This policy explains how Eyednext Pvt Ltd ("Eyednext", "we", "us") handles personal data when you visit eyednext.in, use our forms or chat assistant, apply for a job, join our newsletter, or contact us. It is written to meet India's Digital Personal Data Protection Act 2023 and the Information Technology Act 2000 and its rules. It also covers the privacy laws of other countries where we have clients, including the UK GDPR, the EU GDPR (Malta), the UAE Personal Data Protection Law, the Australian Privacy Act 1988 and Canada's PIPEDA.
When we work on a project for a client, we may handle personal data on that client's behalf, such as their customers' details in a website or app we build. In that case the client decides how that data is used, and their own privacy policy applies. This policy covers only the data we control ourselves.
1. The short version
- We collect only what you give us through our forms, chat, email, phone or WhatsApp, plus limited technical data that keeps the site working and secure.
- We use it to reply to you, quote for and deliver our services, run the Academy, consider job applications, and send the newsletter if you ask for it.
- We do not sell or rent personal data. We do not use advertising cookies or share your data for targeted advertising. We use Google Analytics only if you click Accept on our cookie banner.
- A small number of service providers (hosting, email, spam protection and the AI behind our chat) process data for us under contract.
- You can ask to see, correct or delete your data at any time by emailing info@eyednext.in.
2. Who we are
Eyednext Pvt Ltd is the data controller (the "Data Fiduciary" under Indian law) for the personal data described in this policy.
- Address: 1st floor 272-3, near St George Basilica church, Angamaly, Kerala 683572, India
- Email: info@eyednext.in
- Phone: +91 6238 020 656 / +91 73066 67385
- Grievance Officer: Ajith, Founder & CEO, at the email and address above. The Grievance Officer handles privacy questions, requests and complaints (see section 17).
3. What we collect and why
We collect only the data we need for each purpose below. Fields marked as required on our forms are needed to deal with your request; everything else is optional.
| When | What we collect | Why we use it |
|---|---|---|
| You send an enquiry or ask for a quote | Name, phone / WhatsApp number, email (optional), the service you're interested in, your message | To reply, discuss your needs, prepare a quote, and deliver and invoice any work you agree to |
| You enquire about an Academy course | As above, plus the course and preferred batch | To answer your questions about the course, and to arrange admission if you decide to join |
| You use the chat assistant | Your messages, the assistant's replies and the page you were on. If you choose "talk to a person": your name, phone and email (optional) | To answer your questions, pass your request to our team, and improve the answers the assistant gives |
| You apply for a job | Name, email, phone, portfolio link, cover message, CV and anything in it, the role you applied for | To assess your application, contact you about it and, if you agree, consider you for future roles |
| You join the newsletter | Email address, the page you signed up on, and when you confirmed or unsubscribed | To send the newsletter you asked for and prove that you asked for it |
| You email, call or WhatsApp us | Your contact details and what you send us | To reply and keep a record of what was agreed |
| You become a client | Contact details of you and your team, billing details, contracts, project files and correspondence | To deliver the services, invoice, keep accounts and meet tax and legal obligations |
| Automatically, whenever you use the site or send a form | IP address, browser and device type, pages requested, date and time; for forms and chat also your approximate country (from our network provider or your phone's dialling code), the first page you landed on, the website that referred you, and any campaign tags in the link (UTM codes) | To run and secure the site, stop spam and abuse, fix errors, and understand which pages and campaigns bring enquiries |
Please do not send us sensitive information such as health details, financial account numbers, government ID numbers or passwords through our forms or chat. We don't ask for it and don't need it. If your CV contains more than you want to share (for example your date of birth, a photo or religion), you are welcome to remove it before applying.
4. Our legal grounds
India (DPDP Act). We process personal data you voluntarily give us for the purpose you gave it for, such as answering your enquiry (a "legitimate use" under section 7(a)). We process some data on the basis of your consent: newsletter subscriptions, job applications, and anything else where we ask for consent. We may also process data to comply with law, court orders and legal claims.
UK and EU (GDPR). We rely on:
- Steps before a contract, and performing a contract: quotes, client work, Academy admission, and assessing job applications.
- Legitimate interests: replying to enquiries and chats, keeping the site secure, preventing spam and fraud, understanding which pages and campaigns bring enquiries, and defending legal claims. We have weighed these interests against your rights. You can object at any time (see section 11).
- Consent: the newsletter, keeping your CV for future roles, Google Analytics cookies, and loading the Google map on our contact page. You can withdraw consent at any time. This does not affect anything done before you withdrew it.
- Legal obligation: keeping accounting and tax records, and responding to lawful requests from authorities.
5. Cookies and similar technologies
The cookies our site needs to work are always on. Google Analytics cookies are set only if you click Accept on our cookie banner. Until then Google Analytics is not loaded at all. You can change your choice at any time with "Cookie settings" at the bottom of every page. We do not use advertising or social-media tracking cookies.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
eyednext-session | Eyednext | Keeps your session so forms work and chat replies stay in one conversation. It also remembers where you arrived from (landing page, referrer, campaign tags) so that an enquiry is attributed to the right source. | 2 hours of inactivity |
XSRF-TOKEN | Eyednext | Security: stops other sites from submitting forms in your name | 2 hours |
cookie_consent | Eyednext | Remembers whether you accepted or rejected analytics cookies, so we don't ask on every page | 12 months |
_ga, _ga_* | Only if you accept analytics. Google Analytics uses them to count visits and see which pages and campaigns are useful, without telling us who you are. We don't use this data for advertising. | Up to 2 years | |
| Cloudflare Turnstile | Cloudflare | When switched on, an "I'm human" check on our forms. It reads browser and device signals to tell people from bots. It is not used for advertising. | Session |
| Google Maps | Only if you click "Load map" on the contact page. Google may then set its own cookies and receive your IP address under Google's privacy policy. | Set by Google |
Links to WhatsApp, Facebook, Instagram, LinkedIn and YouTube are ordinary links. Nothing from those services loads until you click them.
6. The chat assistant
The chat window is an automated AI assistant, not a person, and is labelled as one. Depending on the question, answers come either from fixed rules we wrote or from an AI language model hosted by Groq, Inc. (USA). The AI is instructed to answer only from the information on this website.
- Your messages and the conversation so far are sent to Groq to produce a reply. Under its terms, Groq may not use that data to train AI models. It keeps the data only as needed to provide the service, and at most for a short period for abuse and reliability checks.
- We store chat transcripts so our team can follow up and improve the answers.
- The assistant can make mistakes. Prices, timelines and commitments are binding only when confirmed by a person in writing (see our Terms).
- Please don't type sensitive personal information into the chat.
7. Who we share data with
We never sell or rent personal data. We share it only as follows:
| Recipient | What for |
|---|---|
| Hostinger (web hosting) | Stores the website, database and uploaded files, including CVs |
| Our email providers | Sending form confirmations and newsletters, and receiving and storing our business email |
| Cloudflare, Inc. | The "I'm human" check on forms and, where used, network security |
| Groq, Inc. | Generating chat assistant replies (see section 6) |
| Google LLC | Google Analytics, if you accept analytics cookies (pages visited, device and browser type, approximate location and how you arrived), and the map, if you load it on our contact page |
| Meta (WhatsApp) | Only if you choose to message us on WhatsApp, under WhatsApp's own terms |
| Our team and trusted partners | Eyednext staff who need the data for their job. Where a project uses a partner we name on this site (for example a technology partner on a larger build), we share only what that project needs, and only after telling you. |
| Professional advisers | Accountants, auditors and lawyers, under a duty of confidentiality |
| Authorities | Police, courts, regulators or tax authorities, when the law requires it or to protect rights, safety or property |
| A buyer or successor | If our business is sold, merged or restructured, the new owner may receive data and must keep this policy's protections |
Service providers act on our instructions under contracts that require them to keep the data secure and confidential and to use it only to provide their service to us. This is required by section 8(2) of the DPDP Act and Article 28 GDPR.
8. International transfers
We are based in India, and some of our service providers are in other countries, including the United States. Your data may therefore be processed outside the country you live in. Whenever we transfer data, we make sure it stays protected as your local law requires. For data from the UK or EU, this means using approved safeguards such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, which our providers build into their terms. Indian law allows these transfers except to countries the Government has restricted, and we will not send data to any such country. You can ask us for details of the safeguards used.
9. How long we keep data
We keep personal data only as long as we need it for the purpose it was collected for, or as the law requires. After that we delete it or make it anonymous.
| Data | How long |
|---|---|
| Enquiries and chat leads that don't become projects | 24 months after our last contact with you |
| Chat transcripts not linked to an enquiry | 12 months |
| Form submissions filtered as spam | 90 days |
| Client records: contracts, invoices and project correspondence | For the engagement, then 8 years, as required by Indian company and tax law |
| Job applications and CVs | 12 months after we decide on the role, unless you ask us to delete them sooner. If we hire you, they become part of your employment record. |
| Newsletter | Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. After you unsubscribe, we keep only your email address and the date, so that we never email you again. |
| Google Analytics data (only if you accepted) | At most 14 months, then deleted by Google |
| Security and server logs, including IP addresses | 1 year (the minimum Indian law requires for security logs), then deleted |
We may keep data longer if we need it for a legal claim or investigation, or if the law requires it.
10. How we protect data
We use reasonable security safeguards suited to the data we hold, including:
- encrypted connections (HTTPS) across the whole site;
- admin access limited to authorised staff, with passwords plus mandatory two-factor authentication;
- CVs stored in private storage under random file names, never publicly reachable and downloadable only by signed-in admins;
- spam filters, rate limits and form security tokens;
- limiting who can see what, and deleting data on the schedule above.
No system is completely secure. If a personal data breach happens, we will act quickly to contain it. We will notify the affected people and the relevant authorities where the law requires, including the Data Protection Board of India and, for UK or EU data, the regulator within 72 hours where that applies.
11. Your rights
Wherever you live, you can ask us to:
- access the personal data we hold about you, how we use it, and who we have shared it with;
- correct, complete or update data that is wrong or out of date;
- delete your data, unless we must keep it by law;
- withdraw consent you gave, as easily as you gave it (newsletters have a one-click unsubscribe link);
- object to, or ask us to restrict, how we use your data, and receive data you gave us in a portable format (UK/EU);
- nominate someone to exercise your rights if you die or become unable to (India);
- complain to us, and to a regulator (see section 17).
To make a request, email info@eyednext.in or write to us at the address above. We may need to check your identity first. There is no charge, unless a request is plainly unfounded or excessive. We will reply within one month. If a request is complex we may take up to two more months, and we will tell you why. We will not treat you differently for exercising your rights.
12. Extra information for your country
India
You have the rights in sections 11 to 14 of the DPDP Act. If you are not satisfied with our Grievance Officer's response, you can complain to the Data Protection Board of India. We will resolve grievances as quickly as possible, and within 90 days at most. Until the relevant parts of the DPDP Act come into force, we also follow the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.
United Kingdom
You can complain to us about how we handle your data. We will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner's Office (ico.org.uk).
European Union, including Malta
You can complain to the data protection authority in the EU country where you live or work, or where you think the problem happened. In Malta this is the Information and Data Protection Commissioner (idpc.org.mt).
United Arab Emirates
You have the rights set out in Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, including access, correction, erasure, restriction and objection. You can complain to the UAE Data Office.
Australia
We handle personal information in line with the Australian Privacy Principles. You can access and correct your information as described above. If you are not satisfied with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au). Overseas recipients of data are described in sections 7 and 8.
United States
We do not sell personal information and do not "share" it for cross-context behavioural advertising, as those terms are used in US state privacy laws. We do not knowingly collect data from children under 13. You can make any of the requests in section 11, and we will honour them where the law of your state gives you that right.
Canada
We follow the principles of PIPEDA. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
13. Children
This website is meant for adults and businesses. Under Indian law, anyone under 18 is a child. If you are under 18, please ask a parent or guardian to contact us for you, including about Academy courses. We need a parent or guardian's verifiable consent before we process a child's data for admission. We do not track children or target advertising at them. If you believe a child has sent us personal data without that consent, tell us and we will delete it.
14. Marketing emails
We send the newsletter only to people who sign up and then confirm by clicking the link in our confirmation email. Every newsletter has an unsubscribe link, and you can also email us to stop. We do not send marketing by SMS or WhatsApp unless you have asked us to. We do not buy email lists.
15. Automated decisions
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Two automated tools are in use:
- Our spam filter checks form submissions for signs of bots, such as forms sent too fast or messages full of links. Flagged messages go into a separate folder that our team can review, rather than being deleted straight away.
- The chat assistant writes answers automatically (see section 6). It cannot accept or reject you for anything.
16. Changes to this policy
We will update this policy when our practices or the law change. The "last updated" date at the top will change. If we make a significant change, such as using your data for a new purpose, we will tell you by email where we can, and ask for your consent where the law requires it.
17. Contact and complaints
For any privacy question, request or complaint, contact our Grievance Officer:
Ajith, Founder & CEO, Eyednext Pvt Ltd
1st floor 272-3, near St George Basilica church, Angamaly, Kerala 683572, India
Email: info@eyednext.in · Phone: +91 6238 020 656 / +91 73066 67385
Please put "Privacy" in the subject line. If you are not satisfied with our answer, you can go to the regulator for your country, listed in section 12.
