Privacy Policy

1. Introduction

Thalenor respects the privacy of individuals whose personal information we process.

This Privacy Policy explains how Dev Asheesh Chopra, a sole proprietor carrying on business under the name “Thalenor” (“Thalenor”, “we”, “us” or “our”) collects, receives, uses, stores, shares, transfers, secures and otherwise processes personal information.

It also explains the rights and choices that may be available to individuals under applicable privacy and data-protection laws.

Thalenor is an AI, automation and software engineering studio based in Punjab, India. We provide and intend to provide services to clients in India and internationally, including clients and prospective clients in the United Kingdom, Australia, Canada, Europe, the United States and other jurisdictions.

Our principal business address is:

Thalenor
Proprietor: Dev Asheesh Chopra
B-19/18, Fatehgarh Rd, opposite Narad Hospital
Darapur Colony, Hoshiarpur, Punjab 146001
India

Website: https://www.thalenor.com
Email: contact@thalenor.com

For privacy enquiries, requests and complaints, please contact us at contact@thalenor.com.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information that Thalenor processes in connection with:

• our website and webpages;
• project enquiry forms;
• contact forms;
• email communications;
• telephone and video calls;
• WhatsApp and other messaging communications;
• professional networking platforms;
• prospective-client discussions;
• sales and business-development activity;
• proposals and quotations;
• client onboarding;
• software-development engagements;
• AI and automation projects;
• maintenance and support;
• invoicing and payments;
• recruitment and contractor enquiries;
• supplier and business-partner relationships;
• meetings and events;
• website analytics, security and infrastructure; and
• other professional interactions with Thalenor.

This Privacy Policy primarily describes Thalenor's own privacy practices.

Individual client engagements may also be subject to contracts such as a Master Services Agreement, Statement of Work, Non-Disclosure Agreement or Data Processing Addendum.

Where a separate written agreement contains specific privacy or data-processing obligations relating to a project, that agreement will apply to that engagement to the extent provided in the agreement.

3. The Different Roles Thalenor May Have

Because we build and maintain software and AI systems for other organisations, our legal role may differ depending on the processing concerned.

3.1 When Thalenor Determines the Purpose of Processing

For activities such as:

• operating our website;
• responding to enquiries;
• managing prospective clients;
• maintaining client relationships;
• issuing invoices;
• maintaining business records;
• recruitment;
• security;
• permitted marketing; and
• running our own business,

Thalenor generally determines why and how personal information is processed.

Depending upon the applicable law, Thalenor may therefore be described as a:

• Data Fiduciary under applicable Indian data-protection law;
• controller under the UK GDPR or EU GDPR;
• organisation under Canadian privacy law;
• APP entity where the Australian Privacy Act applies; or
• another equivalent term under applicable legislation.

3.2 When Thalenor Processes Data for a Client

Our clients may ask us to design, develop, host, integrate, test, maintain or support software that contains personal information relating to:

• customers;
• employees;
• patients;
• students;
• suppliers;
• contractors;
• website users;
• members;
• residents; or
• other individuals.

Where the client determines the purpose and essential means of processing and Thalenor processes information on its instructions, Thalenor will generally act as a Data Processor, processor, service provider or contractor rather than as the organisation principally responsible for determining the processing.

The client's privacy notice will normally govern its relationship with the affected individuals.

Such processing may also be governed by a Data Processing Addendum or other contractual terms between Thalenor and the client.

If you wish to exercise privacy rights relating to information held by one of our clients through a system that Thalenor developed or maintains, you should ordinarily contact that client first.

We may assist the client where required by contract or law.

4. Personal Information We May Collect

The information we collect depends on how you interact with Thalenor.

4.1 Identity and Contact Information

This may include:

• name;
• professional title;
• organisation or business name;
• business address;
• email address;
• telephone or mobile number;
• country or region;
• professional profile information; and
• preferred method of communication.

4.2 Project Enquiry Information

If you enquire about a project, we may process information including:

• your organisation;
• industry;
• business requirements;
• current systems;
• proposed software;
• project objectives;
• workflows;
• technical requirements;
• desired integrations;
• proposed users;
• approximate budget;
• timeline;
• screenshots;
• technical documentation;
• example files;
• sample data; and
• other information you voluntarily provide.

Please do not send passwords, private keys, API secrets, banking credentials, production databases, medical records or other highly sensitive material through an ordinary website contact form.

If sensitive information is necessary for a proposed engagement, we may arrange an appropriate method for exchanging it.

5. Communications

When you communicate with us, we may process the content and associated metadata of communications through channels such as:

• email;
• telephone;
• WhatsApp;
• video conferencing;
• LinkedIn;
• contact forms;
• collaborative platforms; and
• other business communication channels.

Information may include:

• sender and recipient;
• date and time;
• telephone number;
• email address;
• correspondence;
• attachments;
• meeting notes; and
• related communication records.

Third-party communication providers may separately process your information under their own privacy terms.

6. Business and Transaction Information

For clients, suppliers, contractors and other business partners, we may process:

• contractual details;
• billing details;
• invoice details;
• transaction references;
• payment status;
• purchase orders;
• tax-related information;
• bank information where required for payments;
• correspondence regarding accounts;
• project records; and
• other administrative information.

Payment transactions may be processed through banks, payment providers or other financial institutions.

We do not ordinarily intend to store complete payment-card credentials ourselves.

7. Website and Device Information

When you access our website, information may automatically be generated or processed including:

• IP address;
• approximate geographical region derived from an IP address;
• browser;
• operating system;
• device type;
• referring page;
• requested URL;
• access time;
• session information;
• network information;
• server logs;
• request information;
• error information;
• security events; and
• similar technical information.

Such information may be processed by us or our infrastructure providers to operate, secure, monitor and improve the website.

8. Our Technology Providers

Our current technical environment may include services provided by:

Vercel

We use or may use Vercel for website deployment, hosting, content delivery, infrastructure and related technical functions.

Vercel may process technical information necessary to deliver our website, including requests, IP-related information, logs and other infrastructure information.

Google

We use or may use Google services including:

• Firebase;
• Google Sheets; and
• Gemini.

Depending on the particular function, Google services may be used for:

• databases;
• application infrastructure;
• authentication;
• storage;
• internal business records;
• structured information;
• project workflows;
• AI processing; and
• related services.

OpenAI

We may use services supplied by OpenAI, including APIs or AI tools, for appropriate internal or client-related AI workflows.

Anthropic

We may use Anthropic services and models for appropriate AI-assisted functionality or development.

xAI / Grok

We may use Grok, provided by xAI, for appropriate AI-assisted functionality or development.

The particular providers used in an individual client project depend on the project's technical, commercial, security and privacy requirements.

Our use of a provider does not mean that all personal information collected by Thalenor is automatically sent to that provider.

9. Artificial Intelligence Processing

Because Thalenor develops AI-enabled software, some projects and internal workflows may involve artificial-intelligence technologies.

AI technologies may include:

• large language models;
• generative AI;
• natural-language processing;
• document processing;
• speech recognition;
• text-to-speech systems;
• computer vision;
• retrieval systems;
• classification systems;
• machine-learning APIs;
• agentic workflows; and
• other automated technologies.

Providers may include OpenAI, Anthropic, Google/Gemini and xAI/Grok.

9.1 Client Data Submitted to AI Providers

Where personal or confidential client information is submitted to a third-party AI provider as part of a client project, we will do so subject to:

• applicable client instructions;
• the applicable project agreement;
• applicable privacy law;
• relevant provider terms;
• available security settings; and
• technical requirements of the project.

Clients with specific requirements relating to:

• data residency;
• AI model training;
• prompt retention;
• zero-data-retention configurations;
• particular model providers;
• regulated information;
• sensitive personal information; or
• geographic hosting

should communicate those requirements to us before the relevant architecture is agreed.

9.2 Provider Training and Retention

AI providers offer different products, account types, APIs and contractual arrangements.

Whether a provider stores inputs or outputs, how long they retain them and whether information may be used to improve their systems can depend upon:

• the provider;
• product;
• API;
• account type;
• contractual terms;
• geographic deployment;
• privacy settings; and
• configuration used for a particular project.

Accordingly, we do not make a blanket representation that every AI service we use operates under identical retention or model-training conditions.

Where particular restrictions are essential, they should be documented in the relevant project agreement.

9.3 Website Enquiries and Model Training

Thalenor does not operate the public website for the purpose of collecting visitors' personal information to train a general-purpose Thalenor AI model.

10. Google Sheets and Internal Business Records

We may use Google Sheets for legitimate business and administrative purposes.

Information stored in spreadsheets may include, depending on the context:

• prospect information;
• client contact information;
• project information;
• administrative records;
• commercial information;
• task information;
• business-development records; and
• other operational information.

Access should be limited to persons who reasonably require such information for authorised business purposes.

11. Information Obtained From Public or Third-Party Sources

We may obtain professional or business-related information from sources other than the individual.

Sources may include:

• company websites;
• LinkedIn and other professional networks;
• professional directories;
• public business databases;
• industry directories;
• event websites;
• referrals;
• professional introductions;
• publicly available corporate information; and
• lawful business-intelligence sources.

Information may include:

• name;
• organisation;
• professional position;
• business email;
• business telephone number;
• public professional profile;
• organisation website; and
• information relevant to a potential business relationship.

We may use such information for appropriate business-development purposes where permitted by applicable privacy, electronic-marketing and anti-spam laws.

The availability of information on the internet does not, by itself, mean that Thalenor may use that information without restriction.

12. Direct Marketing and Business Development

Thalenor conducts business development both in India and internationally.

This may include communications with:

• prospective clients;
• founders;
• directors;
• business owners;
• senior managers;
• agency partners;
• technology partners; and
• other relevant professional contacts.

Where legally permitted, we may use professional contact information to:

• introduce Thalenor;
• discuss potentially relevant technology services;
• follow up on enquiries;
• maintain professional relationships;
• discuss partnerships;
• communicate about relevant services; and
• respond to business opportunities.

Where applicable law requires consent or another particular legal condition before sending a communication, we will seek to comply with that requirement.

You may object to direct-marketing communications at any time by:

• using the unsubscribe method included in a communication, where applicable; or
• emailing contact@thalenor.com.

We may retain limited suppression information after an opt-out so that we can remember not to send further marketing communications to that address.

Requests to stop marketing will not necessarily prevent:

• project communications;
• contractual communications;
• invoicing communications;
• security communications;
• legal notices; or
• other non-marketing correspondence.

13. Information From Referrals and Introductions

Clients, acquaintances, partners and other contacts may introduce potential clients or professional contacts to us.

Where this occurs, we may receive information including:

• name;
• organisation;
• role;
• email;
• phone number; and
• context relating to the introduction.

We use such information for purposes reasonably related to the introduction.

14. Recruitment, Freelancers and Contractors

If you apply or express interest in working with Thalenor, we may collect:

• name;
• contact information;
• résumé or curriculum vitae;
• portfolio;
• GitHub or other professional profiles;
• employment history;
• education;
• skills;
• work samples;
• availability;
• interview notes;
• location;
• compensation or commercial expectations;
• references; and
• information relevant to evaluating the relationship.

This applies to potential:

• employees;
• independent contractors;
• freelancers;
• developers;
• designers;
• business-development partners;
• consultants; and
• collaborators.

15. Sensitive Personal Information

The public Thalenor website is not intended to collect highly sensitive personal information.

Please do not submit through an ordinary enquiry form information such as:

• passwords;
• private keys;
• secret access tokens;
• government identification documents;
• detailed medical records;
• biometric data;
• bank login details;
• complete credit-card information;
• criminal records;
• highly sensitive financial information; or
• other specially protected information

unless we specifically request it through an appropriate process.

Certain client projects may legitimately involve sensitive information, particularly projects in sectors such as healthcare, finance or education.

Such processing should be addressed separately through the project architecture, security controls and applicable client agreements.

16. Why We Use Personal Information

We may process personal information for purposes including the following.

16.1 Responding to You

To:

• answer enquiries;
• respond to questions;
• arrange calls;
• understand requirements;
• evaluate a project;
• prepare proposals;
• provide quotations; and
• communicate about potential work.

16.2 Providing Services

To:

• plan projects;
• design software;
• develop software;
• develop AI systems;
• develop automations;
• perform testing;
• configure infrastructure;
• manage integrations;
• deploy applications;
• provide support;
• provide maintenance;
• troubleshoot systems; and
• otherwise perform agreed professional services.

16.3 Managing Relationships

To:

• manage clients;
• manage suppliers;
• communicate with relevant personnel;
• maintain project records;
• manage support;
• discuss future work;
• maintain professional relationships; and
• administer agreements.

16.4 Business Development

To identify and communicate with organisations and professionals who may reasonably have an interest in our services, where permitted by applicable law.

16.5 Operating the Website

To:

• deliver website content;
• maintain website functionality;
• diagnose errors;
• monitor performance;
• secure the website;
• prevent abuse; and
• improve the visitor experience.

16.6 Security

To:

• authenticate users where relevant;
• prevent unauthorised access;
• investigate misuse;
• detect malicious activity;
• protect infrastructure;
• maintain security logs;
• investigate incidents; and
• protect clients and other persons.

16.7 Administration

To:

• issue invoices;
• receive payments;
• maintain financial records;
• perform accounting;
• administer contracts;
• maintain documentation;
• comply with tax obligations; and
• operate our business.

16.8 Recruitment

To evaluate individuals for employment, contracting, freelance and collaborative opportunities.

16.9 Legal Purposes

To:

• comply with law;
• comply with lawful regulatory requirements;
• respond to legal proceedings;
• protect legal rights;
• investigate complaints;
• establish or defend claims; and
• enforce agreements.

17. Legal Bases Under UK and European Data-Protection Law

Where the UK GDPR, EU GDPR or comparable legislation applies and requires a lawful basis, we may rely on one or more of the following.

17.1 Contract

Processing may be necessary:

• to perform a contract with you; or
• to take requested steps before entering into a contract.

For example, if you ask us to prepare a project proposal, we may need to process your contact and project information.

17.2 Legitimate Interests

We may rely on legitimate interests where appropriate, including interests in:

• operating Thalenor;
• responding to professional enquiries;
• maintaining client relationships;
• providing B2B services;
• protecting our systems;
• preventing fraud;
• maintaining business records;
• securing infrastructure;
• establishing legal claims; and
• conducting proportionate B2B business development.

Where we rely on legitimate interests, we consider whether our interests are overridden by the rights and interests of affected individuals.

17.3 Consent

We may rely on consent where required, including for certain:

• marketing;
• optional communications;
• cookies;
• tracking technologies; or
• other activities.

Where processing is based on consent, consent may be withdrawn subject to applicable law.

17.4 Legal Obligation

We may process information where reasonably necessary to comply with applicable legal obligations.

17.5 Other Lawful Bases

In particular circumstances, another legal basis recognised under applicable law may apply.

18. India: Digital Personal Data Protection Framework

Thalenor is established in India and therefore pays particular attention to Indian data-protection requirements.

The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) are being brought into force in stages.

Accordingly, this section applies to the extent that the relevant provisions are in force and applicable to the processing concerned.

The DPDP Act applies to specified processing of digital personal data within India and can also apply to processing outside India where such processing relates to offering goods or services to Data Principals within India. MeitY

For processing for which Thalenor determines the purpose and means, Thalenor may act as a Data Fiduciary within the meaning of the DPDP Act.

18.1 Lawful Purpose

Where the DPDP framework applies, we process personal data for lawful purposes in accordance with applicable requirements.

Depending upon the circumstances, processing may take place:

• pursuant to valid consent; or
• pursuant to another use permitted under applicable Indian law.

The Act provides for processing based on consent or specified legitimate uses and requires consent, where relied upon, to be free, specific, informed, unconditional and unambiguous with clear affirmative action. MeitY

18.2 Notice

Where required under applicable DPDP provisions, we will provide an appropriate notice describing matters such as:

• the personal data being processed;
• the purpose of processing;
• relevant rights;
• means for withdrawing consent where applicable;
• grievance mechanisms; and
• other legally required information.

The 2025 Rules envisage notices that are independently understandable and expressed in clear and plain language, together with mechanisms to withdraw consent and exercise rights. MeitY

18.3 Withdrawal of Consent

Where consent is the basis of processing and applicable law provides a withdrawal right, an individual may withdraw consent.

Requests may be sent to:

contact@thalenor.com

The DPDP Act provides that withdrawal should be capable of being exercised with ease comparable to that with which consent was given. MeitY

Withdrawal will not ordinarily make processing carried out lawfully before withdrawal unlawful.

Certain information may continue to be processed where another applicable law requires or authorises its retention.

18.4 Accuracy

Where required and relevant to the purposes of processing, we will take reasonable measures concerning the completeness, accuracy and consistency of personal data.

18.5 Security Safeguards

Where applicable, we will take reasonable security safeguards designed to protect personal data in our possession or under our control against personal-data breaches.

18.6 Personal Data Breaches

Where a personal-data breach occurs, we will assess the circumstances and comply with applicable notification and mitigation obligations that are in force at the relevant time.

This may include, where legally required, notifications to affected Data Principals or the Data Protection Board of India.

18.7 Erasure

Where required under applicable DPDP provisions, personal data may be erased when:

• consent has been withdrawn; or
• it is reasonable to determine that the specified purpose is no longer being served,

unless retention is necessary under applicable law.

The DPDP Act also contemplates obligations for Data Fiduciaries to cause processors to erase relevant personal data in applicable circumstances. MeitY

18.8 Contact and Grievances

Thalenor provides the following business contact for questions and grievances concerning processing:

Dev Asheesh Chopra
Thalenor
contact@thalenor.com

This contact should not be interpreted as representing that Thalenor has been designated a “Significant Data Fiduciary” or that a statutory Data Protection Officer is presently required where no such requirement applies.

18.9 Individual Rights

To the extent applicable and in force, individuals may have rights concerning:

• information about personal-data processing;
• access-related information;
• correction;
• completion;
• updating;
• erasure;
• withdrawal of consent;
• grievance redressal;
• nomination; and
• other rights provided under applicable law.

Requests may be submitted to contact@thalenor.com.

18.10 Children

Under the DPDP Act, a child is generally an individual who has not completed 18 years of age. MeitY

Our public website and services are directed primarily at businesses and professionals and are not intended for children.

We do not knowingly solicit personal information through the public Thalenor website from individuals under 18.

Where we become aware that a child has submitted personal information in circumstances requiring parental or guardian consent, we may delete, restrict or otherwise appropriately handle that information.

A client may engage Thalenor to develop a service used legitimately by children, for example an educational platform. Such projects require separate consideration of applicable legal requirements, client responsibilities and appropriate safeguards.

19. Automated Decision-Making

Thalenor does not currently use information collected through the ordinary public Thalenor website to make solely automated decisions that produce legal or similarly significant effects concerning website visitors.

Our client projects may include:

• recommendations;
• scoring;
• classification;
• ranking;
• AI-assisted analysis;
• automated workflow decisions; or
• other machine-assisted functionality.

Whether such processing amounts to legally regulated automated decision-making depends on the particular project.

Where Thalenor acts solely as a processor for a client, responsibility for determining the lawful purpose and use of such functionality will ordinarily lie with that client, subject to the contractual allocation of responsibilities.

20. Sharing Personal Information

We do not sell personal information to data brokers.

We may disclose or make personal information available where reasonably necessary to the following categories of recipients.

20.1 Hosting and Infrastructure Providers

Including providers such as Vercel and Google/Firebase where relevant.

20.2 Productivity and Storage Services

Including services such as Google Sheets and other authorised collaboration systems.

20.3 Artificial Intelligence Providers

Depending upon the applicable workflow:

• OpenAI;
• Anthropic;
• Google/Gemini;
• xAI/Grok; and
• other specifically selected technology providers.

20.4 Contractors

Where appropriate, authorised developers, designers, technical contractors, consultants or other persons assisting Thalenor may have limited access to information reasonably required to perform their responsibilities.

20.5 Professional Advisers

Information may be disclosed to appropriate:

• lawyers;
• accountants;
• tax professionals;
• insurers; or
• other professional advisers.

20.6 Financial Providers

Banks, payment processors and other financial intermediaries may receive information required to process transactions.

20.7 Authorities

We may disclose information where required or permitted by law, court order or lawful governmental request.

20.8 Protection of Rights

Information may be disclosed where reasonably necessary to:

• investigate fraud;
• investigate abuse;
• protect our systems;
• protect persons;
• enforce contractual rights;
• establish claims; or
• defend legal proceedings.

20.9 Business Transfer

If Thalenor or substantially all of its relevant business or assets are transferred, reorganised or acquired, personal information may be shared with prospective or actual transaction participants subject to appropriate legal and confidentiality safeguards.

21. International Processing and Transfers

Thalenor is based in India.

Our clients, suppliers and technology providers may be located elsewhere.

Consequently, personal information may be processed in India and may also become accessible to providers or infrastructure located in other jurisdictions.

Depending upon the provider and service configuration, these jurisdictions may include the United States and other countries in which the relevant technology providers maintain infrastructure, personnel or subprocessors.

International processing may arise from our use of services such as:

• Vercel;
• Firebase;
• Google services;
• OpenAI;
• Anthropic;
• Gemini; and
• xAI/Grok.

We do not rely on the statement “by using our website you consent to international transfer” as a substitute for legally required safeguards.

22. UK and EEA International Transfers

Where UK or European data-protection rules concerning restricted or international transfers apply, we will seek to use an appropriate mechanism recognised by the relevant law.

Such mechanisms may include, where applicable:

• adequacy decisions or adequacy regulations;
• Standard Contractual Clauses;
• the UK International Data Transfer Agreement;
• the UK Addendum to recognised Standard Contractual Clauses;
• contractual and technical safeguards;
• approved transfer frameworks; or
• another lawful transfer mechanism.

UK guidance expressly recognises that giving an organisation outside the UK remote access to personal information may itself constitute a restricted transfer, and restricted transfers generally require adequacy, appropriate safeguards or an applicable exception. Information Commissioner's Office

23. UK and EEA Representatives

Thalenor is established in India.

Certain organisations established outside the UK or EEA that target individuals in those territories may be required to appoint a local representative.

UK guidance states that an overseas organisation offering goods or services to individuals in the UK or monitoring them may be required to appoint a UK representative unless a relevant exemption applies. Information Commissioner's Office

If the nature and scale of Thalenor's activities creates a legal obligation to appoint a UK or EEA representative, relevant representative details will be added to this Privacy Policy or otherwise made available as required.

24. Canada

Where Canada's Personal Information Protection and Electronic Documents Act (“PIPEDA”) or applicable provincial privacy legislation applies, we will handle personal information in accordance with the requirements applicable to the circumstances.

PIPEDA's principles include:

• accountability;
• identifying purposes;
• consent;
• limiting collection;
• limiting use, disclosure and retention;
• accuracy;
• safeguards;
• openness;
• individual access; and
• mechanisms for challenging compliance. Office of the Privacy Commissioner

Canadian individuals may, where applicable, have rights to:

• ask whether we hold personal information concerning them;
• request access;
• challenge accuracy;
• seek correction;
• withdraw consent where permitted; and
• raise privacy complaints.

Questions or requests may be directed to contact@thalenor.com.

Where personal information is transferred to a service provider, applicable Canadian privacy principles may continue to require the responsible organisation to protect that information through contractual or other measures. Office of the Privacy Commissioner

25. Australia

Where the Australian Privacy Act 1988 and the Australian Privacy Principles apply to Thalenor's processing, we will seek to comply with requirements applicable to the circumstances.

Depending upon the relevant law, individuals may have rights relating to:

• access;
• correction; and
• privacy complaints.

Australian privacy guidance expects an applicable APP Privacy Policy to describe the kinds of information collected, how it is collected and used, access and correction mechanisms, complaints, and likely overseas disclosures where practicable. OAIC

Where APP 8 applies, cross-border disclosure may also require reasonable steps concerning an overseas recipient's handling of information unless an exception applies. OAIC

Questions may be directed to contact@thalenor.com.

26. United States and Other Jurisdictions

Privacy laws in certain U.S. states and other jurisdictions may provide rights to qualifying individuals where the applicable statute applies to Thalenor and the relevant legal thresholds are satisfied.

Depending upon applicable law, rights may include:

• access;
• correction;
• deletion;
• portability;
• information concerning processing;
• objection or opt-out rights; or
• other statutory rights.

Nothing in this Privacy Policy should be interpreted as representing that a particular foreign privacy statute applies to Thalenor where its jurisdictional or statutory conditions are not satisfied.

We will assess obligations based upon the relevant activity, jurisdiction and applicable law.

27. Data Retention

We do not intend to keep identifiable personal information indefinitely merely because storage is technically possible.

Retention depends upon:

• the purpose for which information was collected;
• whether a relationship remains active;
• contractual requirements;
• applicable law;
• tax requirements;
• accounting requirements;
• dispute or limitation periods;
• security needs;
• recordkeeping requirements; and
• legitimate business requirements.

Examples include:

Business Enquiries

Information concerning an unsuccessful or inactive enquiry may ordinarily be retained for a reasonable period after the last meaningful interaction so that we can understand previous discussions and appropriately respond to future contact.

Prospective Clients

Prospect information may be retained while a relationship is active and for a reasonable period afterwards.

Client Records

Client, contractual and project information may be retained during the engagement and afterwards where reasonably necessary for:

• support;
• warranties;
• contractual records;
• dispute management;
• accounting;
• tax;
• legal compliance; and
• defence of claims.

Financial Records

Invoices and related records may be retained for the period required under applicable tax, accounting and business laws.

Security Logs

Logs may generally be retained for shorter periods appropriate to security and operational requirements unless an incident requires longer preservation.

Recruitment

Applicant information may be retained for the recruitment process and for a reasonable period afterwards where appropriate and lawful.

Marketing Opt-Outs

Where somebody opts out of marketing, we may retain the minimum information required to record and honour that preference.

Client-Controlled Data

Information processed solely on behalf of a client will ordinarily be retained or deleted in accordance with:

• client instructions;
• contractual terms;
• backups and deletion processes; and
• applicable law.

When information is no longer reasonably needed, we may delete, anonymise or aggregate it, subject to applicable obligations.

28. Security

We take reasonable technical and organisational measures designed to protect personal information.

Depending upon the relevant system or project, safeguards may include:

• authentication;
• access restrictions;
• least-privilege principles;
• encryption in transit;
• encryption at rest where appropriate;
• secure cloud infrastructure;
• environment separation;
• secrets management;
• restricted database access;
• logging;
• monitoring;
• backups;
• secure development practices;
• patching;
• dependency management;
• vendor assessment;
• confidentiality commitments; and
• incident-response measures.

The exact security architecture may differ by project.

Nothing in this Privacy Policy should be interpreted as a representation that Thalenor currently holds a certification such as:

• ISO 27001;
• SOC 2;
• PCI DSS;
• HIPAA certification; or
• another security accreditation

unless we expressly state that certification separately and it is factually accurate.

No internet-connected system can be guaranteed to be completely secure.

29. Personal Data Breaches

If we discover a security incident involving personal information, we will investigate and respond in light of:

• the nature of the incident;
• affected information;
• potential risk;
• our role as controller/Data Fiduciary or processor;
• contractual obligations; and
• applicable law.

Where notification to:

• affected individuals;
• a client;
• the Data Protection Board of India;
• the UK Information Commissioner's Office;
• another regulator; or
• another authority

is legally required, we will take reasonable steps to comply with the applicable requirements.

Where we process information as a processor for a client, we will notify and cooperate with that client as required by the applicable agreement and law.

30. Your Privacy Rights

Depending upon applicable law, you may have rights to request one or more of the following:

• confirmation concerning processing;
• access;
• correction;
• completion;
• updating;
• deletion or erasure;
• restriction;
• portability;
• withdrawal of consent;
• objection;
• opt-out from direct marketing;
• information about recipients or processing;
• grievance redressal; and
• complaint to an appropriate authority.

Rights are not absolute.

A request may be subject to:

• verification;
• statutory exceptions;
• another person's rights;
• legal privilege;
• contractual restrictions;
• security considerations;
• record-retention obligations; or
• another lawful reason.

To make a request, email:

contact@thalenor.com

Please provide enough information for us to understand the request.

We may ask for reasonable information to verify identity or authority.

31. Privacy Complaints

Privacy concerns may be sent to:

contact@thalenor.com

Please describe:

• the nature of the concern;
• the information involved, where known;
• the relevant interaction or project; and
• how we can contact you.

We will review complaints and seek to respond within a reasonable period appropriate to the circumstances and applicable law.

Where applicable legislation gives you a right to complain to a regulatory authority, nothing in this Policy is intended to remove that right.

32. Cookies and Similar Technologies

The website may use cookies, browser storage or comparable technology for purposes including:

• essential functionality;
• security;
• fraud prevention;
• session operation;
• preferences;
• performance; and
• website analytics.

We will distinguish, where appropriate, between technologies necessary to operate the website and optional technologies.

Where applicable law requires consent before a non-essential cookie or similar technology is stored or accessed, we will seek to provide an appropriate consent mechanism.

A dedicated Cookie Policy may provide additional information concerning technologies actually deployed on the production website.

33. Third-Party Websites

The website may contain links to third-party websites or services.

Examples may include:

• LinkedIn;
• WhatsApp;
• social networks;
• scheduling systems;
• portfolio websites;
• external documentation; or
• other services.

A link does not mean that Thalenor controls that provider's privacy practices.

You should review the third party's own privacy information where appropriate.

34. Children

The Thalenor website and professional services are directed primarily to businesses and professionals.

They are not intended for children.

We do not knowingly solicit personal information through the public website from persons under 18 years old.

If you believe a person under 18 has submitted personal information to Thalenor inappropriately, contact:

contact@thalenor.com

Where Thalenor builds an application for a client whose legitimate users include children, privacy responsibilities concerning those users will be addressed separately based on the jurisdiction, client instructions and applicable law.

35. Changes to This Privacy Policy

We may update this Privacy Policy as our:

• technology changes;
• service providers change;
• business expands;
• processing changes;
• international activities change; or
• legal obligations develop.

The current version will be published on this page with an updated Last Updated date.

Where applicable law requires additional notice or consent for a change, we will take reasonable steps to provide it.

36. Contact Thalenor

For questions, complaints, consent withdrawals or privacy-rights requests:

Thalenor
Dev Asheesh Chopra, Sole Proprietor
B-19/18, Fatehgarh Rd, opposite Narad Hospital
Darapur Colony
Hoshiarpur, Punjab 146001
India

Email: contact@thalenor.com
Website: https://www.thalenor.com