Privacy

Leapforge Innovations Pvt Ltd, a private limited company incorporated in India, operates this website and decides why and how personal data collected through it is processed. Under the Digital Personal Data Protection Act, 2023 that makes us the Data Fiduciary and you, as the person the data is about, the Data Principal. We are accountable for complying with the Act in respect of everything described on this page, including where processing is carried out by someone on our behalf.

This notice is issued under Section 5 of that Act. It applies to personal data you give us through this website. Work we carry out under a signed engagement is additionally governed by the confidentiality and data-protection terms of that agreement; where those terms give you more protection than this page, those terms apply.

There is exactly one way to give us personal data on this website: the enquiry form on the contact page. Nothing is collected by simply reading a page. When you submit that form we store the following, and nothing else:

• Your name, as you typed it
• Your email address
• Your company name, if you chose to give one — the field is optional
• Your phone number, if you chose to give one — the field is optional
• Which department your enquiry is about, from the dropdown
• The message you wrote
• A randomly generated reference number for the enquiry
• The date and time we received it
• The browser user-agent string your browser sent with the request

Two things on this site touch your IP address, and neither of them keeps it. The enquiry form is rate limited to stop automated abuse: to do that, the server holds your address in memory for ten minutes and counts how many submissions have come from it. It is never written to disk, never added to your enquiry, and is gone when the ten minutes elapse or the server restarts, whichever comes first.

The second is the web server's access log, which every web server keeps in order to serve pages at all. Ours is configured to discard the last part of your address before writing the line, so what lands on disk is a truncated address such as 203.0.113.0 rather than the one your connection actually used. That is done at the web server itself, so the full address is never stored anywhere, even briefly.

The form also contains a hidden field that people never see and automated scripts usually fill in. If it arrives filled in, the submission is discarded. Whatever was typed into that field is never stored.

We think this section matters more than the ones above it, because it is the part most websites get wrong.

This site sets no cookies at all — not necessary ones, not analytics ones, not advertising ones. It stores nothing in your browser's local or session storage. It runs no analytics script, no tag manager, no session recording, no heatmaps, no chat widget and no advertising or conversion pixel. Nothing loads from an external domain when a page opens: no third-party fonts, no maps, no social buttons, and no video. Typefaces are served from our own server.

The practical consequence is that loading a page on this website causes your browser to contact our server and no one else's, so no other company learns that you visited us. We verified this by loading the site in a browser and recording every outbound request: there were none to any host but our own.

We do not build profiles, we do not score or rank visitors, and no automated decision is taken about you.

We do count how many people read which pages, because otherwise we are guessing. That counting is done by reading the truncated access log described above, on our own server, with software we run ourselves. Nothing is added to the page to make it happen: no script, no cookie, no pixel, no identifier. It tells us that a page was read and roughly where in the world from, and it cannot tell us who read it or follow anyone between visits. An earlier version of this page promised that if we ever added analytics it would work exactly this way and that we would say so here first. This is us saying so.

The Academy page lists free courses published by other people on YouTube. We host none of them and we have copied none of them, so the only way to play one here is through YouTube's own player.

That player is not loaded when the page opens. Until you press play on a particular course, nothing on the page has contacted YouTube and YouTube has not been told you are reading it. Pressing play is the moment you choose to load it, and it is the only thing on this entire website that reaches another company's server.

When you do press play we load the video from youtube-nocookie.com, Google's privacy-enhanced player, rather than from the ordinary YouTube domain. It does not set the advertising and profiling cookies the standard player sets. It is still Google's software running in your browser, so from that point Google can see that a video has been played and will apply its own privacy policy to it — we have no control over that, and we would rather tell you plainly than let you discover it.

If you would prefer not to load it at all, every course title on that page is also an ordinary link to the source. Not pressing play costs you nothing here.

We process your enquiry on the basis of your consent, which you give by filling in the form and pressing send. The form tells you what it is for at the point you submit it. We use what you send us to read your enquiry, to reply to it, and — if the conversation goes further — to prepare a proposal, a scope and a contract for the work you have asked about.

That is the whole purpose. We do not use enquiry data for anything else. Specifically: we do not sell it, we do not rent it, we do not trade it, we do not share it with anyone for their marketing, and we do not add you to a mailing list. If we later want to use your details for something you did not ask for, we will ask you first, separately, and a refusal will cost you nothing.

You may withdraw your consent at any time and with the same ease with which you gave it. Email us and say so; you do not have to give a reason. We will stop processing your data and delete it, unless a law requires us to keep a particular record, in which case we will tell you which record and which law.

Withdrawing consent does not make anything we did beforehand unlawful, and it does not affect data we hold under a signed engagement, which is governed by that agreement.

An enquiry that does not lead to an engagement is deleted twenty-four months after the last message between us. We chose that period because business conversations in this industry frequently restart after a year or more, and deleting sooner would mean asking you to explain your situation from the beginning again. If you would rather we did not wait, ask and we will delete it immediately.

Where an enquiry does become an engagement, the associated records become part of that engagement's file. Those are kept for as long as Indian law requires: books of account and their supporting vouchers for eight financial years under Section 128(5) of the Companies Act, 2013; records under Section 36 of the Central Goods and Services Tax Act, 2017 for seventy-two months from the due date of the annual return; and the periods required by the Income-tax Act, 1961. When the longest applicable period expires, the records are destroyed.

Inside the company, only the people who need to read your enquiry in order to answer it. We are a small team and that is a small number of people.

Outside the company, the only party with any access is the provider of the server this website runs on. That access is incidental to hosting rather than a use of your data — an infrastructure provider can technically reach what sits on its machines, which is true of every hosted service. They act as a Data Processor on our instructions and have no right to use your data for their own purposes.

We do not use a third-party CRM, marketing platform or email marketing service for enquiry data. If that changes, we will name the service on this page before we start sending anything to it.

We will disclose personal data to a court, a regulator or a law-enforcement agency where we are legally obliged to, and only to the extent we are obliged to. Where we are permitted to tell you that such a demand has been made, we will.

Enquiries are stored on a server we control and administer, not in a third-party product. Access to that server requires our credentials and is restricted to the people described above.

We do not transfer enquiry data outside India for our own purposes. Should we ever use a service that would involve such a transfer, we will name the service and the country on this page before it starts, and the transfer will be made only to a country not restricted by the Central Government under Section 16 of the DPDP Act.

The site is served over HTTPS, so what you type into the form is encrypted in transit. The server is kept patched, administrative access is restricted and authenticated, and the enquiry store is not reachable from the public internet. The form is validated on the server as well as in your browser, so a malformed or oversized submission cannot be used to attack the store.

Our strongest protection is that we collect very little. There is no password to steal, no payment detail, no identity document and no behavioural profile, because we never asked for any of them.

We do not claim to be unbreachable, because nobody can. If a breach affects your personal data we will report it to the Data Protection Board of India and tell you directly, as Section 8(6) of the DPDP Act requires, describing what happened, what data was involved and what we are doing about it.

Under the DPDP Act you have the following rights over the personal data we hold about you. Exercising any of them is free.

• Access — ask us to confirm what we hold about you, what we have done with it, and who else we have shared it with
• Correction — ask us to correct anything inaccurate, complete anything incomplete, or update anything out of date
• Erasure — ask us to delete it, which we will do unless a law requires us to keep a specific record
• Grievance redressal — complain to us about how we have handled your data, and get an answer
• Nomination — nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself

Write to us at the address given at the foot of this page and say what you want. Please use the same email address you used to contact us, or give us enough detail to find your enquiry, so that we do not hand your data to someone else claiming to be you. We may ask one clarifying question for that reason and no more.

We acknowledge every request within three working days and answer it in full within thirty days. If a request is unusually complex and we need longer, we will tell you inside those thirty days, explain why, and give you a date.

If we have not answered you, or you are unhappy with our answer, you may complain to the Data Protection Board of India. Doing so does not require our permission and does not affect anything else between us.

Section 15 of the DPDP Act places two duties on you that we are required to bring to your attention. Please do not impersonate someone else when giving us your details, and please do not submit a grievance or a rights request that you know to be false or frivolous. The Act provides for a penalty for breaching those duties. This is a statutory notice, not an expectation on our part that anyone reading it would do either.

This site is aimed at businesses and at working professionals, and we do not knowingly collect personal data from anyone under eighteen. We do not track children, we do not advertise, and we run no advertising or behavioural targeting of any kind — so the specific prohibitions in Section 9 of the DPDP Act have nothing to bite on here.

If you believe a child has sent us personal data through this website, tell us and we will delete it.

Where Leapforge Academy runs a programme with a school or college and any participant is under eighteen, the personal data of those participants is handled under the written agreement with that institution, which provides for verifiable parental or guardian consent. It is not collected through this website.

When we change this page we change the date at the top of it. If a change materially affects what we collect, why we collect it, how long we keep it, or who we share it with, we will not apply it retrospectively to data already collected under the previous version without asking you first.

Every version of this page is kept. If you want to see the wording that applied on the day you contacted us, ask and we will send it to you.