Privacy
Policy.

This Privacy Policy explains how Ticking Minds Technology Solutions Pvt. Ltd. ("TickingMinds", "we", "us"), CIN U72900TN2022PTC151234, registered in Tamil Nadu, India, handles personal data collected through tickingminds.com. We are the Data Fiduciary for the personal data described here.

1. Personal data we collect

• Contact form. Name, business email address, company name, role/title, industry sector, and the message you provide. The industry field is collected to help us direct your enquiry to the relevant service team.
• Strategy call scheduling. When you book a call via Calendly, scheduling details (name, email, availability) are processed by Calendly on our behalf as a data processor.
• Technical/server data. IP address, browser type, pages visited, and timestamps, captured automatically in server logs for security and operational purposes.

2. Purpose of processing

• To respond to your enquiry and provide the information or services you requested.
• To route your enquiry to the appropriate service team based on industry sector.
• To arrange and conduct meetings, diagnostics, and engagements.
• To operate, secure, and improve this website.
• To comply with applicable legal and regulatory obligations.

3. Lawful basis for processing

India — Digital Personal Data Protection Act, 2023 (DPDP Act)

For visitors in India, we process personal data only on the basis of your free, specific, informed, unconditional, and unambiguous consent, given via the consent checkbox on the contact form before you submit your data (Section 6, DPDP Act 2023). Processing does not commence until that consent is given. The only lawful bases under the DPDP Act are consent (Section 6) and deemed consent (Section 7); we rely exclusively on Section 6 consent for contact form data.

EU / EEA and UK — GDPR and UK GDPR

For visitors in the EU, EEA, or UK, we process personal data under the following lawful bases (GDPR Article 6):

• Consent (Article 6(1)(a)): Contact form submissions — you consent before submitting. You may withdraw consent at any time (see Section 4 below).
• Legitimate interests (Article 6(1)(f)): Operating and securing the website; maintaining server security logs. We have assessed that these interests are not overridden by your rights and freedoms.
• Legal obligation (Article 6(1)(c)): Retaining records required to comply with applicable law.

We do not rely on legitimate interests as a basis for marketing communications or for processing contact form data — those are consent-based only.

Singapore — Personal Data Protection Act (PDPA)

For visitors in Singapore, we collect and use personal data with your consent, consistent with the PDPA. Our designated Data Protection Contact for PDPA purposes is reachable at privacy@tickingminds.com.

United States — CCPA / CPRA and Applicable State Privacy Laws

For residents of California and other US states with enacted privacy laws, we process personal information as described below. TickingMinds does not sell or share personal information for cross-context behavioural advertising as defined under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). The personal information we collect is limited to what you voluntarily provide via the contact form, plus standard server logs.

• Categories collected: Identifiers (name, email address); professional or employment-related information (company, role, industry); inferences drawn to understand your service interests; internet activity (IP address, browser type, pages visited).
• Business or commercial purpose: Responding to your enquiry; operating and securing the website; complying with legal obligations.
• Disclosed to: Web3Forms (form delivery); Calendly (scheduling). No sale or sharing for advertising purposes.
• Retention: 24 months from date of submission; server logs 90 days.

Other US states with comprehensive privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, and others) confer similar rights — see Section 9b for how to exercise them.

4. How to withdraw consent

You may withdraw your consent at any time, without affecting the lawfulness of processing done before withdrawal, by emailing privacy@tickingminds.com with the subject line "Withdraw Consent". We will acknowledge your request within 3 business days and cease processing within 7 business days of acknowledgement. Withdrawal is as simple as sending that email — no forms, no waiting.

5. Cookies

This website uses only essential session functionality by default. No non-essential analytics or advertising cookies are set without your prior consent.

6. Third-party processors

We share personal data with the following processors, who act only on our instructions:

• Calendly — scheduling and calendar management. Calendly Privacy Policy →
• Google Fonts — web typography (font files served from Google CDN after consent; no personal data submitted). Google Privacy Policy →
• Web3Forms — contact form delivery service. Web3Forms Privacy Policy →

We do not sell personal data to any third party.

7. Data retention

Contact enquiry data is retained for a maximum of 24 months from the date of submission, after which it is securely deleted or anonymised, unless retention is required to comply with a legal obligation or to establish, exercise, or defend a legal claim (Section 8(7), DPDP Act 2023). Server logs are retained for 90 days. Scheduling data retention is governed by Calendly's data retention policy.

8. Security safeguards

We apply appropriate technical and organisational measures including TLS encryption in transit, access controls, and least-privilege practices to protect personal data against unauthorised access, loss, or misuse (Section 8(4), DPDP Act 2023).

8a. Personal data breach notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of Data Principals, we will:

• Under the DPDP Act 2023 (Section 8(6)): notify the Data Protection Board of India and all affected Data Principals without undue delay, in the manner and with the information prescribed by the Board once Rules are notified.
• Under GDPR / UK GDPR (Article 33/34): notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and notify affected individuals without undue delay where the breach poses a high risk to their rights and freedoms.
• Under US state breach notification laws (including California's data breach notification law, Cal. Civ. Code §1798.29 / §1798.82, and equivalent statutes in Virginia, Colorado, Texas, and other states): notify affected residents without unreasonable delay and, where required, notify the relevant state Attorney General's office. Timing requirements vary by state but are generally 30–60 days from discovery.

If you believe your personal data held by us has been compromised, please contact privacy@tickingminds.com immediately.

9. Your rights under GDPR and UK GDPR

If you are located in the EU, EEA, or UK, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access (Article 15). Request a copy of the personal data we hold about you.
• Right to rectification (Article 16). Request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17). Request deletion of your personal data in certain circumstances (e.g. when the purpose for which it was collected is fulfilled or consent is withdrawn).
• Right to restriction of processing (Article 18). Request that we restrict how we process your data in certain circumstances.
• Right to data portability (Article 20). Receive the personal data you provided in a structured, commonly used, machine-readable format, and transmit it to another controller (applies to consent-based processing).
• Right to object (Article 21). Object to processing based on legitimate interests. Where we rely on legitimate interests (e.g. server security logs), you may object and we will cease unless we have compelling legitimate grounds.
• Right to withdraw consent. Where processing is based on consent, you may withdraw at any time (see Section 4 above). Withdrawal does not affect lawfulness of prior processing.
• Right to lodge a complaint. You have the right to lodge a complaint with your local supervisory authority. In the EU, find your authority at edpb.europa.eu. In the UK, this is the Information Commissioner's Office (ICO).

To exercise any of these rights, email privacy@tickingminds.com. We will respond within 30 days as required by GDPR Article 12.

9a. Your rights under the DPDP Act, 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023 (India), you have the following rights:

• Right to access (Section 11). Request a summary of personal data we hold about you and the identities of all processors and fiduciaries with whom it has been shared.
• Right to correction and completion (Section 12(1)(a),(b)). Request correction of inaccurate data or completion of incomplete data we hold.
• Right to erasure (Section 12(1)(c) / Section 8(7)). Request deletion of your personal data when the purpose for which it was collected is fulfilled or consent is withdrawn.
• Right to nominate (Section 14). Nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. To register a nominee, email privacy@tickingminds.com with the subject line "Section 14 Nomination". The specific mechanism for nomination will be updated once Rules under Section 14 are notified by the Central Government.
• Right to grievance redressal (Section 13). Lodge a grievance with our designated Data Privacy Officer (see Section 11 below).

To exercise any right, email privacy@tickingminds.com. We will acknowledge within 3 business days.

9b. Your rights under US state privacy laws (California and others)

If you are a California resident, you have the following rights under the CCPA/CPRA. Residents of Virginia, Colorado, Connecticut, Texas, and other states with enacted privacy laws have equivalent rights under their respective laws.

• Right to know. Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the third parties with whom it was shared.
• Right to delete. Request deletion of personal information we hold about you, subject to certain exceptions (e.g. completing a transaction, legal obligation).
• Right to correct. Request correction of inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioural advertising. No opt-out action is required, but you may confirm this in writing by emailing privacy@tickingminds.com.
• Right to limit use of sensitive personal information. We do not collect sensitive personal information (as defined under CPRA) beyond what is necessary to respond to your enquiry.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights — no denial of services, different pricing, or different quality of service.
• Right to appeal. If we decline to act on your request, you may appeal by replying to our response email. California residents may also contact the California Privacy Protection Agency at cppa.ca.gov.

To exercise any right, email privacy@tickingminds.com with the subject line "US Privacy Rights Request". We will respond within 45 days as required by the CCPA, with a possible 45-day extension where reasonably necessary.

Authorised agents: California residents may designate an authorised agent to submit requests on their behalf. We may require written proof of authorisation before processing the request.

10. Grievance redressal

If you have a complaint or grievance about our handling of your personal data, contact our designated privacy contact:

• Email: privacy@tickingminds.com
• Designated Person: Data Privacy Lead, Ticking Minds Technology Solutions Pvt. Ltd.
• Response SLA: We will respond to grievances within 7 business days.

If your grievance is not resolved to your satisfaction within 30 days, you have the right to escalate to the Data Protection Board of India under Section 13(2) of the DPDP Act, 2023. The Board's contact and complaint filing process is available at www.meity.gov.in (Ministry of Electronics and Information Technology). Once the Board is operationalised and its portal is live, we will update this section with a direct link.

11. Contact for privacy matters

For any privacy question, rights request, consent withdrawal, or data grievance:

• Privacy email: privacy@tickingminds.com
• General enquiries: hello@tickingminds.com
• Address: Ticking Minds Technology Solutions Pvt. Ltd., Chennai, Tamil Nadu, India.

12. International transfers

Where personal data is transferred to processors outside India (e.g. Calendly), we ensure appropriate safeguards are in place consistent with Section 16 of the DPDP Act, 2023. This section will be updated when cross-border transfer Rules are notified by the Central Government.

13. Children

This website is intended for business audiences only and is not directed at children. We do not knowingly collect personal data from individuals below the age of 18.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date above reflects the latest revision. Material changes will be communicated to data principals whose data we hold.