Legal
Privacy Policy
Last updated: August 2026
We advise clients on privacy and data protection for a living, so we hold our own handling of your data to the same standard. This policy explains what we collect, why, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
Who we are
Holdfast Assurance ("we", "us", "our") is a sole proprietorship based in Bengaluru, Karnataka, India, providing ISO certification readiness consulting and managed vulnerability management. For the purposes of the DPDP Act, we act as the Data Fiduciary for the personal data described in this policy. You can reach us at contact@holdfastassurance.com.
What we collect
We only collect what we need to respond to you and deliver our services:
- Enquiry data — the name, work email, phone number and message you submit through our contact form, WhatsApp, phone or email.
- Engagement data — information you share with us during a consulting engagement, which may include details about your organisation's systems, policies and staff. This is handled under the confidentiality terms of our engagement agreement.
- Technical data — basic, aggregated analytics about how visitors use this website. We do not use this to identify individuals.
How we use it
- To respond to your enquiry and provide a consultation or written quote.
- To deliver, manage and support the services you engage us for.
- To meet our legal, regulatory and contractual obligations.
We do not sell your personal data, and we do not use it for advertising or share it with third parties for their own marketing.
Legal basis and consent
We process your personal data on the basis of your consent (given when you contact us) and, where applicable, for the performance of a contract with you or to comply with law. You may withdraw consent at any time by emailing us, though this may affect our ability to provide services you have requested.
Your rights under the DPDP Act
As a Data Principal, you have the right to:
- Access a summary of the personal data we hold about you and how we process it.
- Request correction, completion or updating of inaccurate or incomplete data.
- Request erasure of your personal data where it is no longer needed.
- Nominate another individual to exercise your rights in the event of death or incapacity.
- Raise a grievance with us, and escalate to the Data Protection Board of India if unresolved.
To exercise any of these, email contact@holdfastassurance.com and we will respond within a reasonable period.
How long we keep it
We retain enquiry data only as long as needed to respond and, if you become a client, for the duration of our relationship plus any period required by law. Engagement data is retained per the terms of the specific engagement. When data is no longer required, we delete or anonymise it.
Where your data is processed
This site is served through Cloudflare's global network, and our business email is provided by Zoho. Contact-form submissions are delivered to us through a form-handling service. These providers process data on our behalf; we choose providers that offer appropriate safeguards.
How we protect it
Given the nature of our work, security is not an afterthought. We apply access controls, encryption in transit, and the same information-security practices we help our clients implement, to reduce the risk of unauthorised access, loss or disclosure.
Changes to this policy
We may update this policy as our services or the law evolves. The "last updated" date above reflects the current version.
Contact
Questions or requests about your data? Email contact@holdfastassurance.com or call +91 88921 45713.