Legal

Privacy Policy

Last updated 3 November 2026

This policy explains how Digital Obsession Communication Private Limited, trading as DO Communication ("DO Communication", "we", "us"), handles personal data when you visit docommunication.io (the "Site"), contact us, or apply for a job with us.

It is written to meet:

India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (DPDP);
the EU General Data Protection Regulation (GDPR) and the UK GDPR;
US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA (CCPA) and the California Online Privacy Protection Act (CalOPPA).

Where a law gives you stronger rights than this policy describes, that law applies.

Our use of cookies and similar technologies is explained in our Cookie Policy.

1. Who we are and how to reach us

Data controller / Data Fiduciary	Digital Obsession Communication Private Limited
Address	B-8, Hartron Complex, Electronic City, Udyog Vihar, Sector 18, Gurugram, Haryana 122015, India
Privacy contact / Grievance Officer	Founder & CEO, [email protected]
Phone	+91 99996 61915

The Privacy contact answers questions about this policy and handles requests and complaints about your personal data (this is the contact required by DPDP Rules, 2025 and the grievance officer contact under Indian law).

2. What we collect

We collect only what we need. The Site has no user accounts, and we do not ask for sensitive data.

2.1 Information you give us

Where	What we collect	Required?
Contact / project enquiry forms	Your name, work email, and optionally phone, website, links, and your message. We also record the form you used and the page you were on.	Email (or phone) is required so we can reply. Everything else is optional.
Careers application form	Your name, email, and optionally phone, the role you're interested in, years of experience, portfolio / profile links, a message, and your CV, as a PDF of up to 2 MB.	Email is required.
Emails and calls	Whatever you choose to send us, e.g. [email protected].	—

Please don't send us sensitive personal data in a form or email. That includes health, financial account, government ID, religion or similar data.

2.2 Information collected automatically

Technical and security data. Our hosting and security provider (Cloudflare) processes your IP address, browser and device type, the pages requested, and the date and time of each request. This is how the Site gets delivered and protected from abuse.
Rate limiting. To stop form spam, we keep a counter keyed to your IP address. It is deleted automatically after 60 seconds.
Preferences. If you switch between light and dark mode, your choice is saved in your own browser's local storage (do-theme). It never leaves your device.
Analytics and advertising data. These are collected only if you consent (and, in the US, only if you have not opted out). They include pages visited, time on page, how you arrived (e.g. a search or an ad), approximate location derived from IP, and form-submission events. Details and the exact cookies are in the Cookie Policy.

2.3 Information from others

Referrals. A referrer may pass us your contact details, e.g. a client introducing you.
Public professional profiles. If you apply for a job, we may look at profiles you link to (such as LinkedIn or a portfolio).

3. Why we use it, and our legal basis

Purpose	Data used	GDPR / UK GDPR legal basis	DPDP basis
Reply to your enquiry and discuss a possible project	Contact-form data, emails	Steps you ask for before a contract (Art. 6(1)(b)); our legitimate interest in answering business enquiries (Art. 6(1)(f))	Your consent, or the "voluntarily provided for a specified purpose" legitimate use (s. 7(a))
Consider your job application	Careers-form data, CV, linked profiles	Steps before a contract (Art. 6(1)(b)); legitimate interest in recruiting (Art. 6(1)(f))	Your consent, or s. 7(a) legitimate use
Run, secure and fix the Site; prevent spam and fraud	Technical data, IP rate-limit counter	Legitimate interest in a secure, working site (Art. 6(1)(f))	Necessary to provide the Site; legitimate uses under s. 7
Measure and improve the Site (analytics)	Analytics data	Your consent (Art. 6(1)(a); ePrivacy / PECR)	Your consent
Measure and run our advertising	Advertising data	Your consent (Art. 6(1)(a); ePrivacy / PECR)	Your consent
Send you follow-ups about our services	Name, email	Legitimate interest for existing business contacts (with an easy opt-out), or your consent where the law requires it	Your consent
Meet legal obligations; establish or defend legal claims	Any relevant data	Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f))	s. 7 legitimate uses (compliance with law)

What we don't do:

We do not use your data for automated decisions that have legal or similarly significant effects.
We do not sell lists.
We do not use the content of your messages to train AI models.

We share personal data only with service providers who process it for us under contract, or where the law requires it.

Recipient	What they do for us	Location
Cloudflare, Inc.	Website hosting, content delivery, security, storing form submissions (Cloudflare D1/KV/R2), access control for our admin console, and transactional email	Global network; USA
Google LLC / Google Ireland	Business email (Google Workspace). With consent: Google Analytics, Google Tag Manager, Google Ads	USA, EU, other
Meta Platforms	With consent only: advertising measurement (Meta Pixel) if we use it	USA, Ireland
Professional advisers, authorities	Lawyers, auditors, courts, regulators or law enforcement, where required by law or to protect our rights	As required
A buyer or successor	If our business is reorganised, merged or sold, under the same protections	—

We do not allow our service providers to use your data for their own purposes, except where you have consented to an advertising partner's cookies (see the Cookie Policy).

5. International transfers

We are based in India, and our providers operate worldwide. Your data may therefore be processed in India, the USA, the EU and other countries.

From the EU/EEA or UK. Where data leaves these regions, we rely on:
- adequacy decisions where they exist (e.g. the EU–US Data Privacy Framework for certified providers);
- otherwise, the European Commission's Standard Contractual Clauses (and the UK Addendum);
- plus supplementary measures such as encryption in transit.
From India. Cross-border transfers are made in line with the DPDP Act and any restrictions the Government of India notifies.

You can ask us for a copy of the safeguards we use.

6. How long we keep it

Data	Kept for
Enquiries that don't lead to a project	24 months from our last contact, then deleted
Enquiries that become a client relationship	For the relationship, then as long as contract, tax and accounting law requires (8 years under Indian accounting rules)
Job applications, including your CV	12 months after the role closes. Longer only if you agree to be considered for future roles.
IP rate-limit counter	60 seconds
Security / server logs (Cloudflare)	Per Cloudflare's standard retention (typically days to weeks)
Analytics data	14 months (the Google Analytics retention setting)
Theme preference	Until you clear your browser storage

When a retention period ends, we delete the data or anonymise it.

India. Under DPDP, we erase your data once its purpose is served or you withdraw consent, unless the law requires us to keep it.

7. Security

We protect personal data with reasonable technical and organisational measures:

HTTPS everywhere;
our admin console is behind single-sign-on access control (Cloudflare Access);
only the people who need access have it;
rate limits and input limits on our forms;
providers with recognised security certifications.

No system is perfectly secure. If a personal data breach affects you, we will notify you and the relevant authorities as the law requires. This includes the Data Protection Board of India under the DPDP Rules and the competent supervisory authority under GDPR, normally within 72 hours of becoming aware of it.

8. Your rights

You can exercise any of these rights by emailing [email protected].

We may need to verify your identity first.
We won't charge you, and we won't treat you differently for using your rights.
We reply within the time the law sets: one month under GDPR, 45 days under CCPA, and within the period in the DPDP Rules, 2025 (at most 90 days).

8.1 Everyone

You can:

ask what data we hold about you and get a copy;
correct or update it;
delete it;
withdraw consent at any time. This is as easy as giving it: use "Cookie settings" in the footer, or email us. Withdrawing consent doesn't affect processing that has already happened;
unsubscribe from any marketing email using the link in it.

8.2 India (DPDP Act, 2023)

As a Data Principal, you have the right to:

a summary of the personal data we process and the processing activities;
the identities of the other Data Fiduciaries and processors we have shared it with;
correction, completion, updating and erasure;
grievance redressal;
nominate another person to exercise your rights if you die or become incapacitated.

How to raise a grievance:

Contact our Grievance Officer first (section 1).
If you're not satisfied with our response, you can complain to the Data Protection Board of India.

You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India.

You also have the right to:

restrict our processing;
object to processing based on legitimate interests. This includes an absolute right to object to direct marketing;
data portability.

You can complain to your local data protection authority. In the UK, that is the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to resolve your concern first.

8.4 United States (California and other states)

Residents of California and other states with comprehensive privacy laws have the following rights:

Know / access: the categories and specific pieces of personal information we collect, the sources, our purposes, and who we disclose it to.
Delete and correct your personal information.
Opt out of "sale" or "sharing" for cross-context behavioural advertising, and of targeted advertising and profiling.
- We do not sell personal information for money.
- If you allow advertising cookies, some US laws may treat that as "sharing" or "targeted advertising".
- You can opt out at any time through "Your privacy choices" / "Cookie settings" in the footer.
Global Privacy Control. We honour Global Privacy Control (GPC) browser signals as a valid opt-out for that browser.
Limit use of sensitive personal information. We don't collect sensitive personal information for inferring characteristics.
Non-discrimination for exercising your rights.
Authorised agents. You may use an authorised agent. We'll need proof that you authorised them.
Appeals. If we decline your request, you can appeal by replying to our decision. If we deny the appeal, you can contact your state Attorney General.

Categories of personal information collected in the last 12 months (CCPA categories):

identifiers (name, email, phone, IP address);
professional or employment information (careers form);
internet or network activity (technical data; analytics with consent);
approximate geolocation (from IP).

We collect these from you, your device, and our service providers. We use them for the purposes in section 3 and disclose them to the recipients in section 4.

We have not knowingly sold, or shared for cross-context behavioural advertising, the personal information of consumers under 16.

Do Not Track. Browsers' "Do Not Track" signals have no agreed standard, so we don't respond to them. We do honour GPC.

9. Children

The Site is a business-to-business service and is not directed at children. We don't knowingly collect personal data from:

anyone under 18 (the DPDP Act treats under-18s as children and requires verifiable parental consent);
children under 16 in the EU/UK, or under 13 in the US (COPPA).

If you think a child has sent us their data, contact us and we will delete it.

10. Links to other sites

The Site links to other websites and to social networks such as LinkedIn. Those sites have their own privacy policies, and we're not responsible for them.

11. Changes to this policy

We'll update this policy when our practices or the law change, and change the "Last updated" date above. If a change is significant, we'll make it prominent on the Site. Where consent is needed, we'll ask for it again.

12. Contact

Digital Obsession Communication Private Limited — Founder & CEO (Privacy / Grievance Officer) B-8, Hartron Complex, Electronic City, Udyog Vihar, Sector 18, Gurugram, Haryana 122015, India Email: [email protected] · Phone: +91 99996 61915