This policy explains how The Open[n] Group handles personal data on theopenngroup.com. It is our notice under India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, and it also covers visitors in the United Kingdom and the European Union under the GDPR.
This notice is available in Hindi and, on request, in any of the 22 languages listed in the Eighth Schedule to the Constitution of India. हिन्दी में पढ़ें. Write to hello@theopenngroup.com for another language.
Who we are
The Open[n] Group (“we”, “us”) is the trading name of Amit Singh Rawat, a sole proprietor, running a brand, design and creative technology studio in Bengaluru, India.
Address: B2908, Nikoo Homes 4, Bhartiya City, Thanisandra, Bengaluru 560064, Karnataka, India. GSTIN: 29CJAPR2482J1ZS. Email: hello@theopenngroup.com.
We decide why and how the personal data described here is used. Under the DPDP Act that makes us its Data Fiduciary, and under the GDPR its controller.
At a glance
Each thing we collect, what it is for, and the ground we rely on. The sections below give the detail.
Enquiries (contact form, email, WhatsApp): your name, email address, phone number if you give it, company, and your message. Used to reply to you and scope work. You send it to us voluntarily for that purpose (DPDP Act, section 7(a)); under the GDPR, steps you ask us to take before a contract.
Consultation bookings: your name, email address, phone number, how you want to meet, the time you choose, the consultation and price, your time zone, and what you want to discuss; from Cashfree or PayPal, the payment result. Used to take payment, confirm and hold the booking, invite you and keep tax records. You give it voluntarily to book (section 7(a)), and we keep payment records because the law requires it (section 7(d)); under the GDPR, performing the contract and our legal obligations.
Newsletter: your email address, and your name and topics if you give them, with the date, the page, and a shortened IP address. Used to send the newsletter and prove you asked for it. Your consent, which you can withdraw at any time.
Analytics: pages viewed, device and browser type, approximate location and a random identifier held in a cookie. Used to count visits. Your consent through the banner. Nothing is sent to Google Analytics unless you accept.
Security: a shortened IP address and a hash of it when you use a form, and the logs kept on our server and by Cloudflare, the network that sits in front of the site. Used to stop abuse of the forms and keep the site running. Covered by the purpose you gave the data for and by our legal duties to keep logs; under the GDPR, our legitimate interest in keeping the site secure.
What we collect
Information you give us. When you email us, submit the contact form, or start a conversation on WhatsApp, we receive your name, email address, phone number where you provide it, and whatever you choose to tell us about your project.
Booking a consultation. When you book a consultation with our founder we collect your name, email address, phone number, how you would like to meet, the date and time you choose, the consultation and amount you picked, and anything you tell us about what you would like to discuss. Your device’s time zone and language are used to show times in your zone and to decide whether the Indian or international price applies. When you pay, Cashfree (guests in India) or PayPal (guests outside India) tells us the order number, the amount, whether the payment succeeded, and when. Cashfree or PayPal collects your card, UPI, bank or PayPal details on its own checkout. We never receive or store them.
Calls and consultations. We do not record calls, video calls or consultations without asking you first. If we take notes, they are kept with the rest of your correspondence.
What you must give us. We need your name, email address and phone number to confirm and deliver a booking, and your email address to reply to an enquiry. Everything else is optional. If you would rather not give the required details, we cannot take the booking, but you can still write to us.
The newsletter. If you subscribe, in the footer of any page, in the sign-up window, or by ticking the box on the contact form, we record your email address, the name and topics you give us if any, the date and time, the page you subscribed from, the version of this notice you were shown, and a shortened form of your IP address. We keep that record because it is our evidence that you asked to hear from us. Signing up is confirmed by a link we email you (double opt-in): nothing is sent until you click it, and if you do not click it within seven days the request lapses. That way nobody can sign up an address that is not theirs. Every unsubscribe link we send is signed for your address, so only you can take your address off the list. If you ask to unsubscribe without one, we email you a link.
Information collected automatically. Our server, and Cloudflare, which sits in front of it to deliver the site and filter out attacks, record standard technical data: IP address, browser and device type, referring page, pages viewed and time of visit. When you submit a form we also record a shortened form of your IP address (the last part removed) to stop the forms being used to send bulk mail, and that shortened address appears in the notification we receive. Google Analytics only receives anything if you accept (see below).
Why we use it
We use enquiry data to reply to you, scope work and keep a record of our correspondence. We use booking data to take your payment, confirm the consultation, reserve the time you chose so no one else can book it, add it to our calendar and send you the invitation and video call link, send you your receipt, and keep the accounting records the law requires. We use technical data to keep the site secure and working.
Under the DPDP Act, we process enquiry and booking data because you gave it to us voluntarily for that purpose and have not told us you do not consent (section 7(a)), and keep records where the law requires it (section 7(d)). The newsletter and analytics rely on your consent. Under the GDPR, the same activities rest on taking steps you asked for before a contract, performing the contract, our legal obligations, your consent (newsletter and analytics), and our legitimate interest in keeping the site secure.
We do not sell personal data, and we do not use your enquiry to send marketing you did not ask for.
Cookies and analytics
This site uses Google Analytics 4 to count visits and see which pages are read. It is the only analytics we run and the only cookie we set ourselves. Cloudflare, which sits in front of the site to filter out attacks, may set a security cookie of its own when it checks that a visit comes from a real browser. If you book a consultation and continue to payment, you leave this site for the checkout of Cashfree (guests in India) or PayPal (guests outside India), which may use its own cookies and device data to process the payment and prevent fraud, under its own privacy policy.
Google Analytics is not loaded until you accept. We ask once, in the corner of the page. Until you answer, and if you decline, nothing is sent to Google Analytics and no analytics cookie is set.
If you accept, Google Analytics sets two cookies on this domain, _ga and _ga_<id>, which last two years and hold a random identifier used to tell one browser from another. Advertising features are switched off. If you later withdraw, the analytics cookies are removed and Google Analytics is not loaded on the pages you visit after that.
Your answer is kept in your browser’s local storage rather than in a cookie, so recording it does not require the permission we are asking for. You can change your choice at any time, and clearing your browser storage resets the question.
Who else sees it
We share personal data only with the service providers who process it for us (our Data Processors), only as far as they need it to provide that service, and under their data processing terms:
Google Cloud (web hosting: the server in the United States that runs this site and stores form and booking records, and the nightly backups of them); Cloudflare, Inc. (the content delivery network, attack filter and domain name service in front of the site; it sees each visitor’s IP address, browser and the pages they request, at its servers around the world); Google Workspace (email, and Google Calendar and Meet, where your booking is added to our calendar and a video call link is created, so your name, email address and the topic you share appear on the invitation; and Google Sheets, where newsletter sign-ups are kept); Amazon Web Services (Amazon SES, which sends the emails from our forms and bookings, from its data centre in India); Google Analytics (only if you accept); Cashfree Payments India Private Limited (consultation payments from India; it receives your name, email address, phone number and the amount); PayPal (consultation payments from outside India; from us it receives the order number, what you booked and the amount, and you give it your payment details yourself on its checkout).
If you choose to message us on WhatsApp, operated by Meta, that conversation is also under WhatsApp’s own terms and privacy policy.
We do not sell personal data and we do not share it for advertising. We may also disclose data where the law requires it, for example to a court, a tax authority or CERT-In.
We do not use your personal data to make automated decisions about you.
How long we keep it
Enquiries are kept for as long as the conversation is live and for up to twenty-four months afterwards, so we can pick up where we left off. Records connected to a signed engagement, and booking and payment records, are kept for as long as tax and accounting law requires, normally eight years.
The personal details of a checkout that was started but never paid are deleted within thirty days. A log of it with nobody named in it (when, which consultation, the amount and the outcome) is kept for one year and then deleted.
Newsletter records are kept until you unsubscribe, and the record of your unsubscribing is kept as proof the request was honoured. Abuse-prevention counters hold only a one-way hash, not your address, and are discarded after twenty-four hours. Server logs are kept on our server, and Cloudflare keeps its own records of requests under its own retention policy. Analytics data is retained by Google for no longer than fourteen months.
Where Indian law requires us to keep personal data, traffic data or logs of processing for a minimum period (currently one year under the DPDP Rules), we keep them for that period and no longer, and use them only for the purposes the law sets.
Where it is processed
We are based in India. This site, and the form and booking records it keeps, are hosted on a Google Cloud server in the United States (Iowa), with nightly backups stored in the same region, and Cloudflare handles requests to the site at its servers around the world. Our other providers, including Google Workspace and PayPal, also process data outside India, for example in the United States and the European Union. The DPDP Act permits this except to countries the Government of India has restricted, and we will stop any transfer the Government restricts.
For visitors in the UK and EU, transfers to India and to our providers rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) in our providers’ data processing terms, or on the transfer being necessary to perform the booking or enquiry you asked for.
Your rights
Under the DPDP Act you can ask us for: a summary of the personal data we hold about you and what we do with it, and the names of every other organisation we have shared it with and what we shared; correction, completion or updating of your data; and erasure of data we no longer need or that you withdrew consent for. You can also nominate another person to exercise these rights for you if you die or become unable to act. Under the GDPR you additionally have the rights to portability, to restriction and to object.
Where we rely on your consent (the newsletter and analytics), you can withdraw it at any time, as easily as you gave it, and withdrawing it does not affect anything we did before then. Unsubscribe from the newsletter here, or use the link in any issue; change your analytics choice here.
How to make a request. Email hello@theopenngroup.com with the subject “Data request”, from the email address you gave us (or tell us the phone number or booking order number you used), so we can find your data and confirm it is you. We acknowledge within forty-eight hours and respond within thirty days, well inside the ninety days the DPDP Rules allow.
Grievance officer. The person responsible for answering questions and complaints about your personal data is Amit Singh Rawat, Founder, at hello@theopenngroup.com or +91 90199 10195.
Complaints to a regulator. Under section 13(3) of the DPDP Act you need to come to us first; if you are not satisfied with our answer you can then complain to the Data Protection Board of India. In the UK you can complain to the Information Commissioner’s Office, and in the EU to your national supervisory authority.
Your duties. The DPDP Act also asks you to give us true information, not to impersonate anyone, and not to make false or frivolous complaints.
Security
The site is served over HTTPS with a strict content security policy. Form and booking records are stored outside the public part of the server, access to them and to our accounts is limited to the people in the studio who need it, and we keep logs so misuse can be detected. No system is perfectly secure, but we take reasonable technical and organisational measures to protect what you send us.
If a breach of security affects your personal data, we will tell you without delay, and the Data Protection Board of India and CERT-In as the law requires, explain what happened and what we are doing about it, and tell you what you can do to protect yourself.
Children
This site is intended for business audiences, and you must be eighteen or over to book a consultation. We do not knowingly collect personal data from children: anyone under eighteen, as India’s Digital Personal Data Protection Act defines it, or under the age set by local law where that is lower. If you believe a child has sent us personal data, contact us and we will delete it.
Changes to this policy
If this policy changes we will update the page and the “last updated” date above. Material changes will be signposted on the site, and if a change affects something you consented to, we will ask again.
Contact
Questions about this policy, or about the data we hold: hello@theopenngroup.com.
