Privacy Policy

This Privacy Policy explains how Fundamenta (“Fundamenta”, “we”, “us”, “our”) collects, uses, shares, and protects personal data when you visit fundamenta.agency (the “Site”), contact us, request a Brand Trust Audit, subscribe to our updates, apply for a role, or engage our services.

We are a B2B brand practice based in Pune, India. We work with clients in India and internationally. This policy is written to hold across the regions we deal with: India, the European Union and European Economic Area, the United Kingdom, the United States, Australia, and the Middle East.

If you do not agree with this policy, please do not use the Site or share personal data with us.

1. Who we are and how to contact us

Data Fiduciary / Data Controller: Fundamenta, a proprietorship.

Registered address: 201, Siddhant Serene, Shreenath Nagar Lane No. 2, Veerbhadra Nagar Road, Baner, Pune, Maharashtra 411045, India.
General contact: hello@fundamenta.agency
Phone: +91 70209 97971
Grievance Officer (India DPDP Act): Vivek Chandanshiv, reachable at vivek.chandanshiv@fundamenta.agency.

For any privacy question, request, or complaint, write to hello@fundamenta.agencywith the subject line “Privacy Request”.

2. The scope of this policy

This policy covers personal data we process as the controller or data fiduciary, meaning data we decide the purpose and means for.

When we deliver services to a client, we sometimes process personal data on that client’s behalf and under their instructions. In those cases we act as a processor or data processor, and the client’s own privacy policy governs that data. This policy does not cover that client-controlled data.

3. The personal data we collect

We collect only what we need. Categories include:

Data you give us directly

• Identity and contact details: name, work email, phone or WhatsApp number, company name, job title.
• Audit and enquiry details: your website URL, turnover band, the brand or sales problem you describe, and anything you choose to share in a form, email, or call.
• Recruitment details: CV, portfolio, work history, and anything in your application, if you apply for a role.
• Communication content: messages you send us by email, WhatsApp, form, or social channels.

Data we collect automatically

• Technical and usage data: IP address, browser type, device type, pages viewed, referring source, and time on page. This is collected through cookies and similar technologies, and only with your consent where the law requires it. See our Cookie Policy.

Data from third parties

• Public professional sources such as LinkedIn or a company website, used to qualify a lead or prepare for a call.
• Analytics and advertising platforms, where you have consented to those cookies.

We do not knowingly collect sensitive or special category data through the Site. Please do not send us such data unless we have asked for it and explained why.

4. How we use your data and our legal bases

We use personal data for these purposes:

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing done before you withdrew it.

Where we rely on legitimate interest, we have weighed our interest against your rights, and we will stop if you object and your rights override that interest.

5. Cookies and tracking

The Site uses strictly necessary cookies to function. With your consent, it also uses analytics cookies to understand usage.

When you first visit, you can choose to Allow or Deny non-essential cookies. We honour that choice and re-ask after a set period. Strictly necessary cookies run regardless, because the Site cannot work without them.

Full detail sits in our Cookie Policy.

6. Who we share data with

We do not sell your personal data. We share it only with:

• Service providers (sub-processors) who help us run the business, such as email, hosting, analytics, scheduling, document signing, and CRM tools. They process data under contract and only on our instructions. Current providers include hosting on Vercel, email and bookings on Zoho, scheduling tools, and analytics where consented. A current list is available on request.
• Professional advisers such as legal, accounting, or insurance, where needed.
• Authorities where the law requires disclosure.
• A successor in the event of a merger, acquisition, or reorganisation, under equivalent protection.

We choose providers that offer suitable safeguards for personal data.

7. International data transfers

We are based in India and use providers in other regions, including the United States and the European Union. This means your data may be transferred and stored outside your home country.

When we move data across borders, we put appropriate safeguards in place, such as Standard Contractual Clauses for transfers from the EU, EEA, or UK, or transfers to countries recognised as providing adequate protection, or other lawful transfer mechanisms. For transfers under India’s DPDP Act, we follow the restrictions the Government of India notifies from time to time.

You can ask us for detail on the safeguards that apply to your data.

8. How long we keep data

We keep personal data only as long as we need it for the purpose we collected it, or as the law requires.

• Enquiry and lead data: kept while the lead is active, then for a reasonable follow-up window, then deleted or anonymised.
• Client project data: kept for the engagement and a records period afterwards.
• Newsletter data: kept until you unsubscribe.
• Recruitment data: kept for the role and a short window after, unless you agree we may keep it longer for future roles.

When data is no longer needed, we delete or anonymise it.

9. How we protect data

We take reasonable technical and organisational steps to protect personal data against loss, misuse, and unauthorised access. These include access controls, encrypted connections, vetted providers, and limiting who on the team can see what.

No system is perfectly secure. We cannot promise absolute security, but we work to reduce risk and we act on any breach as the law requires.

10. Your rights

Your rights depend on where you are. We honour the rights available to you under the law that applies. To use any right, write to hello@fundamenta.agency. We may need to verify your identity first.

India (Digital Personal Data Protection Act, 2023)

You have the right to access a summary of your data and how it is processed, to correct or update it, to erase it where no longer needed, to nominate someone to act for you, and to grievance redressal through our Grievance Officer. You may also withdraw consent.

EU / EEA and United Kingdom (GDPR and UK GDPR)

You have the right to access, rectify, erase, restrict, and object to processing, the right to data portability, the right to withdraw consent, and the right not to be subject to solely automated decisions with legal effect. You may also complain to your local supervisory authority.

United States (including California, CCPA / CPRA, and similar state laws)

You have the right to know what we collect, to access and delete it, to correct it, to opt out of any sale or sharing for cross-context advertising, and to not be discriminated against for using your rights. We do not sell personal data. Where US state law gives an authorised agent the right to act for you, we honour valid requests.

Australia (Privacy Act 1988 and Australian Privacy Principles)

You have the right to access and correct your personal information, and to complain about how we handle it. If unresolved, you may contact the Office of the Australian Information Commissioner.

Middle East (including UAE Federal Decree-Law No. 45 of 2021 and Saudi Arabia’s PDPL)

Where these laws apply to you, you have rights to access, correct, and delete your data, to withdraw consent, and to object to certain processing, subject to local conditions.

We respond to rights requests within the timeframe the applicable law sets. If we cannot act on a request, we explain why.

11. Marketing

We send marketing and updates only to people who asked for them, or where the law otherwise allows. Every marketing email has an unsubscribe link. You can opt out at any time, and we will stop.

12. Children

The Site and our services are meant for businesses and professionals. They are not directed at children. We do not knowingly collect data from anyone under the age that local law treats as a minor. Under India’s DPDP Act, we do not knowingly process a child’s data without verifiable parental consent. If you believe a child has shared data with us, contact us and we will delete it.

13. Third-party sites

The Site may link to other websites, including client sites and social platforms. We do not control those sites and are not responsible for their privacy practices. Read their policies before sharing data with them.

14. Changes to this policy

We may update this policy as our practices or the law change. We will post the new version here with a fresh “Last updated” date. For a material change, we will take reasonable steps to tell you. Continued use of the Site after a change means you accept the updated policy.

15. How to contact us or complain

For any request, question, or complaint about your data:

Email: hello@fundamenta.agency (subject: Privacy Request)
Phone: +91 70209 97971
Grievance Officer (India): Vivek Chandanshiv, vivek.chandanshiv@fundamenta.agency
Post: 201, Siddhant Serene, Shreenath Nagar Lane No. 2, Veerbhadra Nagar Road, Baner, Pune, Maharashtra 411045, India.

If you are in the EU, UK, Australia, or another region with a data authority, you may also complain to that authority. We ask that you contact us first so we can try to resolve it.