination: We will never deny service, charge different prices, or alter quality of service if you exercise your privacy rights.
To exercise any right, submit a verified request to simplictyhq@gmail.com. We respond within 48 business hours and fulfill all statutory requests within 30 calendar days at zero cost to you.
Our digital workstation enforces a minimal, privacy-first storage architecture:
• Essential Consent Cookie: A single local preference token is saved to remember your cookie consent decision so you are not prompted repeatedly. • Zero Advertising Trackers: We deploy NO advertising cookies, NO Facebook/Meta pixels, NO Google Analytics tracking, and NO cross-site surveillance beacons. • Local Storage: Transient UI state (such as 3D canvas interaction states and navigation drawer preferences) is handled locally within browser memory and is never transmitted to any third party.
Our services, digital products, and platform are strictly intended for enterprise professionals and individuals who are at least 18 years of age. We do not knowingly collect, maintain, or process personal data from children under 13 (in compliance with the US Children’s Online Privacy Protection Act - COPPA) or minors under 16/18 under European regulations. If you believe a minor has submitted personal information through our contact form, contact us immediately at simplictyhq@gmail.com and we will expunge the record within 24 hours.
In strict adherence to European data protection case law regarding third-party font servers, all typography (including Cormorant Garamond and Inter) is 100% self-hosted locally from our own origin servers. No visitor IP addresses, browser headers, or device fingerprinting telemetry are ever transmitted to Google Fonts or foreign font CDNs.
We do not run unconsented session replay recording or keystroke interception tools. Where diagnostic telemetry is deployed with explicit affirmative consent, client-side cryptographic masking is enforced across all form inputs, preventing sensitive text, passwords, or personal details from ever being recorded or transmitted, complying with the California Invasion of Privacy Act (CIPA) and federal wiretapping statutes.
Every email notification or operational message originating from Simplicity includes our full registered studio postal address (Simplicity Studio, 100 Feet Rd, Indiranagar, Bengaluru, KA 560038, India) and a functional one-click unsubscribe mechanism. You may opt out of promotional communications at any time via /unsubscribe or by contacting simplictyhq@gmail.com.
For inquiries, data requests, or compliance questions regarding this policy, contact our Data Protection Officer:
Email: simplictyhq@gmail.com Attn: Data Protection Officer — Simplicity Studio Postal Address: Simplicity Studio, 100 Feet Rd, Indiranagar, Bengaluru, KA 560038, India.
EEA & UK residents also have the statutory right to lodge a formal complaint with their national supervisory authority (e.g., the Information Commissioner’s Office in the UK, the CNIL in France, or the BfDI in Germany).
