Privacy Policy

1. Who this policy covers

This Privacy Policy explains how True Infinity Consultants (“True Infinity”, “we”, “us”), registered office at 1148, Shukrawar Peth, Chandrakamal, Subhashnagar Lane 1, Pune 411002, Maharashtra, India, collects, uses, stores, and discloses personal data through www.trueinfinity.co (“the Site”).

This policy applies to visitors to the Site, including those accessing it from India, the UAE, Saudi Arabia, and other GCC states. Where you are located in India, we act as a Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 and its Rules. Where you are located in the UAE, we process personal data in a manner consistent with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its Executive Regulation. Where you are located in Saudi Arabia, we process personal data in a manner consistent with the Personal Data Protection Law (Royal Decree M/19) and its Implementing Regulations, as overseen by the Saudi Data & AI Authority (SDAIA). Where you are located in Bahrain, Qatar, Oman, or Kuwait, we process personal data in a manner consistent with the applicable data protection law of that jurisdiction — respectively, Bahrain’s Personal Data Protection Law (Law No. 30 of 2018), Qatar’s Law No. 13 of 2016 Concerning Personal Data Privacy Protection, and the data protection frameworks in force in Oman and Kuwait.

This policy covers the Site only. Personal data you provide to us as part of a client engagement (for example, employee census data submitted for a gratuity or pension valuation) is governed by the terms of the relevant engagement letter and any data processing terms agreed separately, not by this Site policy.

2. What we collect

We collect personal data only where you choose to provide it, through:

• Contact / enquiry form: name, email address, phone number, organisation, and the content of your message.
• Newsletter subscription: name and email address.
• Job applications: name, contact details, CV/resume content (which may include your education, employment history, and references), and any covering note you submit.
• Client login portal: login credentials, engagement-related documents, and communication history associated with your engagement.
• Site usage data, collected automatically: IP address, browser type, device type, pages visited, and time spent, via the analytics tools described in Section 4.

We do not knowingly collect special categories of sensitive personal data (health data, biometric data, financial account details) through the Site itself.

3. Why we use it, and our lawful basis

For visitors in the UAE, Saudi Arabia, and the other Gulf states named in Section 1, we may additionally rely on the lawful bases available under the applicable law of that jurisdiction, including our legitimate interests in the security and proper operation of the Site, where that basis is recognised and does not override your rights.

Where our lawful basis is consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. Withdrawal does not affect any separately agreed client engagement.

4. Cookies and tracking tools

The Site uses:

• Google Analytics, to understand how visitors use the Site (pages viewed, time on page, general location at a city/region level, device type). Google Analytics uses cookies and similar technologies; data is processed by Google in accordance with Google’s own privacy terms.
• LinkedIn Insight Tag, to understand traffic originating from LinkedIn and to measure the performance of any LinkedIn-based outreach. This may involve LinkedIn setting cookies and, where you are logged into LinkedIn, associating Site visits with your LinkedIn profile in aggregate, non-identifying reporting; data is processed by LinkedIn in accordance with LinkedIn’s own privacy terms.

Non-essential cookies (including Google Analytics and the LinkedIn Insight Tag) are set only after you consent via the cookie banner shown on your first visit. You can review or withdraw your consent at any time using the “Cookie Preferences” link in the Site footer, or through your browser settings. Withdrawing consent is as straightforward as giving it, and takes effect immediately. Blocking cookies may affect parts of the Site’s functionality but will not prevent you from viewing its core content.

We do not sell personal data or make it available to third parties for their own independent marketing purposes. The LinkedIn Insight Tag may enable us to measure and, where we run campaigns on LinkedIn, to direct those campaigns to relevant professional audiences; it does not involve sharing your details with any other advertiser.

5. Who we share data with

We share personal data with:

• Service providers who host the Site, deliver the newsletter, or process job applications on our behalf, under instructions limited to those purposes;
• Google and LinkedIn, in relation to the analytics and insight tools described in Section 4;
• Regulators, courts, or government authorities, where required by law;
• Professional advisers (for example, our own legal or IT advisers), where necessary and subject to confidentiality.

We do not sell personal data, and we do not share it with third parties for their own independent marketing purposes.

6. Cross-border transfer

True Infinity is based in India. Personal data collected through the Site may be transferred to and processed by our service providers outside India, the UAE, Saudi Arabia, or the other Gulf states named above — including in the United States, where Google and LinkedIn operate their global infrastructure.

For analytics and insight-tag data (Section 4), this transfer occurs only after you give explicit, affirmative consent via the cookie banner. If you decline or later withdraw analytics consent, no such data is collected or transferred. Where the law applicable to you requires a further condition, safeguard, or regulatory authorisation for a transfer of this kind beyond your consent, we will not carry out the transfer unless that condition is satisfied.

For data submitted through the contact form, newsletter signup, job application, or client portal, our hosting and processing service providers are contractually bound to confidentiality and data-security obligations at least equivalent to those under this policy, regardless of where they are located. We do not otherwise transfer personal data internationally without an equivalent safeguard in place.

7. Retention

We retain personal data only for as long as necessary for the purpose it was collected:

• Enquiry form submissions: retained for the period reasonably needed to respond and follow up, and thereafter deleted or anonymised unless a client relationship develops, in which case retention follows the engagement’s own records-retention terms.
• Newsletter data: retained until you unsubscribe.
• Job application data: retained for the duration of the relevant hiring process and a reasonable period thereafter for record-keeping, then deleted, unless you consent to longer retention for future opportunities.
• Analytics data: retained per the default retention settings of the relevant tool, which we periodically review.

8. Security

We apply reasonable technical and organisational measures — including access controls, encrypted transmission (HTTPS), and limiting data access to personnel who need it — to protect personal data against unauthorised access, loss, or misuse. No system is completely secure. If we become aware of a personal data breach affecting you, we will notify you without undue delay, and will notify the relevant supervisory authority within the period required by the law applicable to you — which, for data principals in India and for individuals in Saudi Arabia, is within 72 hours of becoming aware of the breach.

9. Your rights

Subject to the law applicable to you:

• If you are in India (DPDP Act, 2023): you have the right to access a summary of the personal data we hold about you and the processing we carry out, to correction and completion of your data, to erasure (once the purpose for which it was collected is no longer being served, subject to any legal retention requirement), to withdraw consent, to nominate another individual to exercise your rights in the event of death or incapacity, and to grievance redressal directly with us in the first instance, and thereafter with the Data Protection Board of India.
• If you are in the UAE (PDPL): you have the right to access, correct, and request deletion of your data, to object to or restrict certain processing, to data portability, and to lodge a complaint with the UAE Data Office.
• If you are in Saudi Arabia (PDPL): you have the right to be informed of the legal basis for processing, to access and obtain a copy of your data, to request correction and destruction where applicable, and to lodge a complaint with SDAIA.
• If you are in Bahrain, Qatar, Oman, or Kuwait: you have equivalent rights of access, correction, and complaint to the relevant data protection authority under that jurisdiction’s law.

To exercise any of these rights, contact us using the details in Section 11. We aim to respond to any request or grievance within 30 days of receipt, and in any event within the period required by the law applicable to you. We may need to verify your identity before acting on a request.

10. Children’s data

The Site is directed at working professionals and organisations, not children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data through the Site, contact us and we will delete it.

11. Grievance redressal / contact

For any question about this policy, or to exercise a data protection right:

If you are not satisfied with our response, you may escalate to:

• India: the Data Protection Board of India
• UAE: the UAE Data Office
• Saudi Arabia: the Saudi Data & AI Authority (SDAIA)
• Bahrain, Qatar, Oman, Kuwait: the relevant data protection authority in your jurisdiction

12. Changes to this policy

We may update this policy as our practices, the Site, or applicable law change. The “Last updated” date above reflects the most recent revision. Material changes affecting how we use previously collected data will be notified to affected individuals where required by law.