1. Overview
The General Data Protection Regulation (GDPR), UK GDPR, and UAE privacy requirements set rules for collecting, using, sharing, and protecting personal data. This page explains how Simple Mind applies those rules when operating simplemind.tech.
This page works alongside our Privacy Policy and Cookie Policy, which describe the personal data and cookies we collect in more detail.
2. Scope
This page covers personal data processed through our website, contact forms, discovery-call bookings, email correspondence, and related business communications where GDPR or UK GDPR applies.
Personal data processed inside a client project is governed by the client agreement, Master Services Agreement, Statement of Work, Data Processing Agreement, or other signed engagement terms.
3. Controller and Processor Roles
For website enquiries, call bookings, and general communications, Simple Mind India Pvt Ltd generally acts as the data controller because we decide why and how that information is processed.
When delivering a client engagement where we access client-controlled data, we usually act as a data processor and process that data only on the client's documented instructions.
4. Lawful Basis for Processing
- Consent: for optional cookies, analytics, and marketing communications where required.
- Contract or pre-contract steps: to respond to enquiries, prepare proposals, and deliver services.
- Legitimate interests: to operate our website, respond to business messages, secure our systems, and improve our services.
- Legal obligation: to keep tax, accounting, compliance, and dispute-resolution records.
5. Data Subject Rights
If GDPR or UK GDPR applies to you, you may have the right to access, rectify, erase, restrict, or object to our processing of your personal data. You may also have data portability rights, the right to withdraw consent, and the right to complain to a supervisory authority.
| Right | What it means |
|---|---|
| Access | Request a copy of the personal data we hold about you. |
| Correction | Ask us to fix inaccurate or incomplete information. |
| Deletion | Ask us to delete your data, subject to legal exceptions. |
| Objection | Object to processing based on legitimate interests or direct marketing. |
| Portability | Receive data you provided in a structured, commonly used format. |
6. International Transfers
Simple Mind is based in India and may use service providers in other countries. Where GDPR or UK GDPR requires safeguards for transfers outside the EEA or UK, we use appropriate mechanisms such as Standard Contractual Clauses, UK transfer addenda, data processing terms, and supplementary security measures where needed.
7. Sub-processors
We use service providers to host the website, deliver email, schedule calls, manage business communications, and measure website usage where analytics is enabled. We choose providers that offer appropriate confidentiality, security, and data protection commitments.
For client engagements, a project-specific sub-processor list can be supplied during contract or DPA review where applicable.
8. Breach Notification
We maintain procedures to identify, investigate, and respond to personal data incidents. Where required, we notify the relevant supervisory authority and affected individuals within the timeframes required by applicable law. Where we act as a processor, we notify the client without undue delay.
9. Security Measures
- HTTPS/TLS for website connections.
- Access controls for enquiry, booking, and client communication records.
- Confidentiality and data protection commitments with relevant service providers.
- Periodic review of website data flows, tools, and legal notices.
10. Exercising Your Rights
To exercise a GDPR right or ask a data protection question, contact us using the details below. We may need to verify your identity before responding.