This Privacy Policy explains how VDHOSTS INTERNET PRIVATE LIMITED ("VD Hosts", "we", "us") collects, uses, shares and protects personal data when you visit our websites (including vdhosts.com and our country pages), contact us, register for a client account, apply for a job or partnership, or use our services. It also explains the choices and rights you have.
We are a private limited company incorporated in India (CIN U72200UP2022PTC159610), with our registered office at C/o Anita, Kanakpur Mayabazar, Faizabad (Ayodhya), Uttar Pradesh 224161, India. For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we act as a Data Fiduciary for the personal data described in this policy. When we process personal data on behalf of our clients while delivering services, we act as a Data Processor (or "service provider" / "processor" under US and EU law) and our client's own privacy notice applies; see section 12.
1. Summary
- We collect the personal data you give us (for example your name, email, phone number, company and message) and limited technical data when you use our website.
- We use it to reply to you, provide and bill for our services, run client accounts, keep our systems secure, and meet legal obligations.
- We do not sell your personal data, and we do not share it for cross-context behavioural advertising without your consent.
- Non-essential cookies (analytics and marketing) are used only with your consent, which you can withdraw at any time.
- You can ask to access, correct, update or erase your data, withdraw consent, and raise a grievance. Contact details are in section 14.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | Name, email address, phone number (with country code), job title, company name, country and city | You, through our forms, emails, calls or WhatsApp |
| Enquiry and project data | Service of interest, budget range, timeline, preferred contact method, message content and attachments | You |
| Client account data | Login email, password (stored only as a one-way hash), company details, GSTIN (optional), requests you raise, account status and decisions | You and our staff |
| Commercial and billing data | Proposals, agreements, invoices, payment status and tax details. Card and bank details are handled by our payment providers, not stored by us | You, our systems and payment providers |
| Recruitment data | CV, experience, location, profile links and anything else you include in a job application | You |
| Partner data | Business details, website, partner type and correspondence | You |
| Technical and usage data | IP address, approximate country derived from IP, browser and device type, pages visited, referring page, date and time, and security logs | Your device and our servers |
| Cookie and preference data | Your cookie choices, chosen country and colour theme | Your browser |
| Communications | Emails and WhatsApp messages exchanged with us, and whether you opted out of messages | You and our systems |
We do not intend to collect sensitive categories of data (such as health, biometric, financial account passwords, religious beliefs or sexual orientation) through our website. Please do not send them unless we specifically ask for them for a defined purpose. Our services are intended for businesses and adults; see section 11 on children.
3. Why we use personal data, and on what basis
| Purpose | Basis under the DPDP Act | Basis under GDPR (EU/UK visitors) |
|---|---|---|
| Replying to enquiries, contact messages and requests for proposals | Your consent given on the form, and your voluntary provision of data for this purpose | Steps at your request before a contract; legitimate interests |
| Creating, reviewing and running client accounts, including approval decisions | Consent and voluntary provision; performance of the services you request | Contract; legitimate interests |
| Delivering services, project communication, invoicing and collections | Voluntary provision for the specified purpose; legal obligations (for example tax laws) | Contract; legal obligation |
| Recruitment and partner evaluation | Consent | Consent; legitimate interests |
| Website security, fraud and abuse prevention, troubleshooting | Legitimate uses permitted by law, including compliance with CERT-In directions and preventing harm | Legitimate interests; legal obligation |
| Analytics and marketing measurement (only with cookie consent) | Consent | Consent |
| Marketing emails and WhatsApp messages | Consent, which you can withdraw at any time | Consent; legitimate interests for existing clients where permitted |
| Complying with law, court orders and regulator requests; establishing or defending legal claims | Legal obligation and legitimate uses | Legal obligation; legitimate interests |
Where we rely on consent, you can withdraw it at any time with the same ease as it was given (see section 9). Withdrawal does not affect processing already carried out, and we may then be unable to provide a service that needs the data.
4. Who we share personal data with
We share personal data only as needed for the purposes above, under written agreements that require recipients to protect it:
- Service providers (processors): hosting and cloud infrastructure, email delivery, the WhatsApp Business Platform (Meta), analytics (only with consent), customer-support and ticketing tools, file storage and backup, and payment gateways. They may use the data only to provide services to us.
- Our group, partners and subcontractors involved in delivering a service you have engaged us for, under confidentiality obligations (see our Subcontractor and Third-Party Policy).
- Professional advisers such as auditors, lawyers and accountants, under confidentiality.
- Authorities where required by law, including requests from courts, CERT-In, tax authorities or other competent authorities, and where necessary to protect rights, property or safety.
- Successors in a merger, acquisition or sale of assets, subject to this policy.
We maintain a current list of our main sub-processors and can provide it on request to clients.
5. No sale of personal data; advertising
We do not sell personal data for money. We do not "sell" or "share" personal data as those terms are defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and we do not process personal data for targeted advertising, except where you have consented to marketing cookies. If you consent to marketing cookies, limited data (such as a hashed email or a cookie identifier) may be shared with advertising platforms to measure our campaigns. You can withdraw that consent at any time through Cookie settings, and we honour browser-based opt-out signals such as Global Privacy Control as a request to opt out.
6. International transfers
We are based in India and our main systems are hosted in India and with major cloud providers. Personal data may be processed in other countries where we or our service providers operate, including the United States. Where we transfer personal data outside India, we do so in accordance with the DPDP Act and any restrictions notified under it. For transfers of personal data from the European Economic Area or the United Kingdom, we use appropriate safeguards such as standard contractual clauses.
7. How long we keep personal data
| Data | Retention |
|---|---|
| Enquiries that do not become clients | Up to 24 months from the last contact, then deleted or anonymised, unless you ask us to delete it sooner |
| Client account, contracts, project records | For the life of the relationship and up to 8 years after it ends, to meet tax, accounting and limitation requirements |
| Invoices and accounting records | As required by Indian tax and company laws (generally at least 8 years) |
| Job applications | Up to 12 months, unless you are hired or ask us to delete it sooner |
| Security and access logs | Generally 180 days, as required by the CERT-In Directions of 28 April 2022, or longer where needed to investigate an incident |
| Marketing consent and opt-out records | As long as needed to respect your choice |
When the purpose is served and no law requires us to keep it, we delete or anonymise the data, as the DPDP Act requires.
8. How we protect personal data
We implement reasonable security practices and procedures, as required by section 43A of the Information Technology Act, 2000 and the related SPDI Rules, and the security safeguards required under the DPDP Act. These include encryption in transit (HTTPS/TLS), hashed passwords, role-based access with multi-factor authentication for staff, private storage of uploaded files with time-limited access links, audit logs, regular updates, backups and security testing. No system is completely secure; if a personal data breach occurs, we will notify affected persons and the relevant authorities, including the Data Protection Board of India and CERT-In, as and when required by law.
9. Your rights
9.1 In India (DPDP Act)
- Right to access a summary of the personal data we process and the processing activities, and the identities of others we have shared it with.
- Right to correction, completion, updating and erasure of your personal data.
- Right to withdraw consent at any time.
- Right to grievance redressal (section 14), and to complain to the Data Protection Board of India after using our grievance process.
- Right to nominate another person to exercise your rights in the event of death or incapacity.
9.2 In the United States
Depending on your state of residence (for example California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others with comprehensive privacy laws) and on whether the law applies to us, you may have the right to: know what personal information we collect and how we use and disclose it; access and obtain a copy; correct inaccuracies; delete it; opt out of sale, sharing for cross-context behavioural advertising, targeted advertising and certain profiling; limit the use of sensitive personal information; and not be discriminated against for exercising these rights. You may use an authorised agent. If we deny a request, you may appeal by replying to our decision, and you may contact your state Attorney General if you disagree with the outcome of an appeal.
Categories under the CCPA. In the past 12 months we may have collected identifiers, commercial information, internet or other network activity, approximate geolocation (from IP address), professional or employment-related information, and inferences limited to service preferences, for the business purposes described in section 3, and disclosed them to the categories of recipients in section 4. We have not sold or shared personal information as defined in the CCPA, except as described in section 5 when you consent to marketing cookies.
9.3 In the EU, EEA and UK
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local data protection authority.
9.4 How to exercise your rights
Email info@vdhosts.com with the subject "Privacy request", or write to the Grievance Officer (section 14). We will verify your identity proportionately (usually by confirming control of the email address on record) and respond within the time required by applicable law, and in any case within 30 days of a verified request unless the law allows an extension, in which case we will tell you why. Requests are free unless they are manifestly unfounded or excessive.
10. Cookies and similar technologies
We use strictly necessary cookies (for example to keep you signed in, protect forms against forgery, and remember your cookie choice, country and theme) without consent, and analytics or marketing cookies only with your consent. See our Cookie Policy for the full list and how to change your choice.
11. Children
Our website and services are directed at businesses and are not intended for children. We do not knowingly collect personal data from children under 18 in India or under 13 in the United States (as defined by the Children's Online Privacy Protection Act). If you believe a child has provided personal data to us, contact us and we will delete it. Where a client engages us to build services for children, verifiable parental consent and other safeguards are addressed in the project agreement.
12. Data we process for our clients
When we build or operate systems for clients, we may process personal data of their customers or employees on their instructions. In that case the client is the Data Fiduciary (or controller / business), our processing is governed by our agreement and Data Processing Agreement with that client, and questions should be directed to the client first. We will assist our clients in responding to such requests.
13. Communications and marketing
We send service and transactional messages (for example replies to your enquiry, account approvals, invoices and security notices). We send marketing emails or WhatsApp messages only with your consent or where otherwise permitted by law, and every marketing message includes a way to opt out. Replying "STOP" on WhatsApp opts you out of WhatsApp messages. See our Anti-Spam and Communications Policy.
14. Grievance Officer and contact
In accordance with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, our Grievance Officer is:
Grievance Officer
VDHOSTS INTERNET PRIVATE LIMITED
C/o Anita, Kanakpur Mayabazar, Faizabad (Ayodhya), Uttar Pradesh 224161, India
Email: info@vdhosts.com
We acknowledge grievances promptly and aim to resolve them within the time required by applicable law. For general privacy questions write to info@vdhosts.com. For anything else, including visitors and clients in the United States and other countries, write to contact@vdhosts.com.
Our offices. Headquarters: Bellandur Main Road, near Marathahalli, Kaverappa Layout, Kadubeesanahalli, Bengaluru, Karnataka 560103, India. Kota office: 2-B-14, Rangbari Yojana, Mahaveer Nagar Extension, Kota, Rajasthan 324005, India. Registered office: C/o Anita, Kanakpur Mayabazar, Faizabad (Ayodhya), Uttar Pradesh 224161, India.
15. Changes to this policy
We may update this policy to reflect changes in law or our practices. The version number and effective date at the top show when it last changed. If a change materially affects how we use personal data you have already given us, we will notify you and, where required, ask for your consent again.