Privacy & data protection

The short version

This website collects personal data in one place: the contact form. We store what you type there on our own server so we can find it again when we reply, and we delete it after twelve months, or sooner if you ask. Two providers handle it on the way: Resend sends the emails the form generates, and Google Workspace holds our mailboxes, where your email address arrives with our notice of your enquiry. Both act on our instructions, as our host does. There are no advertising pixels and no mailing list, and we sell no data. There is one analytics tool, Google Tag Manager, and it does not load unless you accept it. Refuse, or ignore the question, and your browser never contacts Google at all. Everything below is the same statement said precisely enough to satisfy two regulators.

Who is responsible

Verhelm Advisory Private Limited, trading as Verhelm Advisory, of C-64, First Floor, East of Kailash, New Delhi - 110065, is the data controller for the purposes of the UK and EU GDPR and the Data Fiduciary for the purposes of the Digital Personal Data Protection Act, 2023.

For any question about this notice, or to exercise a right described below, contact dhirajkhanna@verhelm.com.

We will send you this notice in English or in any language listed in the Eighth Schedule to the Constitution of India, as section 5(3) of the DPDP Act provides (checked 6 October 2026). Ask at the same address and name the language.

Our Grievance Officer for the purposes of section 13 of the DPDP Act is Dhiraj Khanna, Director, audit and engineering, reachable at dhirajkhanna@verhelm.com or by post at the registered office above. We aim to respond within seven working days and will not exceed the statutory periods. If you are not satisfied with the outcome, you may complain to the Data Protection Board of India or, where the GDPR applies to you, to your local supervisory authority.

What we collect, and why

Contact form submissions

Your name, email address, optional company name, and the message you write. Collected so we can read your enquiry and reply to it: nothing else. Providing a company name is optional and the form works without it. We write each submission to a database on our own server, which only the directors can reach, behind a password. Resend then sends two emails: a notice to the directors, which gives the enquiry number and a link to our admin page and nothing from your enquiry, and an acknowledgement to you, which carries your first name. If our database cannot be reached, the notice to the directors carries the whole enquiry instead, so that it is not lost, and we delete that email once we have copied the enquiry back into the database.

Technical detail attached to a submission

Alongside your message we record the time you sent it and the time you gave consent, and the version of the consent wording you agreed to (currently 2026-10-06.3), so we can show which wording you gave your consent under. We do not store your IP address or your browser’s user-agent string with an enquiry. The form reads your IP address while it handles your submission, to limit how many messages one address can send in an hour, and keeps it in memory only. We never write it to the database.

Analytics, only if you accept it

If you accept analytics, Google Tag Manager loads on the public pages of this site. Google then receives your IP address, your browser’s user-agent string and the page you are reading, and the tags in the container set a cookie holding a randomly generated identifier so that repeat visits from the same browser can be recognised. We use it to see which pages are read. If you refuse, or have not answered, none of this happens and no request is made to Google. The cookie page sets out exactly what is set and how to withdraw.

Email correspondence

If you email us, that correspondence sits in our mailboxes for as long as the business relationship or enquiry reasonably requires.

Server logs

Our server writes standard access logs, which include IP addresses, for security and to keep the service running. We do not use them to build a profile of you and do not combine them with anything else.

Client engagement data

Where you become a client, we process the material you share with us under a separate written agreement, which governs in place of this notice for that data.

What we deliberately do not do

• We set no advertising or profiling cookies, and run no remarketing or audience tags. The single analytics container is opt-in, off until you say otherwise, and refusable in one click. See the cookie page.
• Fonts are served from our own origin rather than a font CDN, so loading a page transmits nothing to a third party until and unless you accept analytics.
• We use no third-party CRM or marketing platform. We hold enquiries on our own server, and the only other providers that handle them are the ones named under who else sees it.
• We do not sell or rent personal data, and we run no automated decision-making or profiling that produces legal or similarly significant effects.

Lawful basis and consent

Under the GDPR we rely on your consent (Art. 6(1)(a)) for the contact form, given by the unticked checkbox you complete when you send it, and on legitimate interests (Art. 6(1)(f)) for keeping our systems secure and our correspondence in order.

For analytics we rely on your consent as well, given by the banner and withdrawable at any time from the cookie page. Storing and reading information on your device additionally requires consent under the ePrivacy Directive, which is why nothing is loaded before you answer rather than merely disabled afterwards. Withdrawing is as easy as consenting, takes effect immediately, and does not affect anything collected while your consent stood.

Under the DPDP Act each activity has its own ground:

• Contact form: your consent under section 6. We ask for it with an itemised description of the purpose and do not bundle it with anything else. The wording beside the checkbox is version 2026-10-06.3, and we store that version with your enquiry. Withdraw it at any time by replying to us and saying so.
• Analytics: your consent under section 6, given by the banner and withdrawn from the cookie page.
• Server logs: a legal obligation. Rule 6 of the Digital Personal Data Protection Rules, 2025 (checked 6 October 2026) requires us to keep logs of access to personal data, which is a use the law requires under section 7.

Withdrawing consent is as easy as giving it, and does not affect anything done before you withdrew it. We rely on legitimate interests only under the GDPR, as set out above.

How long we keep it

• Analytics, if you accepted it: two months, which is the shortest period Google Analytics allows, for both event-level and user-level data. We have also turned off the setting that restarts that clock every time you come back, so the two months runs from when the data was collected rather than from your last visit. Aggregate counts, such as how many people read a page, fall outside that setting, and Google keeps them for longer.
• Enquiries that do not become engagements: deleted within 12 months. Every stored enquiry carries its own deletion date, set when it arrives, and a scheduled job deletes the record once that date passes. Deletion means the row is removed, not hidden or flagged.
• Client correspondence and records: kept for the life of the engagement and then for the period our professional and statutory obligations require, after which it is deleted.
• Server logs:Rule 6 of the DPDP Rules requires us to keep them for one year. We have not yet set that period on our server, so for now the logs follow the server’s default rotation. We will change this line when the one-year period is in place.

Who else sees it

We use a small number of service providers, each acting on our instructions under a data processing agreement:

• Resend sends the emails the contact form generates, on our behalf. It handles your name and email address, and the whole enquiry on the rare occasion our database cannot be reached.
• Google Workspace holds our mailboxes on our behalf. The notice of your enquiry arrives there without your email address. Any email you send us arrives there too.
• Google Analytics, loaded through Google Tag Manager, receives analytics data from visitors who have accepted it, and only from them. We accepted Google’s data processing terms for it, under which Google processes that data on our behalf. Refusing, or ignoring the banner, means Google receives nothing.
• Sanity stores the articles published under Resources. It holds no visitor data.
• A virtual private server at Hetzner, Finland, managed with Coolify, runs this website and the database that holds contact-form enquiries, on our behalf. It serves pages, writes request logs, and stores enquiries for us until their deletion date.

Some of these operate outside the UK, EEA and India. Where personal data is transferred internationally we rely on adequacy decisions where they exist and on Standard Contractual Clauses where they do not, with transfer risk assessed. Under the DPDP Act, transfers are permitted except to territories the Central Government restricts by notification.

Your rights

If the GDPR applies to you, you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, to withdraw consent at any time, and to complain to a supervisory authority. In the UK that is the Information Commissioner’s Office.

If the DPDP Act applies to you, as a Data Principal you have the right to access a summary of your personal data and our processing of it, to correction, completion, updating and erasure, to grievance redressal through the contact above, and to nominate another individual to exercise your rights in the event of your death or incapacity. If we do not resolve your grievance, you may complain to the Data Protection Board of India.

To exercise any of these, email dhirajkhanna@verhelm.com. We will not charge you and we will not make it difficult.

Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect the personal data of anyone under 18, and we do not undertake any tracking, behavioural monitoring or targeted advertising directed at children, which the DPDP Act prohibits outright.

AI and this website

Where AI is used in producing this site or in delivering our services, we describe it on the AI disclosure page. Nothing you submit through the contact form is used to train any model.

Promptwright plugin

Promptwright provides instructions and reference material for generating and improving prompts inside an AI assistant. The current plugin is skills-only: it includes no Verhelm-hosted service, external API connection, analytics code, or separate user database. It does not itself send your prompts, attached content, or generated responses to us. We do not receive or retain a separate copy of those conversations through the plugin.

Your AI-assistant provider processes the inputs and outputs needed to run the plugin. That provider’s terms, privacy policy, account settings, and any applicable workspace agreement govern its processing, retention, and available deletion or export controls. Disabling or uninstalling Promptwright does not itself delete conversations held by the provider.

If you contact us for support and choose to share prompts, outputs, or other personal information, we receive that material as part of your enquiry. The contact and email provisions of this notice apply to that correspondence. Share only the information needed to explain the issue.

Questions about how we handle support information can be sent to dhirajkhanna@verhelm.com.

Changes

We date this notice at the top and revise it when what we do changes. If a change is material we will say so here rather than quietly amending the text.