Privacy policy

Who we are

This website is run by Onfocus Software Private Limited (CIN U72900TG2022PTC168752), a company registered in India, trading as Onfocus (“Onfocus”, “we”, “us”). We decide how personal data from this website is used, which makes us the data fiduciary under Indian law and the controller under the UK and EU GDPR.

Office: G Square Building, Raidurgam, Gachibowli, Hyderabad, Telangana 500032, India. We also have offices in Dublin, Ohio, United States and Preston, United Kingdom. For anything about this policy, email team@onfocussoft.com.

What we collect and why

When you use the contact form

• What: your name, email address, company (optional), the topic you choose and your message.
• Why: to read and reply to your enquiry and, if you ask us to, to discuss and prepare a proposal or work with you.
• Legal basis: in India, you give this data voluntarily for that purpose (DPDP Act, section 7(a)), and you can tell us at any time to stop using it. Under the UK and EU GDPR, our legitimate interest in answering the people who contact us and, where you are asking about working together, steps taken at your request before entering a contract.
• Giving us these details is optional, but we need a name, email address and message to reply. You can also simply email us.

When you email us

We receive whatever you put in your email, including your email address and signature, and use it in the same way as a form enquiry.

When you visit any page

• What: technical data that every web request carries: IP address, browser and device type, the page requested, the referring page and the time.
• Why: to deliver pages, keep the site secure, prevent abuse and fix faults. We do not use it to build a profile of you.
• Legal basis: our legitimate interest in running a secure website, and the reasonable purposes the DPDP Act allows for keeping systems secure.

We do not ask for sensitive data such as health, financial, biometric or government ID details. Please do not send them through the form. We do not make automated decisions about you, and we do not sell your data.

Cookies and tracking

This website sets no cookies and uses no analytics, advertising pixels, social media trackers or fingerprinting. Fonts and scripts are served from our own domain, so visiting a page does not send your data to third parties such as Google Fonts. Because nothing tracks you, there is nothing to opt out of, and we treat Global Privacy Control and “Do Not Track” signals as already respected.

If we ever add cookies or analytics that are not strictly necessary, we will update this policy first and, where the law requires it, ask for your consent before setting them.

Who we share it with

We share personal data only with service providers that process it on our behalf and under contract:

• Vercel Inc. (United States): hosts this website and keeps request logs.
• Resend (United States, sending from data centres in Japan): delivers form messages to our inbox.
• Google LLC (Google Workspace): hosts our company email, where enquiries are stored.

Within Onfocus, enquiries are read by the people who need to reply, which may include colleagues in our India, US and UK offices. We may also disclose data where the law requires it, to protect our legal rights, or as part of a sale or reorganisation of our business, in which case this policy continues to apply. We never sell personal data or share it for cross-context behavioural advertising.

International transfers

Our providers process data outside the country you may be in, including in the United States, Japan and India. Where UK or EU law applies, we rely on adequacy regulations or decisions (including the EU–US Data Privacy Framework and its UK extension, where a provider is certified) or on standard contractual clauses and the UK International Data Transfer Addendum, together with the providers’ security measures. Transfers out of India follow the DPDP Act and any restrictions the Government of India notifies. You can ask us for more detail on these safeguards.

How long we keep it

• Enquiries: up to 24 months after our last contact with you, then deleted. If you become a client, we keep the related correspondence for as long as the contract and our legal and tax obligations require.
• Delivery records held by our email provider: for the short period its service keeps them, usually days.
• Website request logs: for the short period our host keeps them, usually days, unless we need them longer to investigate a security incident.

If you ask us to delete your data sooner, we will, unless the law requires us to keep it.

Security

The site is served only over encrypted HTTPS with strict transport security. Our email is sent with domain authentication (DKIM, SPF and DMARC), and access to our inbox and hosting accounts is limited to the people who need it. No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant regulators as the law requires: in India, the Data Protection Board; in the UK, the ICO within 72 hours where required.

Your rights

Wherever you are, you can ask us to:

• tell you what personal data we hold about you, how we use it and who we have shared it with;
• correct, complete or update it;
• delete it;
• stop using it, which for an enquiry also withdraws your consent under Indian law;
• give you a copy in a portable format.

In the UK and EU you can also object to processing based on our legitimate interests and ask us to restrict processing. In India you can nominate another person to exercise your rights if you die or become unable to. US residents can exercise the rights their state law gives them, and we will not treat you differently for doing so.

To make a request, email team@onfocussoft.com or use our contact form and choose “Something else”. We may need to confirm your identity first. We reply within one month (UK and EU), 45 days (US states) and at most 90 days (India), and sooner where we can. Requests are free.

Questions and complaints

Please tell us first if you are unhappy with how we have handled your data, and we will try to put it right. Email team@onfocussoft.com with “Privacy complaint” in the subject, or use the contact form. Our Grievance Officer handles every complaint: we acknowledge it within 30 days, tell you what we are doing about it and give you our outcome without undue delay.

You can also complain to a regulator:

• India: the Data Protection Board of India, once you have used our grievance process.
• United Kingdom: the Information Commissioner’s Office (ico.org.uk).
• European Union: the data protection authority in the country where you live or work.
• United States: your state attorney general or privacy agency, such as the California Privacy Protection Agency.

Country-specific information

India

This policy is our notice under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and our privacy policy under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Grievance Officer: Onfocus Software Private Limited, G Square Building, Raidurgam, Gachibowli, Hyderabad, Telangana 500032; team@onfocussoft.com.

United Kingdom and European Union

This policy gives the information required by Articles 13 and 14 of the UK GDPR and EU GDPR. Our complaints process above follows the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025.

United States

In the last 12 months we have collected these categories of personal information, only for the purposes described above: identifiers and contact details (name, email address, company) and internet or network activity (request logs). We collect them from you directly and from your browser. We have not sold or shared personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information. This policy is also our notice under the California Online Privacy Protection Act. If you use an authorised agent, we may ask for proof that you authorised them.

Children

This website is meant for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their details, email us and we will delete them.

Changes to this policy

We will update this page when our practices change and show the new effective date at the top. If a change materially affects how we use data we already hold, we will tell the people affected before it applies.