Last updated 7 October 2026

Privacy Policy

This policy explains what personal data ONYX collects through this website, why, how long we keep it and the rights you have. It is written with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") in mind.

1. What we collect

When you send a project enquiry, we collect only what you type into the form:

• your name and email address;
• the service and budget range you select;
• your message;
• a record that you gave consent, when, and which version of the consent wording you agreed to.

When you browse the site, our hosting provider automatically processes standard technical data (IP address, browser type, pages requested, date and time) to deliver the site and keep it secure. If you submit the enquiry form, we also keep a scrambled (hashed) form of your IP address for up to 10 minutes to block spam; your IP address is never written to our enquiry records.

If you email us directly, we handle your email and the details in it in the same way as a form enquiry.

We do not use analytics, advertising pixels, tracking cookies or profiling of any kind.

2. Why we use it

• To reply to your enquiry and, if you choose to work with us, to plan and deliver the project. We rely on your consent, which you give by ticking the box on the form.
• To keep the website secure and working, for example blocking spam and abuse.

We will not use your details for marketing, newsletters or any other purpose without asking you separately first.

3. Who we share it with

We never sell or rent your data. It is handled only by:

• Our hosting provider (Cloudflare), which serves the website, protects it from attacks and stores enquiry records.
• Our email provider, which delivers enquiry notifications to us and our replies to you.

All fonts and code on this website are served from our own server. Your browser does not contact Google, content-delivery networks or any other third party when you visit.

We may also disclose data where Indian law requires it.

4. Where it is stored

Data may be stored on servers outside India, depending on our hosting provider's data centres. Where data is transferred abroad, we do so only as permitted under the DPDP Act.

5. How long we keep it

Enquiries are deleted automatically after 12 months. Copies may remain in our hosting provider's routine backups for a short time afterwards, until those backups are overwritten. If we start a project together, we keep the project correspondence for as long as the work and any related legal, tax or accounting obligations require (for example, invoices must be retained under Indian tax law).

6. Your rights

Under the DPDP Act you can ask us to:

• give you a summary of the personal data we hold about you and how we use it;
• correct, complete or update your data;
• erase your data. We will do so unless the law requires us to keep it (for example, invoices for tax purposes);
• withdraw your consent at any time. This is as easy as giving it: just email us. Withdrawal does not affect anything we did before you withdrew;
• nominate another person to exercise these rights on your behalf if you die or become incapacitated.

Write to [email protected]. We aim to respond within 30 days.

7. Complaints

Please contact our privacy contact, Suryanshu Bhattacharya, at [email protected] first so we can put things right. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

8. Children

This website and our services are intended for adults. We do not knowingly collect data from anyone under 18, and the enquiry form asks you to confirm you are 18 or older. If you believe a child has sent us their details, contact us and we will delete them.

9. Security

We use reasonable safeguards: the site is served only over HTTPS (plain HTTP requests are redirected), enquiry records are stored privately, never in a publicly reachable location, and access is limited to the people handling your enquiry. If a personal data breach affects you, we will notify you and the Data Protection Board as the law requires.

10. Changes to this policy

If we change how we handle personal data, we will update this page and the "last updated" date above. Where a change needs fresh consent, we will ask for it.