Compliance · India
Digital Personal Data Protection Act, 2023
This notice explains how personal data submitted through this website is collected, used, stored, and erased, and the rights you hold as a Data Principal under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act").
This page is maintained by Chandrasekar Rathinam to answer common privacy questions about this website. It describes current practices — it is not a certification, an audit report, or legal advice. Read it alongside the Privacy Policy and Terms.
Who is the Data Fiduciary?
Data FiduciaryChandrasekar Rathinam, Cyber Security Consultant, operating as an independent freelance practice.
LocationChennai, Tamil Nadu, India
Contacthi@chandrasekarrathinam.com
Role under the ActData Fiduciary for enquiries made through this website; Data Processor when handling client data during a contracted security engagement.
What data is collected and why (Section 5 notice)
Personal data is collected only when you choose to submit it. Nothing on this page is collected silently, and no sensitive categories such as financial or health data are requested.
| Personal data | Purpose of processing | Lawful basis |
|---|---|---|
| Name | To address you correctly in our correspondence | Consent given when you submit the contact form |
| Email address | To reply to your enquiry and share proposals or reports | Consent / performance of an engagement you request |
| Phone or WhatsApp number (optional) | To call or message you about your enquiry if you prefer that channel | Consent given when you provide it |
| Message and project details | To understand the scope of the security work you are asking about | Consent given when you submit the form |
Your rights as a Data Principal
Right to access information
You can ask for a summary of the personal data held about you, the processing carried out on it, and the identities of anyone it has been shared with.
Right to correction and erasure
You can ask for inaccurate or misleading data to be corrected, incomplete data to be completed, and data to be erased once it is no longer needed for the purpose you shared it for.
Right to grievance redressal
You can raise a grievance about how your data has been handled and expect a response. If it is not resolved, you may escalate to the Data Protection Board of India.
Right to nominate
You may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
To exercise any right, email hi@chandrasekarrathinam.com with the words "DPDP request" in the subject line. Requests are acknowledged and actioned within a reasonable period, and you may be asked to confirm your identity first so data is not disclosed to the wrong person.
Consent and withdrawal
- Withdraw consent at any time by emailing the grievance contact below — processing stops for any purpose that relied on that consent.
- Withdrawal does not affect processing already lawfully carried out before the request.
- Where data must be retained to meet a legal or contractual obligation, that specific retention is explained to you in writing.
Reasonable security safeguards
- Data minimisation — only the fields on the contact form are collected; there is no hidden profiling, ad tracking, or data broking.
- Access control — enquiry data is accessible only to Chandrasekar Rathinam as the Data Fiduciary.
- Encryption in transit — the site is served over HTTPS.
- Confidentiality — anything disclosed during a security engagement is treated as confidential and covered by a mutual non-disclosure agreement.
- Breach notification — if a personal data breach affecting you occurs, you and the Data Protection Board of India will be notified as required by the Act.
Retention and erasure
Enquiry data is kept only while it is needed to answer you or to meet a contractual or statutory obligation. Once the purpose is served and no legal retention applies, it is erased.
Sharing and processors
Personal data is never sold, rented, or shared for advertising. Where a hosting or email provider processes data on instruction, it is limited to what is needed to deliver that service.
Children's data
This site and these services are intended for business audiences. Personal data of children or persons with a lawful guardian is not knowingly collected, and no behavioural tracking or targeted advertising is carried out.
Grievance redressal contact
Concerns about how your personal data has been handled go directly to the Data Fiduciary. If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India as provided under the DPDP Act.
This notice may be updated as practices or the rules under the DPDP Act evolve. Last reviewed: August 2026.