Privacy Policy

01 Who we are

This policy explains how Plurentoo Systems Private Limited ("Plurentoo", "we", "us") handles personal data. We are a private limited company registered in India with Corporate Identity Number U62020PN2026PTC259543 and registered office at B-334, Gera's Imperium Gateway, Near Nashik Phata Metro Station, PCMC, Pune 411034, Maharashtra, India.

For the personal data described here, we act as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and as the controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR. When we process personal data on behalf of clients as part of a service, we act as their Data Processor under the DPDP Act, or processor under the GDPR, and the client's own privacy notice applies.

Until the relevant provisions of the DPDP Act come into force, we also follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

You can contact us about privacy at any time at connect@plurentoo.com.

02 What this policy covers

This policy applies to personal data we collect when you:

visit plurentoo.com or send us an inquiry through it;
make a privacy request or raise a grievance;
arrange training or an industrial visit for your institution, or take part in one;
apply for a job or send us your CV;
work for a client, prospective client, supplier or partner that deals with us;
communicate with us by email, phone or at events.

It does not cover the websites of other organizations that we link to, which have their own policies.

03 The personal data we collect

Categories of personal data
Category	What it includes
Inquiry data	Name, work email, company, phone number, country, the topic and industry you choose, your message and the page you sent it from.
Privacy request data	Request type, your relationship with us, name, email, country, request details and, if you act for someone else, their name.
College program data	Names of participating students and staff, attendance and session feedback, and any details a host site requires for entry, shared by the institution we work with.
Recruitment data	The information in your CV and cover email, interview notes and, for selected candidates and only with consent, background verification results.
Business contact data	Names, job titles, business contact details and correspondence of people at clients, suppliers and partners, and information needed to run a contract.
Website technical data	IP address, browser and device type, pages requested, date and time, and referring page, recorded in server logs by our hosting provider.
Consent records	A random consent ID, your cookie choices, how you made them (including whether your browser sent a Global Privacy Control signal), the date and time, and the page where you made the choice. The consent record does not include your IP address.
Analytics data (only with your consent)	Pseudonymous identifiers, pages viewed, approximate location, device and browser information, collected by Google Analytics if analytics is enabled and you opt in.

We do not ask for sensitive information such as passwords, financial account details, health information, biometric data or government identification numbers through this website. Please do not include them in messages or CVs.

04 Why we use personal data and our legal bases

We only use personal data for specific purposes. The table sets out each purpose and the basis we rely on.

Purposes and legal bases
Purpose	Data used	Basis under the DPDP Act	Basis under the GDPR and UK GDPR
Replying to inquiries and preparing proposals	Inquiry data	Your consent, and data you voluntarily provide for this purpose (section 7(a))	Steps at your request before a contract (Art. 6(1)(b)) or our legitimate interest in responding (Art. 6(1)(f))
Handling privacy requests and grievances	Privacy request data	Compliance with the DPDP Act and Rules	Legal obligation (Art. 6(1)(c))
Running training programs and industrial visits for institutions	College program data	Consent of the participant obtained through the institution, or data the participant provides for this purpose (section 7(a)); for students under 18, verifiable consent of a parent or lawful guardian (section 9)	Performance of our contract with the institution (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f))
Recruitment	Recruitment data	Your consent, and data you voluntarily provide for this purpose	Steps before a contract (Art. 6(1)(b)); consent for background checks and for keeping your CV for future roles (Art. 6(1)(a))
Managing client, supplier and partner relationships	Business contact data	Data voluntarily provided for the relationship, and performance of our contracts	Contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f))
Operating and securing the website, and meeting CERT-In log requirements	Website technical data	Compliance with law and the security safeguards the Act requires	Legitimate interests in security (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c))
Remembering your cookie choices	Consent records	Compliance with law	Legal obligation (Art. 6(1)(c)) and ePrivacy rules
Website analytics, if enabled	Analytics data	Your consent	Your consent (Art. 6(1)(a))
Accounting, legal claims and regulatory compliance	Relevant records	Compliance with law and legal proceedings (section 7)	Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f))

Where we rely on consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect processing that already took place. If you withdraw consent for an inquiry, we will stop using your data for it, which may mean we cannot continue the conversation.

We do not send marketing emails unless you have asked for them. We do not sell personal data.

05 Where the data comes from

Most personal data comes directly from you. Business contact data may also come from your employer or from colleagues who introduce us. Background verification results come from verification providers, and only with the candidate's consent. Technical data is generated when you use the website.

We share personal data only when needed, and only with:

Service providers who process it on our instructions, such as our website hosting, email and collaboration providers, and, if analytics is enabled and you consent, Google as our analytics provider;
Host organizations for industrial visits, limited to the details they need for entry and safety;
Background verification providers, for selected job candidates who have consented;
Professional advisors such as lawyers, auditors and accountants, under confidentiality duties;
Government authorities, regulators and courts when the law requires it, including the Data Protection Board of India and CERT-In;
A buyer or successor if our business is reorganized, merged or sold, under the same protections.

Our service providers are bound by contracts that require confidentiality, security safeguards and deletion or return of data when the service ends. We do not sell personal data or share it for cross-context behavioral advertising.

07 International transfers

We are based in India, so personal data we receive from other countries is processed in India. Under the DPDP Act, we may transfer personal data outside India except to countries the Government of India restricts by notification.

The European Commission has not issued an adequacy decision for India. Where the GDPR or UK GDPR applies to a transfer, we use appropriate safeguards such as the European Commission's standard contractual clauses or the UK International Data Transfer Addendum, together with supplementary measures where needed. Some of our service providers may process data in other countries, such as the United States, under similar safeguards or a recognized framework such as the EU-US Data Privacy Framework. You can ask us for more information about these safeguards.

08 How long we keep it

Retention periods
Record	How long we keep it
Inquiries that do not lead to a contract	Up to 24 months after our last contact
Client, supplier and partner records	For the relationship, then for 8 years to meet accounting and tax requirements
Job applications	Up to 12 months after our last contact, unless you ask us to delete them sooner
College program records (participant lists, attendance, feedback)	Only as long as needed to run the program and close any follow-up with the institution, then deleted
Privacy requests and grievances	3 years after the request is closed
Website server and security logs	At least 180 days as CERT-In directions require, and up to one year in line with the DPDP Rules, then deleted unless needed to investigate an incident
Consent records	Your choice is valid for 6 months; the record is kept for up to 3 years to show how consent was given
Analytics data, if enabled	Cookies expire after 13 months; event data is kept in Google Analytics for no more than 14 months

When a retention period ends, or when you withdraw consent and no other legal basis applies, we erase or anonymize the data unless the law requires us to keep it longer.

09 How we protect it

We apply reasonable security safeguards, including:

encryption of data in transit using TLS, and encryption at rest where our providers support it;
access limited to people who need it, with multi-factor authentication and regular access reviews;
logging and monitoring to detect and investigate unauthorized access;
backups to keep data available after an incident;
security and confidentiality terms in contracts with service providers;
confidentiality obligations and privacy awareness for our staff.

No system is perfectly secure. If you believe your data has been exposed, contact us right away at connect@plurentoo.com.

10 Your rights

Under the DPDP Act (India)

You have the right to:

obtain a summary of your personal data that we process and of our processing activities, and the identities of others we shared it with;
have inaccurate or incomplete data corrected, completed or updated;
have your data erased when it is no longer needed, unless the law requires us to keep it;
withdraw consent at any time;
have your grievances redressed by us;
nominate another person to exercise your rights if you die or become incapacitated.

Under the GDPR and UK GDPR

You have the right to:

access your data and receive a copy;
have inaccurate data rectified;
have your data erased in certain circumstances;
restrict or object to processing, including processing based on legitimate interests;
receive your data in a portable format;
withdraw consent at any time;
complain to a data protection supervisory authority.

Under US state privacy laws

Depending on where you live, you may have rights to know, access, correct and delete personal data, and to opt out of its sale or sharing. We do not sell or share personal data for targeted advertising, and we will not treat you differently for exercising your rights.

11 How to exercise your rights

Use our privacy request form or email connect@plurentoo.com. Tell us what you would like us to do and how you have interacted with us.

We acknowledge requests within 7 working days.
We respond within 30 days. Where the GDPR applies and a request is complex, we may extend this by up to two further months and will tell you why.
We aim to resolve grievances within 30 days of receiving them, well within the 90-day maximum that the DPDP Rules allow.
We may ask for information to confirm your identity, and we use it only for that purpose.
We normally do not charge a fee. Where the GDPR applies and a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request, and we will explain why.

Under the DPDP Act, you need to raise a grievance with us, and give us the chance to resolve it, before you approach the Data Protection Board of India. See Grievance Officer and complaints.

12 Cookies, analytics and browser signals

At present this website sets no cookies. If we enable analytics, we will ask for your consent first, and a strictly necessary cookie will remember your choice. Details are in our cookie policy, and you can review your choice at any time using the Cookie settings link in the footer.

We treat a Global Privacy Control signal from your browser as a request to switch off optional cookies. There is no agreed standard for Do Not Track signals, so we do not respond to them separately, but you can achieve the same result by rejecting optional cookies. Google Analytics, which loads only if analytics is enabled and you consent, is the only third-party script on our site. No other third party collects information about your online activities across websites through it.

We host our fonts and scripts ourselves and do not embed third-party maps, videos or social media widgets, so visiting our pages does not send your data to those providers.

13 Children

Our website is intended for businesses, institutions and adults. Under the DPDP Act, a child is anyone under 18. We do not knowingly collect personal data from children through this website, and we do not track, monitor or target advertising at children. Our contact form asks you to confirm that you are 18 or older. If you believe a child has sent us personal data, contact us and we will delete it. Our training programs and industrial visits can include students under 18: in that case we require the institution to obtain, and share with us a record of, verifiable consent from a parent or lawful guardian before sharing their details with us, and we use those details only to run the program.

14 Automated decision-making

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing, including profiling.

15 Personal data breaches

If a personal data breach occurs, we will act to contain it and will notify affected people and the Data Protection Board of India as the DPDP Act and Rules require. Where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority and affected individuals when required. We also report cyber incidents to CERT-In in line with its directions.

16 Links to other websites

Our website links to other sites, such as Google Maps, our Google Business Profile, our LinkedIn page and the websites of our partner companies. Those sites have their own privacy practices, and we are not responsible for them. We do not embed their content, so nothing is sent to them unless you follow a link.

17 Grievance Officer and complaints

Our Grievance Officer answers questions and complaints about our processing of personal data:

Grievance Officer
Plurentoo Systems Private Limited
B-334, Gera's Imperium Gateway, Near Nashik Phata Metro Station, PCMC, Pune 411034, Maharashtra, India
Email: connect@plurentoo.com

We aim to resolve grievances within 30 days of receiving them. If you are not satisfied with our response, you can then complain to the Data Protection Board of India. If you are in the European Economic Area, you can complain to the supervisory authority in the country where you live or work, and in the United Kingdom to the Information Commissioner's Office.

18 Representatives in the EU and UK

If we are required to appoint a representative in the European Union or the United Kingdom under Article 27 of the GDPR or UK GDPR, we will publish their contact details in this section. Until then, please contact us directly at connect@plurentoo.com.

19 Language of this policy

This policy is published in English. You can ask us for it in any language listed in the Eighth Schedule to the Constitution of India, including Hindi and Marathi, by writing to connect@plurentoo.com.

20 Changes to this policy

We review this policy regularly and at least once a year. When we make changes, we update the date at the top of the page. If a change is significant, we will also tell you through the website or by email where we have your details. This version is effective from 16 September 2026.