Privacy Policy

1Who we are and what this covers

This Privacy Policy explains how Cortesys Pvt Ltd (“Cortesys”, “we”) collects, uses, shares and protects personal data when you visit cortesys.com (the “Website”) or contact us through it. For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), Cortesys is the Data Fiduciary for the personal data described here. Our registered office is at [Registered office — to be added] (CIN: [CIN — to be added]).

This policy does not cover our marketplaces (PropertyKartz, Freelyns and InfluencerKart) or other third-party websites, which have their own privacy policies.

2Personal data we collect

• Details you give us. Your name, work email address, company, topic and message when you use our contact form; and the details you provide when you make a grievance or data-rights request, including information needed to verify who you are.
• Your choices. A record of your cookie preferences (see the Cookie Policy).
• Email correspondence. If you email us, including through the email window opened by our forms, we receive the content of your message and your email address.
• Technical data. Our hosting provider may automatically log standard technical data — such as IP address, browser type, device, pages requested and date and time — for security and reliability. We do not use analytics or advertising cookies unless you opt in.

We do not ask you to provide sensitive personal data through the Website and we do not knowingly collect personal data of children.

3Why we use personal data

• to respond to your enquiries and provide the information you ask for;
• to handle grievances and requests to exercise your data-protection rights;
• to keep the Website secure, prevent misuse and diagnose faults;
• to record and respect your cookie preferences;
• to improve the Website, using aggregated information and only where you have allowed analytics; and
• to comply with legal obligations and to establish, exercise or defend legal claims.

4Consent and other lawful grounds

Where required, we process personal data only with your consent, given by a clear affirmative action — for example by ticking the consent box on a form. We may also process personal data for the “certain legitimate uses” recognised by the DPDP Act, such as where you voluntarily provide data for a stated purpose and have not indicated that you do not consent to its use for that purpose, or where we must comply with a law or court order.

You may withdraw consent at any time. Withdrawal will be as easy as giving consent: use “Cookie settings” in the footer, our Data Principal Rights page, or email us. Withdrawal does not affect processing carried out before you withdrew, but it may mean we can no longer respond to your request.

5Who we share personal data with

• Service providers that help us operate the Website and handle email, hosting and IT support, bound by written obligations to protect personal data and use it only for our purposes.
• Professional advisers such as lawyers, auditors and insurers where needed.
• Authorities and courts where we are required by law or legal process to disclose it.
• A successor to our business in the event of a merger, acquisition or restructuring, subject to this policy.

We do not sell personal data. We do not share your enquiry with our marketplaces unless that is needed to respond to your request.

6Transfers outside India

Our service providers may store or process personal data on servers located outside India. We do this only as permitted by the DPDP Act and any restrictions notified by the Central Government, and we use contractual and technical safeguards to protect the data.

7How long we keep personal data

We keep personal data only for as long as it is needed for the purposes in this policy or as required by law, and then delete or anonymise it. If you would like to know the retention period that applies to your data, ask us through the Data Principal Rights page.

8Security

We take reasonable security safeguards appropriate to the nature of the personal data we hold, which may include encryption in transit, access controls and confidentiality obligations for people who handle it — in line with Section 43A of the Information Technology Act, 2000, the Reasonable Security Practices and Procedures Rules, 2011 and the DPDP Act. No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as required by law.

9Your rights

Under the DPDP Act you have the right to:

• obtain a summary of the personal data we process about you, the processing activities and the other parties with whom we have shared it;
• request correction, completion or updating of your personal data;
• request erasure of your personal data when it is no longer needed for the purpose for which it was collected or you have withdrawn consent, unless law requires us to keep it;
• have your grievances addressed (see below); and
• nominate another person to exercise your rights if you die or become incapacitated.

To exercise a right, use our Data Principal Rights page. We may need to verify your identity first, and we will respond within the period prescribed by law. If you are not satisfied after using our grievance process, you may approach the Data Protection Board of India as provided under the DPDP Act.

10Children

The Website is intended for businesses and is not directed at children. The DPDP Act treats anyone under 18 as a child and requires verifiable consent of a parent or lawful guardian before processing a child’s personal data. If you believe a child has given us personal data, contact us and we will delete it.

11Visitors outside India

If you are in the European Economic Area, the United Kingdom or another region with its own data-protection law, you may have additional rights — such as access, rectification, erasure, restriction, portability and objection — and the right to complain to your local supervisory authority. Contact us to exercise them. Where such laws apply, our legal bases are your consent, steps taken at your request before a contract, our legitimate interests in running and securing the Website, and legal obligations.

12Cookies and similar technologies

We use only the cookies and similar storage described in our Cookie Policy. The Website serves its own fonts and does not call third-party font or analytics services. If we ever add optional cookies we will ask for your consent first.

13Links to other websites and social media

The Website links to other websites, including our marketplaces, our pages on Facebook, LinkedIn and Instagram, and our review pages on Google, Clutch and Justdial. These are plain links: we do not embed their widgets, buttons or scripts, so they do not receive information from you unless you choose to follow a link. Once you do, that service’s own privacy policy and cookies apply, and we are not responsible for their practices.

14Changes to this policy

We may update this policy from time to time. The version and dates at the top show when it last changed. If a change is material, we will tell you prominently and, where the law requires, ask for your consent again.

15Contact and Grievance Officer

For questions about this policy or to raise a concern about how we handle personal data, contact our Grievance Officer:

Privacy queries: hello@cortesys.com. See also Grievance Redressal.