Privacy policy

Who we are

This policy explains how CB Consulting Group (“we”, “us”) collects and uses personal data through this website. We are based in India, and we are the Data Fiduciary for that data under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it. Where they still apply, we also follow the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”).

• Company name: CB Consulting Group
• Address: 132 Ring Road, Satellite, Ahmedabad, India
• Grievance Officer (for privacy questions, requests and complaints): cb@cbconsultinggroup.in

What we collect

We keep this short because the website does very little. We collect personal data in three ways: when you send an inquiry, when you visit the website, and, only if you agree, through Google Analytics.

When you send an inquiry

If you use the inquiry form, we receive:

• your name;
• your work email address;
• your company name, if you give it;
• your message;
• the topics you selected (for example “AI and automation” or “CTO advisory”);
• the address of the page you sent the form from, and the date and time you sent it.

Please don’t include sensitive information (such as health or financial data) in your message. If you email or phone us directly, we receive whatever you choose to share, along with your email address or phone number. This website is meant for businesses and is not directed at children.

When you visit the website

• Hosting. Like any website, ours is delivered by our hosting provider, HV Web Host, which receives your IP address and basic request details in order to deliver pages and keep the service secure. Our host keeps standard access logs (such as IP address, browser and pages requested) for security and troubleshooting.
• Your cookie choice. When you choose “Accept” or “Reject” in our cookie banner, your browser’s local storage remembers that choice. This is strictly necessary to respect your decision. It stays on your device and is not sent to us.

Google Analytics, only if you accept

We use Google Analytics 4 to understand how visitors use the website, so we can improve it. It is loaded through Google Tag Manager, a Google tool that sets no cookies of its own and only loads the tags we have set up. It runs fully only after you choose “Accept” in the cookie banner. It then sets cookies (_ga and _ga_<ID>) and collects: a random browser ID, the pages you view and how long you stay, how you arrived (for example from a search engine or a link), your device type, browser and screen size, your approximate location (country and city level), and whether you sent the inquiry form or clicked our email address or phone number. It does not receive your name, your email address or the content of your inquiry. Your IP address reaches Google as part of the connection; Google says Google Analytics 4 uses it to estimate location and does not store it.

Before you choose, or if you choose “Reject”, we use Google Consent Mode: Google Analytics sets and reads no cookies, but your browser may send Google basic, cookieless signals (such as the page visited, the time and the fact that consent was not given) with no identifier that lets us recognize you. Google may use these to estimate overall visitor numbers in our reports. We have turned off advertising features and Google Signals, and do not use this data for ads. Our cookie policy lists each cookie and explains how to change your choice.

Why we use it, and our legal basis

Purpose	Data	Legal basis
Replying to your inquiry and arranging a call	Inquiry form details, or what you send by email or phone	A legitimate use under the DPDP Act: you voluntarily gave us the data for this purpose. Where needed, your consent, which you can withdraw at any time
Delivering the website securely	IP address and request details	A legitimate use under the DPDP Act (keeping the website working and secure), or your consent where required
Remembering your cookie choice	Your “Accept” or “Reject” choice, stored in your browser	Strictly necessary to respect your choice; no consent needed
Understanding how the website is used (Google Analytics)	Analytics cookie IDs, pages viewed, device and browser details, approximate location, and form and contact-link events	Your consent, given through the cookie banner, which you can withdraw at any time using the “Cookie settings” button on our cookie policy page

We use your data only for the purpose you gave it for. We do not use your details for marketing unless you ask us to, and we do not sell your data. We do not make decisions about you using automated processing.

Who we share it with

We use two service providers (Data Processors) that handle data on our behalf and on our instructions:

• HV Web Host hosts this website and provides our email service. The inquiry form is processed on our own website server and delivered to us by email through HV Web Host’s mail service, and we use the same service for our replies. No other company receives your form submission.
• Google (Google Analytics) provides our website analytics. Purpose: measuring how the website is used, in aggregate. Legal basis: your consent, which you can withdraw at any time. Google processes this data on servers outside India, including in the United States. Google receives the analytics data described above only after you accept, and the cookieless signals described above before you choose. See Google’s privacy policy and how Google uses data from sites that use its services.

We may also share data where the law requires it, or with professional advisers under a duty of confidentiality.

International transfers

Some providers process data outside India. In particular, Google processes Google Analytics data in the United States and other countries where it operates. The DPDP Act allows such transfers, except to countries the Government of India restricts by notification, and we will not transfer personal data to any such country. When we work with clients outside India, we agree with them how their data moves between countries before any work starts.

How long we keep it

We keep inquiry details for 24 months after our last contact with you, unless you become a client, in which case our client records policy applies. We then delete them. We also delete them sooner if you withdraw your consent or ask us to erase them, unless the law requires us to keep them. Our host keeps its access logs in line with its own standard practice. Google Analytics data is kept for the retention period we set in Google Analytics (14 months), after which Google deletes it; analytics cookies on your device last up to 2 years unless you delete them or choose “Reject”. Your cookie choice stays in your browser until you clear its site data.

Your rights

Under the DPDP Act you have the right to:

• access a summary of the personal data we hold about you, how we use it, and who we have shared it with;
• correction of data that is inaccurate or incomplete, and to have it updated;
• erasure of data we no longer need, unless the law requires us to keep it;
• withdraw consent at any time, as easily as you gave it (this does not affect anything we did before you withdrew it);
• grievance redressal, meaning a response from us to any complaint about how we handle your data;
• nominate another person to exercise these rights on your behalf if you die or become unable to do so.

To use any of these rights, email our Grievance Officer at cb@cbconsultinggroup.in. We will reply within a reasonable time. There is normally no charge.

If you are outside India

Most of our clients are in the US and the UK. Where we handle personal data of people outside India, we also respect the data protection laws that apply to them, such as the UK General Data Protection Regulation and US state privacy laws. If those laws give you rights in addition to the ones above, such as the right to object to or restrict how we use your data, or to receive a copy of it, contact us at the same address and we will honor them where they apply. We do not sell personal data or share it for targeted advertising.

Complaints

If you are unhappy with how we have handled your data, please contact our Grievance Officer first so we can put it right. If you are not satisfied with our response, you can complain to the Data Protection Board of India. If you live outside India, you may also be able to complain to your local data protection authority.

Changes to this policy

We will update this page if what the website does changes, for example if we add another tool that collects personal data. The date at the top shows when it was last revised.