(Legal)
Privacy Policy
Last updated: 21 October 2026 · In effect from: 21 October 2026
This policy explains how personal data is collected, used and protected when you visit this website or contact us through it. It is written to meet the notice and consent standards of India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, which are being brought into force in stages, and, where they apply to you, the EU and UK General Data Protection Regulations.
Notice at a glance
This summary is part of this Privacy Policy and is given at the point where you provide your details.
| What we collect | Why | How long |
| Name, company name, email address and topic of enquiry, from the enquiry form | To respond to your enquiry and arrange a conversation | Up to 24 months after our last contact |
| Details you send by email or telephone | To correspond with you | Up to 24 months after our last contact |
| IP address and basic technical data, in server logs | To deliver the website and keep it secure | Up to 90 days |
The website sets no cookies and uses no analytics, advertising or tracking. You may withdraw your consent, access, correct or erase your data, or make a complaint at any time, as set out in sections 7 to 9.
- 1.Who we are
- 2.Personal data we collect
- 3.Why we use personal data, and on what basis
- 4.Who receives your personal data
- 5.Transfers outside India
- 6.How long we keep personal data
- 7.Your rights
- 8.Withdrawing your consent
- 9.Grievance redressal and complaints
- 10.Children
- 11.Security
- 12.Cookies and similar technologies
- 13.Links to other websites
- 14.Your responsibilities
- 15.Changes to this policy
- 16.Contact
1.Who we are
Helen Carolina H (“we”, “us”, “Helen Carolina H”) operates this website at officeofhelen.com (the “Website”). For the purposes of India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we are the Data Fiduciary for the personal data described in this policy. Where the EU or UK General Data Protection Regulation applies to you, we are the controller.
Registered address: [To be completed: registered address, Chennai, Tamil Nadu, India]
Email: hey@officeofhelen.com
Grievance Officer: Helen Carolina H, hey@officeofhelen.com
2.Personal data we collect
Data you give us
- Through the enquiry form: your name, company name, email address and the topic you select.
- By email or telephone: the details you choose to send or say, and your contact details.
- In a conversation: information you choose to share about yourself and your organisation.
Data collected automatically
When you visit the Website, our hosting provider’s servers record standard technical data in logs: your IP address, browser type, device type, the pages requested, the date and time, and the referring page.
What we do not collect
We do not ask for sensitive data such as financial account numbers, health information or government identification numbers. Please do not send them to us. The Website has no user accounts or payments, and it uses no analytics, advertising identifiers, social media plug-ins or cookies. It does not load fonts, scripts or other content from third-party servers.
3.Why we use personal data, and on what basis
| Purpose | Basis under the DPDP Act | Basis under the GDPR (where it applies) |
| To respond to enquiries, arrange and hold conversations, and prepare a scope note | Your consent, given when you submit the form and tick the consent box, or when you contact us directly | Steps taken at your request before entering into a contract, and our legitimate interest in responding to business enquiries |
| To keep a record of enquiries, and to establish or defend legal claims | Your consent, and compliance with law | Our legitimate interests |
| To operate and secure the Website | Our duty to maintain reasonable security safeguards | Our legitimate interest in the security and operation of the Website |
| To comply with legal obligations | Compliance with law | Legal obligation |
We do not sell personal data. We do not use it for advertising, we do not profile you, and we do not make decisions about you by automated means. We will send you marketing messages only if you ask for them or separately consent to them.
4.Who receives your personal data
- Service providers that host the Website, handle email and forms, and schedule calls: Cloudflare Pages, Web3Forms and Google Meet or Zoom. They process personal data on our instructions and under contract.
- Specialist collaborators, only if an engagement is proposed and only with your agreement, under written confidentiality obligations.
- Professional advisers such as legal and accounting advisers, under duties of confidentiality.
- Courts, regulators and public authorities, where the law requires us to disclose.
5.Transfers outside India
Our service providers may store or process personal data in countries other than India. We transfer personal data outside India only as the DPDP Act permits, which allows transfers except to countries or territories that the Government of India restricts by notification. We require our providers to apply appropriate security and confidentiality safeguards.
Where the GDPR applies and a transfer requires specific safeguards, we use standard contractual clauses or another lawful mechanism.
6.How long we keep personal data
- Enquiries and correspondence: up to 24 months after our last contact. If an engagement begins, the engagement agreement governs how long related records are kept.
- Server logs: up to 90 days.
We delete or anonymise personal data when the purpose for which it was collected has been served, or when you withdraw consent, unless the law requires us to keep it longer.
7.Your rights
Under the DPDP Act
You may:
- obtain a summary of the personal data we process and of our processing activities, and the identities of those with whom we have shared it;
- ask us to correct, complete or update your personal data;
- ask us to erase your personal data;
- withdraw your consent at any time;
- use our grievance redressal process (section 9); and
- nominate another person to exercise these rights on your behalf if you die or become incapacitated.
Under the GDPR, if it applies to you
You also have the right of access, rectification, erasure, restriction of processing, data portability and objection, the right to withdraw consent, and the right not to be subject to decisions based solely on automated processing. You may complain to the data protection supervisory authority of your country.
How to exercise your rights
Email hey@officeofhelen.com with the subject “Data request”. We may ask you to confirm your identity first. We will respond within 30 days and always within the period the law allows.
8.Withdrawing your consent
Withdrawing consent is as easy as giving it. Email hey@officeofhelen.com with the subject “Withdraw consent”, or reply to any message from us. We will stop processing your personal data for the purpose concerned and delete it within 30 days, unless the law requires us to keep it. Withdrawal does not affect processing carried out before you withdrew. If you withdraw consent, we may not be able to continue a conversation with you.
9.Grievance redressal and complaints
If you have a concern about how we handle your personal data, contact our Grievance Officer: Helen Carolina H, hey@officeofhelen.com. We will acknowledge your grievance within 7 days and resolve it within 30 days, and in any case within the period prescribed by law, which under the Digital Personal Data Protection Rules, 2025 is not more than 90 days.
If you are not satisfied, you may complain to the Data Protection Board of India, once you have used our grievance process. If the GDPR applies to you, you may complain to your local supervisory authority.
10.Children
The Website is intended for business audiences and not for anyone under 18. We do not knowingly collect the personal data of children. If you believe a child has given us personal data, contact us and we will delete it.
11.Security
We use reasonable security safeguards suited to the data we hold: encrypted connections (HTTPS), access limited to those who need it, and providers who are bound by contract to protect personal data. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and the persons affected, as the law requires.
12.Cookies and similar technologies
The Website does not set cookies and does not track you. Please see our Cookie Policy.
13.Links to other websites
The Website links to external services such as LinkedIn and Instagram. We do not control them and are not responsible for their privacy practices. Please read their policies before you share personal data with them.
14.Your responsibilities
Please give us accurate information. Do not impersonate another person, and do not send us another person’s personal data unless you have the authority to do so.
15.Changes to this policy
We may update this policy. The date at the top shows when it was last revised. If a change materially affects how we use your personal data, we will state it clearly on the Website, and where the law requires, we will ask for your consent again.
16.Contact
Helen Carolina H
[To be completed: registered address, Chennai, Tamil Nadu, India]
hey@officeofhelen.com