01 Statutory Framework & Scope
This Privacy Policy governs the processing of Digital Personal Data by Anjan Pandit ("we", "us", or "our") through the website accessible at https://anjanpandit.in. It has been formulated in strict compliance with the statutory provisions of the Digital Personal Data Protection Act, 2023 (hereinafter referred to as the "DPDP Act"), the Information Technology Act, 2000, and rules notified thereunder.
This policy applies to:
- Digital personal data collected directly from you through our organizational inquiry forms, consultation requests, and email communications.
- Digital personal data collected automatically as technical telemetry and essential session identifiers when browsing this platform.
02 Identity of the Data Fiduciary
Under Section 2(i) of the DPDP Act, the Data Fiduciary responsible for determining the purpose and means of processing your personal data is:
🛡️ Statutory Grievance Desk: Submit Statutory Request / Grievance →
🔒 Direct Coordinates: Disclosed securely upon verified request to prevent automated harvesting.
03 Categories of Personal Data Collected
We only collect personal data that is strictly necessary, adequate, and relevant for professional communication and secure platform operation:
| Data Category | Specific Data Points | Collection Method |
|---|---|---|
| Professional Inquiry Data | Full Name, Official Work Email Address, Contact Phone/WhatsApp Number, Organization Name, Designation, Project Timeline, Engagement Nature, and Inquiry Message. | Voluntarily provided by Data Principal via Contact Form. |
| Identity & Spam Verification Data | 6-digit numeric Email OTP (One-Time Passcode), cryptographic mathematical CAPTCHA solutions, and CSRF authentication tokens. | Generated by server and verified via Email / HTTP headers. |
| Technical Telemetry & Security Data | One-way SHA-256 hashed IP address, user-agent string (Browser & Operating System), device category, screen resolution, referral path, and visit timestamp. | Collected automatically via server headers with pseudonymization. |
| Essential Session Cookies | PHP Session Cookie (PHPSESSID) for authentication/anti-CSRF state; Consent preference cookie (anjan_cookie_consent). |
Stored locally on Data Principal's device browser. |
04 Lawful Basis for Processing (Consent)
In accordance with Section 6 of the DPDP Act, we process your personal data strictly on the lawful ground of free, specific, informed, unconditional, and unambiguous Consent signified by an affirmative action:
- Inquiry Submission Consent: By checking the consent checkbox and clicking "Submit Organizational Inquiry", you affirmatively signify consent for Anjan Pandit to process your name, work email, and requirements for replying to your inquiry.
- Withdrawal of Consent: Under Section 6(4) of the DPDP Act, you possess the statutory right to withdraw your consent at any time with the same ease with which it was provided. Upon receipt of consent withdrawal, we will cease processing and purge your submitted inquiry data within 30 business days.
05 Specified Purposes of Processing
Under Section 4(1) of the DPDP Act, personal data is processed solely for specified, lawful purposes:
- Professional Engagement & Consultation: Reviewing client inquiries, providing tailored project feasibility evaluations, sharing relevant case studies, and scheduling discussions.
- Spam Prevention & Cyber Defense: Validating official work email ownership via 6-digit OTPs and verifying human submissions via CAPTCHA to defend web infrastructure against malicious bots.
- Platform Security & Audit Logs: Enforcing session fixation defense, monitoring unauthorized CMS intrusion attempts, and preventing brute force attacks.
- Anonymized Public Reach Metrics: Aggregating non-identifiable IP hashes to compute verified unique visitor counts without profiling or behavioral tracking.
06 Rights of the Data Principal under DPDP Act
As a Data Principal, you are entitled to exercise the following statutory rights directly with the Data Fiduciary:
1. Right to Access Information (Section 11)
You have the right to request a summary of your personal data being processed, the processing activities undertaken, and the identities of any data processors with whom data has been shared.
2. Right to Correction and Erasure (Section 12)
You have the right to request correction of inaccurate or misleading data, completion of incomplete data, updating of outdated data, and erasure of your personal data when the processing purpose is fulfilled.
3. Right of Grievance Redressal (Section 13)
You have the right to accessible grievance redressal mechanisms regarding any act or omission of the Data Fiduciary regarding the performance of its obligations under the Act.
4. Right to Nominate (Section 14)
You have the right to nominate any other individual who shall, in the event of death or incapacity, exercise your rights as a Data Principal under the Act.
07 Grievance Redressal Officer (GRO)
Pursuant to Section 13(1) of the DPDP Act, we have designated an official Grievance Redressal Officer to receive and address your requests and concerns:
Anjan Pandit
Designated Grievance Redressal Officer & Data Fiduciary
If your grievance is not redressed within the statutory timeline of 30 days or you are dissatisfied with the resolution, you retain the statutory right to appeal to the Data Protection Board of India (DPBI) in accordance with Section 13(3) and Chapter VI of the DPDP Act.
08 Technical & Organizational Security Safeguards
In adherence to Section 8(5) of the DPDP Act, we implement reasonable and robust technical and organizational measures to prevent personal data breaches:
- Transport Layer Security: Full TLS 1.3 / SSL encryption across all public and administrative endpoints.
- Cryptographic Hashing: All administrator credentials use Blowfish/Bcrypt (`PASSWORD_BCRYPT`) with randomized salt; all verification codes (OTPs) and password reset tokens are stored exclusively as 64-character SHA-256 hashes.
- SQL Injection Elimination: 100% parameter-bound prepared statements through PHP Data Objects (PDO) with strictly disabled emulation.
- Cross-Site Scripting (XSS) & CSRF Defense: Context-aware UTF-8 output encoding (`htmlspecialchars`), strict same-origin cookies, and anti-CSRF token verification on all POST operations.
- Rate Limiting & Brute-Force Delay: Sub-second artificial sleep latency on failed authentication attempts and a maximum threshold of 5 attempts before OTP invalidation.
09 Data Retention & Automated Purging
Personal data is retained only for as long as necessary to satisfy the specific purposes for which it was collected, or as required by applicable laws:
- Inquiry Submissions: Retained for a maximum period of 180 days following active correspondence, after which records are archived or permanently erased upon request.
- One-Time Passcodes (OTP): Login verification OTPs are automatically expired after 10 minutes; password reset OTPs expire after 15 minutes. Used or expired tokens are immediately deleted.
- Telemetry & Visitor Logs: Aggregated IP hashes are stored in pseudonymized form without linkage to identifiable personal records.
10 Children's Personal Data Policy
Pursuant to Section 9 of the DPDP Act, we do not knowingly collect, track, or process the personal data of individuals under the age of eighteen (18) years without verifiable consent from their parent or lawful guardian. This website is an executive professional portfolio intended exclusively for adult professionals, organizations, and corporate partners.
If you believe a minor has submitted personal data to this platform, please notify our Grievance Redressal Officer immediately via our Statutory Grievance Desk, and we will purge the data within 48 hours.
11 Third-Party Service Processors & Transfers
We engage select technical service providers solely as data processors under contractual confidentiality terms:
- Hostinger International Ltd.: Secure cloud server infrastructure and MySQL database hosting.
- Google Workspace / SMTP Relay: Secure email transmission infrastructure for dispatching acknowledgment notifications and verification OTPs.
We do not transfer personal data to any country or territory outside India that has been restricted by the Central Government of India under Section 16 of the DPDP Act.
12 Policy Amendments & Updates
We reserve the right to amend this Privacy Policy to reflect statutory updates, administrative notifications under the DPDP Act, or enhancements to our digital infrastructure. Any material modifications will be posted on this page with an updated "Effective Date".
For questions regarding this policy or to exercise your statutory rights as a Data Principal, please submit an inquiry through our Statutory Grievance Desk.