Effective 1 July 2026
Version 1.0 | Last Updated: 1 July 2026
Kaarastu Consultancy Services ("Kaarastu," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at https://www.kaarastu.com (the "Website") or interact with us through other channels described herein.
We encourage you to read this Privacy Policy carefully. By accessing or using our Website, you acknowledge that you have read and understood this Privacy Policy.
This Privacy Policy applies to all personal information collected through:
This Privacy Policy does not apply to information collected by third parties, including through any application or content that may link to or be accessible from our Website.
We collect personal information that you voluntarily provide to us when you:
The categories of personal information we may collect include:
We do not intentionally collect sensitive personal information (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) through our Website.
When you access our Website, certain information may be collected automatically through cookies and similar technologies, including:
This information is collected to help us understand how visitors use our Website, improve its functionality, and ensure its security.
Our Website uses cookies and similar tracking technologies to enhance your browsing experience and to collect analytical data.
Types of cookies we use:
Google Analytics: We use Google Analytics 4 to collect anonymized usage data. Google Analytics sets cookies (including _ga and _ga_EE2MB08RCE) to help us analyze how visitors use our Website. The information generated by the cookie about your use of the Website is transmitted to and stored by Google on servers that may be located outside your country of residence. We have configured IP anonymization.
Local Storage: Our Website uses browser local storage (not cookies) to remember your color theme preference and your cookie consent decision. These are stored only on your device and are not transmitted to our servers.
Cookie Consent: Where required by applicable law, we obtain your consent before placing non-essential cookies on your device. Our Website displays a cookie consent banner on your first visit. Analytics cookies (Google Analytics) are only activated after you explicitly accept via the consent banner. You may change your consent decision at any time via the "Cookie Settings" link in our website footer.
How to control cookies: Most web browsers allow you to control cookies through their settings. You can typically set your browser to refuse cookies or to alert you when cookies are being sent. Please note that disabling cookies may affect the functionality of certain parts of our Website.
We use the personal information we collect for the following purposes:
We will not use your personal information for purposes materially different from those described above without providing you notice and, where required, obtaining your consent.
For individuals located in the European Economic Area (EEA) or the United Kingdom (UK), we process personal information only where we have a valid legal basis to do so under the General Data Protection Regulation (GDPR) or UK GDPR:
Where we rely on legitimate interest, we have conducted balancing assessments to ensure our interests do not override your fundamental rights and freedoms.
You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.
We do not sell, rent, or trade your personal information to third parties.
We may share your information with the following categories of recipients, only to the extent necessary for the purposes described in this Privacy Policy:
All third-party service providers are bound by Data Processing Agreements (DPAs) or equivalent contractual terms that require them to process personal information only on our instructions and in accordance with applicable data protection laws. We have reviewed and accepted the standard data processing terms offered by AWS, Google, and Formspree, which include appropriate data protection commitments and, where applicable, Standard Contractual Clauses for international transfers.
Kaarastu operates from India and serves clients globally. Your personal information may be transferred to and processed in countries other than your country of residence, including India and the United States, where data protection laws may differ from those in your jurisdiction.
Where we transfer personal information from the EEA or UK to countries not deemed to provide an adequate level of data protection, we rely on appropriate safeguards, including:
Our hosting provider (AWS) and analytics provider (Google) include Standard Contractual Clauses as part of their standard data processing agreements, which apply automatically to transfers of EEA/UK personal data.
By submitting your information through our Website, you acknowledge that your information may be processed in countries outside your country of residence.
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.
Our retention guidelines:
When personal information is no longer needed, we will securely delete or anonymize it in accordance with our data retention procedures.
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.
In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will:
Depending on your location and applicable law, you may have certain rights regarding your personal information:
To exercise any of these rights, please contact us using the details provided in Section 17 below. We will respond to verifiable requests within the timeframes required by applicable law (typically 30 days under GDPR, 45 days under CCPA/CPRA).
We may need to verify your identity before fulfilling your request. If we cannot verify your identity or the request is manifestly unfounded or excessive, we may decline the request or charge a reasonable fee, as permitted by applicable law.
Where you have provided consent or where we have a legitimate interest to do so, we may send you marketing communications about our services, events, publications, or thought leadership content.
Scope of legitimate interest for marketing: We rely on legitimate interest as a legal basis for marketing communications only to individuals with whom we have an existing business relationship (e.g., those who have previously submitted an inquiry, engaged our services, or attended our events). All other marketing communications are sent only with explicit consent.
You may opt out of receiving marketing communications at any time by:
Opting out of marketing communications will not affect communications necessary for service delivery or responding to your inquiries.
Our Website may contain links to third-party websites, services, or content that are not operated or controlled by Kaarastu. This Privacy Policy does not apply to such third-party sites.
We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policies of any third-party site you visit.
Third-party services integrated with our Website:
Our Website also contains outbound links to LinkedIn for company and team profiles. These are standard hyperlinks and do not embed third-party tracking on our Website.
Our Website and services are directed to businesses and professionals. We do not knowingly collect personal information from children under the age of 16 (or under 18 where required by local law, including India under the Digital Personal Data Protection Act, 2023).
If we become aware that we have collected personal information from a child without appropriate parental or guardian consent, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us using the details in Section 17.
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other operational factors. When we make material changes, we will:
We encourage you to review this Privacy Policy periodically. Your continued use of our Website after any changes indicates your acceptance of the updated Privacy Policy.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Kaarastu Consultancy Services 9th Floor, Tower C, Logix Cyber Park, Block-C, Phase-II, Industrial Area, Sector-62, Noida, Uttar Pradesh-201309, India
Email: contact@kaarastu.com
We aim to respond to all inquiries within 30 days.
If you are not satisfied with our response to a privacy concern or believe our processing of your personal information violates applicable law, you have the right to lodge a complaint with the relevant supervisory authority:
We encourage you to contact us first so we can attempt to resolve your concern directly.
If you are located in the EEA or UK, the GDPR / UK GDPR provides you with specific rights as outlined in Section 12. In addition:
Data Protection Officer: Kaarastu has assessed its processing activities against the criteria in Article 37 GDPR and has determined that the appointment of a Data Protection Officer is not currently required. Our core activities do not involve (a) regular and systematic monitoring of individuals at large scale, or (b) large-scale processing of special categories of data. Privacy inquiries may be directed to contact@kaarastu.com.
EU/UK Representative: Based on the current nature and scale of our processing (occasional, limited to basic contact information from business inquiries, no special category data), we have determined that the appointment of an EU/UK representative under Article 27 GDPR is not currently required. We will reassess this determination annually, or sooner if we begin regularly offering services directly to EEA/UK individuals at scale or systematically processing data of EEA/UK residents.
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) may provide you with additional rights. While Kaarastu does not currently meet the CCPA/CPRA applicability thresholds, we voluntarily provide the following transparency:
Disclosure: Kaarastu does not sell personal information. We do not use personal information for cross-context behavioral advertising.
Do Not Track: Our Website does not currently respond to "Do Not Track" (DNT) browser signals, as there is no industry-standard technology for recognizing or honoring DNT signals. However, you may opt out of analytics tracking at any time via our cookie consent mechanism (accessible through the "Cookie Settings" link in our website footer).
To exercise your privacy rights, please contact us using the information in Section 17.
If you are located in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) provides you with rights including:
We process your personal data based on consent or for legitimate uses as permitted under the DPDP Act.
Grievance Officer:
The Grievance Officer will acknowledge your grievance within 48 hours and endeavor to resolve it within 30 days of receipt.