Privacy Policy

Last updated 8 May 2026. This policy explains how Kunal Waghmare ('I', 'me', 'the controller') collects, uses and protects your personal data when you visit kunalwaghmare.com or contact me through this site. It is written to be compliant with the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and India's Digital Personal Data Protection Act 2023 (DPDP Act).

1. Who is the data controller

The data controller is Kunal Waghmare, an independent marketing consultant operating from Padmavati Hills, Pune, Maharashtra 411038, India. For all privacy-related queries, contact office@quiamo.com.

For users in the European Union or United Kingdom, I act as the data controller for any personal data you submit through this website. For users in India, I act as the Data Fiduciary under the DPDP Act 2023.

2. What personal data I collect

I collect the following categories of personal data, only when you actively provide them or when essential for the website to function:

• Contact data: name, email address, phone number — only when you submit the enquiry form or email me directly.
• Enquiry content: the topic and message text you provide.
• Technical data: IP address, browser type, device type, pages visited, time spent — collected through Google Analytics 4, only after you accept analytics cookies.
• Cookie preferences: stored locally on your device.

I do not collect: payment information, government-issued IDs, sensitive personal data (health, sexual orientation, religion, political opinions), biometric data, or location data beyond country-level inference from IP.

3. Why I collect it (lawful bases)

Under GDPR, my lawful bases are:

• Legitimate interest for analytics — to understand which content helps visitors and which doesn't.
• Consent for analytics cookies — explicitly captured via the cookie banner before any analytics script loads.
• Contract / pre-contractual steps for processing your enquiry — when you submit the contact form, I process your data to respond to your enquiry.
• Legal obligation — to comply with tax, accounting and consumer-protection law where applicable.

Under the DPDP Act 2023, I rely primarily on consent (cookie banner) and specified purpose / certain legitimate uses (responding to enquiries you initiate).

4. Who I share data with

I share personal data only with the following categories of processors, all under written contracts that meet GDPR Article 28 requirements:

• Google LLC — for Google Analytics 4 and Google Tag Manager. Data is anonymised at the IP level. No advertising signals are shared.
• Hosting provider — BigRock Solutions Ltd (India) hosts this website. Server logs are processed only for security and operational purposes.
• Email service provider — emails sent through the contact form open in your own email client, so the message body is processed by your email provider, not mine.

I do not sell, rent, trade or share your personal data with marketers, data brokers, advertisers, or social media platforms for advertising. I do not use your data to train AI models.

5. International data transfers

Google Analytics processing involves transfer of data to the United States. Google relies on Standard Contractual Clauses (SCCs) for this transfer, as approved by the European Commission. For India-resident users, Google's transfer is in line with the DPDP Act 2023 framework for international transfers.

If you are uncomfortable with international transfer of analytics data, decline analytics cookies in the cookie banner — no analytics data will then be transmitted.

6. How long I keep data

I retain personal data only as long as necessary:

• Enquiry emails: retained for up to 24 months after our last interaction, to maintain context for follow-up. Deleted on request.
• Google Analytics data: retained for 14 months (the minimum GA4 setting), then auto-deleted.
• Cookie consent records: stored on your device, persisted until you clear your browser data or use the 'Manage cookie preferences' link in the footer.
• Server logs: retained for up to 30 days for security purposes.

7. Your rights

Under GDPR (and equivalent rights under the DPDP Act 2023), you have the right to:

• Access — request a copy of the personal data I hold about you.
• Rectification — request correction of inaccurate data.
• Erasure ('right to be forgotten') — request deletion of your data.
• Restriction — request that I limit how I use your data.
• Portability — request your data in a machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, for any consent-based processing.
• Lodge a complaint — with your local supervisory authority (the ICO in the UK, your DPA in the EU, or the Data Protection Board of India under the DPDP Act).

To exercise any of these rights, email office@quiamo.com with the subject line 'Data subject request'. I will respond within 30 days.

8. Children

This website is not intended for children under 18. I do not knowingly collect data from minors. If you believe a minor has submitted data, please email me and I will delete it.

9. Security

The site is served over HTTPS with HSTS. Email enquiries are sent through your own email client — meaning the content is not stored on this website's servers. Server-side data is held on infrastructure with industry-standard physical and logical access controls.

No security measure is perfect; if a personal-data breach occurs, I will notify affected users and the relevant supervisory authority within 72 hours, as required by GDPR Article 33 and equivalent DPDP Act provisions.

10. Changes to this policy

I may update this policy from time to time. Material changes will be highlighted on this page with a revised 'last updated' date. If you have an active enquiry with me, I will notify you of material changes by email.

11. Contact

For all privacy-related queries, including data subject requests:

Kunal Waghmare
Padmavati Hills, Pune, Maharashtra 411038, India
Email: office@quiamo.com
Phone: +91 90216 02686