Privacy Policy

1. Who we are

This Privacy Policy explains how Riskamy (“Riskamy”, “we”, “us”) handles personal data collected through this website, riskamy.com.

For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDPA”), we are the Data Fiduciary for personal data collected through this website.

2. What personal data we collect

We deliberately collect as little as possible.

Information you give us

• Contact and enquiry details. When you use a form on this website to book a demo, request a preview, ask for a quote or take up the switch offer, we collect the email address you enter, along with any name, organisation or message you choose to include.
• Correspondence. If you email us or take part in a demo, we hold the content of that correspondence and any notes we make about what you are looking for.
• Documents you choose to send us. For example an order form for the tool you use today, or a sample register you would like us to load into a preview. We ask you not to send us data you would not want us to hold, and we do not need live production data to run a preview.

Information collected automatically

• Aggregated website analytics. Page views, referrer, approximate country, device type and browser. This is collected in a privacy-preserving way that does not use cookies, does not fingerprint your device and does not follow you across other websites.
• Server and security logs. Our hosting and form providers keep short-lived technical logs, which can include IP address, for the purposes of delivering the site and preventing abuse.

We do not collect sensitive personal data through this website, we do not build advertising profiles, and we do not sell personal data to anyone.

3. Why we collect it

• To reply to your enquiry, arrange a demo, set up a preview instance or issue a quotation.
• To provide support, onboarding and migration assistance if you become a customer.
• To send you information about Riskamy that is relevant to a conversation you have started with us. We do not run a marketing list you have not asked to be on, and every email we send has a way to stop them.
• To keep this website available, secure and free of spam and automated abuse.
• To understand, in aggregate, which pages people find useful so we can improve them.
• To meet legal, accounting and record-keeping obligations.

4. Our lawful basis

Under the DPDPA we process personal data on the basis of:

• Your consent, given when you voluntarily submit a form on this website or contact us. You may withdraw it at any time, as easily as you gave it, by writing to [email protected]. Withdrawal does not affect processing that already happened.
• Certain legitimate uses permitted by the DPDPA, including responding to a request you have made, and complying with a legal obligation.

Where the General Data Protection Regulation applies to a visitor in the United Kingdom or the European Economic Area, our lawful bases are consent, the performance of a contract or steps taken at your request before entering into one, and our legitimate interests in responding to enquiries and securing this website.

5. Service providers we use

We keep our supply chain short. These are the only third parties that handle personal data from this website:

Each of these acts on our instructions for the purpose described. We do not permit them to use your data for their own marketing. We do not use advertising networks, social media pixels, session recording, heat mapping or cross-site trackers on this website.

6. Cookies

This website does not set advertising, analytics or profiling cookies, which is why you will not find a cookie banner on it. Our analytics provider measures visits without cookies and without fingerprinting.

Your browser may store small amounts of data that are strictly necessary to serve the site securely. If we ever introduce a cookie that is not strictly necessary, we will ask for your consent first and update this policy.

7. How long we keep it

• Enquiries and correspondence: up to 24 months after our last contact with you, unless you become a customer, in which case we keep them for the life of the relationship and as long afterwards as the law requires.
• Documents you send us for a preview or a quote: deleted once the preview or quotation is concluded, or sooner if you ask.
• Aggregated analytics: retained in aggregate only; it is not linked to you.
• Records we must keep by law, such as invoices and tax records: for the statutory period.

When a retention period ends, we delete the data or irreversibly anonymise it.

8. Your rights

Under the DPDPA you have the right to:

• Access a summary of the personal data we hold about you and how we are processing it.
• Correction and completion of personal data that is inaccurate, misleading or incomplete.
• Erasure of personal data we no longer need for the purpose it was collected for.
• Withdraw consent at any time, as easily as you gave it.
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Grievance redressal — raise a complaint with us first, and escalate to the Data Protection Board of India if you are not satisfied with how we handled it.

To exercise any of these, email [email protected]. We will respond within the period the DPDPA allows, and in any case without undue delay. We may need to verify your identity before we act, which we will do with the minimum information necessary.

9. Where your data is processed

We are based in India. The service providers listed in section 5 operate global infrastructure, so personal data submitted through this website may be processed on servers outside India, including in the United States and the European Union.

We transfer personal data outside India only to countries not restricted by the Central Government under the DPDPA, and we rely on our providers' contractual commitments, including standard contractual clauses where applicable, to keep the level of protection intact.

10. How we protect it

• This website is served only over HTTPS, and form submissions are encrypted in transit.
• The website is static. It has no database, no server-side application code and no administrative login, which removes an entire class of attack, including SQL injection.
• Access to the mailbox that receives enquiries is restricted to the people who need it and protected by multi-factor authentication.
• We apply the principle of least privilege and delete what we no longer need.

No method of transmission or storage is perfectly secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the DPDPA requires.

11. Children

This website is intended for business users and is not directed at children. We do not knowingly collect personal data of anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Grievance officer

If you have a question or a complaint about how we handle personal data, contact our Grievance Officer:

We will acknowledge your complaint and respond within the timeframe prescribed under the DPDPA. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

13. Changes to this policy

We may update this policy as our practices, our providers or the law change. The “last updated” date at the top of this page always shows the current version. Where a change materially affects how we handle your personal data, we will tell you by email if we hold your address.