Privacy Policy
1. Introduction
INK IT Solutions (‘we’, ‘us’, or ‘our’) is committed to protecting and respecting your privacy. This Privacy Policy explains who we are, how we collect, share, and use personal information about you in connection with our website at www.inkitsolutions.com(the ‘Website’), and how you can exercise your privacy rights.
This Privacy Policy applies to personal data we collect when you interact with the Website. Different policies apply to personal data we collect in other contexts, including in our capacity as employer and as service provider to our customers.
This Policy is published in compliance with the European Union General Data Protection Regulation 2016/679 (‘GDPR’), the Indian Digital Personal Data Protection Act 2023 read with the Digital Personal Data Protection Rules 2025 (‘DPDPA’), the Kingdom of Saudi Arabia Personal Data Protection Law issued under Royal Decree M/19 of 2021 with its Implementing Regulations (‘KSA PDPL’), and the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data with its Executive Regulations (‘UAE PDPL’).
2. Who We Are
INK IT Solutions is a company incorporated in India with its registered office at [registered address]. We are the controller (and, under DPDPA, the Data Fiduciary; under KSA PDPL, the Controller; under UAE PDPL, the Controller) responsible for personal data collected through the Website.
Privacy contact: [[email protected]].
Grievance Officer (for DPDPA matters): [Kaustubh Shakkarwar], [External DPO], [[email protected]].
Data Protection Officer (where required): [Kaustubh Shakkarwar, [email protected]].
3. What Personal Data We Collect
Depending on how you interact with the Website, we may collect the following categories of personal data:
- Identification and contact data — name, email address, telephone number, postal address, company name, job title — when you complete a contact form, request information, or apply for a role.
- Recruitment data — CV, work history, qualifications, references, eligibility-to-work data — when you submit an application through the careers page.
- Technical data — IP address, browser type and version, operating system, device identifiers, referring website, pages visited, and time and date of visit — collected through cookies and analytics technologies.
- Marketing preferences — subscriptions to our newsletter or marketing communications, and your preferences regarding the receipt of those communications.
- Correspondence — content of correspondence you send to us through the Website or in response to materials served from the Website.
We do not knowingly collect special categories of personal data through the Website. If you provide such information voluntarily (for example, in a CV that includes sensitive information), we will process it only to the extent necessary for the purpose for which you submitted it.
4. How We Collect Personal Data
We collect personal data directly from you when you choose to interact with the Website — by submitting a form, applying for a role, or subscribing to a list. We collect technical data automatically through cookies and similar technologies, as described in our Cookie Policy at www.inkitsolutions.com/cookies-policy.
We do not buy personal data from third-party data brokers for the purposes of the Website. Personal data we hold about you that originates outside the Website (for example, where we contact you on a business basis) is governed by separate notices issued at the point of collection.
5. Purposes for Which We Use Personal Data
We use personal data for the following purposes:
- To respond to enquiries, you submit them through the Website.
- To consider applications for employment with INK IT Solutions and, where you are unsuccessful, to retain your application for a defined period in case suitable roles arise.
- To send you marketing communications you have subscribed to, including our newsletter, product updates, and event invitations.
- To operate, maintain, and improve the Website — analytics, performance monitoring, security, and fraud prevention.
- To comply with legal, regulatory, and audit obligations.
To establish, exercise, or defend legal claims.
6. Lawful Basis for Processing
The lawful basis on which we process your personal data depends on the regime that applies to you. The table below summarizes the position by category of processing and by regime.
| Right | GDPR (EU) | DPDPA (India) | KSA PDPL | KSA PDPL UAE PDPL |
|---|---|---|---|---|
| Responding to enquiries | Legitimate interests (Article 6(1)(f)) | Legitimate use — Section 7 / consent (Section 6) | Legitimate interests — Article 6(1) | Performance of contract / consent — Article 4(1) |
| Recruitment processing | Pre-contractual step / consent | Legitimate use — Section 7(i) / consent | Performance of contract / consent | Performance of contract / consent |
| Marketing communications | Consent (Article 6(1)(a)) | Consent (Section 6) | Consent (Article 6(1)) | Consent (Article 4(1)(a)) |
| Website analytics & performance | Legitimate interests / consent for non-essential cookies | Consent (Section 6) / legitimate use | Consent for non-essential cookies | Consent for non-essential processing |
| Legal & regulatory | Legal obligation | Legitimate use | Legal obligation | Legal obligation |
| compliance | (Article 6(1)(c)) | Section 7 | - | - |
7. Notice under Section 5 of the DPDPA (India)
DPDPA SECTION 5 NOTICE — INDIA ONLY
This section is the notice contemplated by Section 5 of the Digital Personal Data Protection Act 2023 and Rule 3 of the Digital Personal Data Protection Rules 2025. If you are a Data Principal under the DPDPA, the following itemised disclosures apply to the processing of your personal data by INK IT Solutions through the Website. This notice is also available in the languages set out in the Eighth Schedule to the Constitution of India on request to [email protected].
We provide the following notice to you in accordance with the DPDPA:
- Personal data we process: identification and contact data, recruitment data, technical data, marketing preferences, and correspondence, as described in Section 3 above.
- Purpose of processing: the purposes set out in Section 5 above, namely enquiry response, recruitment, marketing, website operations, legal compliance, and legal claims.
- Manner in which you can exercise your rights: by writing to [email protected], or through the rights request form on www.inkitsolutions.com. We will acknowledge your request within seventy-two (72) hours and respond within a reasonable period as required by the DPDPA.
- Manner in which you can make a complaint to the Data Protection Board of India: you have the right to make a complaint to the Data Protection Board of India established under Section 18 of the DPDPA. Information on how to do so will be available from the Board’s website once published.
By using the Website and providing personal data through it, where the lawful basis for processing is your consent, you indicate your free, specific, informed, unconditional, and unambiguous consent through clear affirmative action for the processing described in this notice.
You may withdraw your consent at any time by writing to [email protected]. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal.
8. Cookies and Similar Technologies
The Website uses cookies and similar technologies for analytics, performance, functionality, and where applicable advertising. Detailed information about the cookies we use, their purposes, and how you can manage your preferences is set out in our Cookie Policy at www.inkitsolutions.com/cookies-policy.
9. Who We Share Personal Data With
We share personal data with third parties only where necessary for the purposes described in this Policy and on the basis of appropriate safeguards. The categories of recipient are:
- Service providers acting as processors on our behalf — including providers of website hosting, email delivery, recruitment systems, customer relationship management, and analytics. Each is bound by a data processing agreement that incorporates the technical and organisational measures INK IT Solutions requires.
- Professional advisers — lawyers, accountants, auditors, and consultants — where engaged to provide professional services to INK IT Solutions.
- Public authorities and regulators — where disclosure is required by law or in response to a binding legal request.
- Successor entities — in the event of a merger, acquisition, restructuring, or similar transaction involving the relevant part of our business.
We do not sell personal data. We do not share personal data with third parties for their own marketing purposes without your consent.
10. International Transfers
Some of the service providers we use are located outside India, the European Economic Area, the Kingdom of Saudi Arabia, or the United Arab Emirates (as applicable). Where personal data is transferred internationally, we put in place appropriate safeguards:
- For transfers from the European Economic Area: the European Commission’s Standard Contractual Clauses with supplementary measures as required.
- For transfers from India: transfers to countries other than those notified as restricted under Section 16 of the DPDPA, subject to the conditions of the DPDPA and the DPDP Rules 2025.
- For transfers from the Kingdom of Saudi Arabia: transfer in compliance with Article 29 of the KSA PDPL and the Implementing Regulations.
- For transfers from the United Arab Emirates: transfer in compliance with Articles 22 and 23 of the UAE PDPL and the Executive Regulations.
You may request details of the safeguards in place by writing to [email protected].
11. How Long We Keep Personal Data
We retain personal data for as long as necessary for the purpose for which it was collected, and thereafter for any period required by law or by the establishment, exercise, or defence of legal claims. Specific retention periods include:
- Enquiry correspondence — twenty-four (24) months from the date of last contact, unless a longer period is required.
- Recruitment data — six (6) months from the date the application is declined, unless you consent to retention for a longer period for consideration for future roles.
- Website analytics — as set out in the Cookie Policy.
- Records required for legal or regulatory compliance — for the periods required by applicable law.
12. Security
We have implemented appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These include encryption in transit, access controls and identity management, sensitivity labelling and data loss prevention, logging and monitoring, vendor security review, and staff training. The measures are calculated to GDPR Article 32, DPDPA Section 8(5) and Rule 6, KSA PDPL Article 30, and UAE PDPL Article 12.
13. Your Rights
Subject to the conditions and exemptions under the regime that applies to you, you have rights with respect to your personal data. The following summary describes those rights:
| Right | GDPR | DPDPA | KSA PDPL | UAE PDPL |
|---|---|---|---|---|
| Access | Article 15 | Section 11 | Article 4(1) | Article 13(c) |
| Correction / rectification | Article 16 | Section 12 | Article 4(2) | Article 14 |
| Erasure | Article 17 | Section 12 | Article 4(2) | Article 15 |
| Restriction / cessation | Article 18 | - | Article 4(2) | Article 15 |
| Portability | Article 20 | - | Article 4(3) | Article 16 |
| Object / withdraw consent | Article 21 / 7(3) | Section 6(4) | Article 6 | Article 4(2) |
| Grievance redressal | - | Section 13 | - | - |
| Complain to authority | Article 77 | Section 14 | Article 18 | Article 26 |
14. How to Exercise Your Rights
To exercise any of the rights summarized above, please write to [email protected] or use the rights request form at www.inkitsolutions.com. We will acknowledge your request within seventy-two (72) hours and respond within the statutory clock that applies to you — thirty (30) days under GDPR, KSA PDPL, and UAE PDPL; a reasonable period under DPDPA.
We may need to verify your identity before processing your request. We will request only the minimum information required to confirm that you are who you say you are.
\If you are unsatisfied with our response, you may bring the matter to the Grievance Officer (DPDPA) or lodge a complaint with the supervisory authority in your jurisdiction.
15. Children’s Data
The Website is not directed at children. Under the DPDPA, a ‘child’ is a person below 18 years of age and processing of personal data of a child requires the verifiable consent of a parent or lawful guardian. Under GDPR the threshold is 16 years (lower in some Member States). We do not knowingly process personal data of children through the Website. If you believe a child has provided personal data through the Website, please contact us [email protected] and we will take appropriate steps to delete it.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through a prominent notice on the Website prior to the change taking effect. The ‘Effective date’ at the top of this Policy indicates when it was last revised.
17. Contact and Complaints
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:
Privacy contact: [[email protected]].
Grievance Officer (for DPDPA matters): [Kaustubh Shakkarwar], [External DPO], [[email protected]].
Data Protection Officer (where required): [Kaustubh Shakkarwar, [email protected]].
If you are not satisfied with our response, you may complain to: the Data Protection Board of India (DPDPA); the supervisory authority in the EU Member State of your habitual residence (GDPR); the Saudi Data and Artificial Intelligence Authority (SDAIA) (KSA PDPL); or the UAE Data Office (UAE PDPL).