01Introduction
Rythium Technologies LLP (“Rythium”, “we”, “us”) is an independent advisory firm specialising in enterprise software licensing and AI procurement. Our clients trust us with commercially sensitive information about their software estates, contracts and negotiations. We apply the same discipline to the personal information of everyone we deal with — website visitors, clients, prospective clients, training participants, job applicants and suppliers.
This policy describes how we collect, use, disclose, store and protect personal information, and how you can exercise your rights. Where we say “personal information” we mean any information that relates to an identified or identifiable individual.
02Scope
This policy applies to personal information we process when you:
- visit our website or watch our content on third-party channels such as YouTube;
- contact us, request a consultation or book Advisor on Call time;
- engage us for advisory services such as licence reviews, audit defence, ULA certification, the SAVE Review Program or AI procurement negotiation;
- register for or attend a masterclass, training session, webinar or event;
- apply to work with us, or supply goods or services to us.
03Who is responsible for your information
Rythium Technologies LLP, headquartered in Navi Mumbai, India, is responsible for the personal information described in this policy and is the “data fiduciary” for the purposes of India's Digital Personal Data Protection Act, 2023 (and the “controller” under laws that use that term).
Our teams in Dubai and Nairobi work under this same policy. Where personal information is collected through one of those offices, that office may also be responsible for it under local law. Contact details for all privacy matters are in section 16.
04Information we collect
We collect only what we need for the purposes in section 5. Most of it you give us directly; some is generated when you use our website; a small amount comes from public or professional sources.
| Category | Examples | Source |
|---|---|---|
| Identity & contact | Name, job title, employer, business email, phone number, country | You, or a colleague who introduces you |
| Enquiry content | What you tell us in forms, emails, calls and meetings about your licensing or procurement situation | You |
| Engagement records | Contracts, proposals, invoices, correspondence, meeting notes, project contacts and approvals | You and your organisation |
| Training & events | Registration details, attendance, course feedback, certificates issued | You, or your employer when it registers you |
| Recruitment | CV, qualifications, employment history, interview notes, references | You, referees, recruitment platforms |
| Technical & usage | IP address, browser and device type, pages viewed, referring site, approximate location derived from IP | Our website, cookies and similar technologies |
| Marketing preferences | Your subscription choices and whether you have opted out | You |
| Professional information | Publicly available business profile details, used to understand who we are speaking with | Company websites, professional networks |
We do not ask for, and ask you not to send us, identity numbers, bank or card details, or health information through our website or general email.
05How we use your information
Responding to you
Answering enquiries, arranging consultations, and following up on conversations you started.
Delivering our services
Scoping, contracting, performing and invoicing advisory engagements, Advisor on Call blocks and the SAVE Review Program.
Training & events
Registering participants, running sessions, issuing certificates and improving course content from feedback.
Running our website
Operating, securing and improving the site, understanding which content is useful, and fixing faults.
Keeping in touch
Sending insights, articles and event invitations where you have agreed to receive them, or where the law allows us to contact existing clients. Every message includes a way to opt out.
Recruitment
Assessing applications, arranging interviews and, if you join us, starting your employment record.
Security & integrity
Protecting our systems, detecting misuse and keeping records of who has accessed client information.
Legal obligations
Meeting tax, accounting and regulatory requirements, and establishing, exercising or defending legal claims.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you.
06Our basis for processing
We only process personal information where the law allows it. Depending on the situation and where you are, we rely on one or more of the following:
- Consent — for example, when you subscribe to our updates or accept non-essential cookies. You can withdraw consent at any time, as easily as you gave it; withdrawal does not affect processing that took place before.
- Contract — where the processing is needed to enter into or perform an agreement with you or your organisation.
- Legitimate uses and legitimate interests — such as processing information you voluntarily provide for a specified purpose, running and securing our business, and maintaining relationships with existing clients, always balanced against your rights.
- Legal obligation — where the law requires us to keep or disclose information.
For individuals in India, we process personal information on the basis of your consent or for the legitimate uses permitted by the Digital Personal Data Protection Act, 2023. When we ask for consent, we will tell you clearly what information we want and why.
07How long we keep it
We keep personal information only for as long as the purpose for which we collected it continues, plus any period the law requires. Typical periods are:
| Information | Typical retention |
|---|---|
| Enquiries that do not become engagements | Up to 2 years from last contact |
| Client engagement and financial records | Duration of the relationship plus the period required by tax, accounting and limitation laws (generally up to 8 years) |
| Client engagement data handled on a client's behalf | As set out in the engagement agreement; returned or securely deleted at the end of the engagement |
| Training and certification records | Up to 5 years, so we can verify certificates |
| Unsuccessful job applications | Up to 1 year, unless you ask us to keep it longer |
| Marketing preferences and opt-outs | Until you change them; opt-outs are kept so we respect them |
| Website analytics data | Up to 14 months |
When information is no longer needed, we delete it or anonymise it so it can no longer identify you.
09International transfers
We work with clients around the world and operate from India, the United Arab Emirates and Kenya. Some of our service providers store data in other countries. Your information may therefore be processed outside the country where you live.
Whenever we transfer personal information across borders, we take steps to ensure it remains protected — including transferring only to countries permitted by applicable law, using contractual safeguards such as standard contractual clauses where required, and limiting transfers to what is necessary. You can contact us for more information about the safeguards that apply to your information.
10Security
Confidentiality is central to our work. We use reasonable technical and organisational measures appropriate to the sensitivity of the information, including:
- encryption of data in transit and, where supported, at rest
- role-based access and multi-factor authentication
- confidentiality obligations for everyone who handles client data
- segregation of client engagement data by engagement
- vetting and contractual controls for service providers
- logging and monitoring of access to sensitive systems
No system is perfectly secure. If a personal data breach occurs that affects you, we will notify you and the relevant authorities as required by applicable law, explaining what happened and what we are doing about it.
11Cookies and similar technologies
Cookies are small files placed on your device when you visit a website. We use these:
| Type | Purpose | Your choice |
|---|---|---|
| Strictly necessary | Make the site work and keep it secure, and remember your cookie choices | Always on |
| Google Analytics | Tell us, in aggregate, which pages are visited and how visitors arrive, so we can improve content | On unless you reject it* |
| Microsoft Clarity | Heatmaps and recordings of how pages are used, with anything you type hidden, so we can fix what is hard to use | On unless you reject it* |
| Google Ads measurement | Tell us which of our ads lead to enquiries | On unless you reject it* |
| Personalised ads | Let Google use your visit to show you our ads on other websites | Only if you switch it on |
| Embedded content | Videos and other content from third parties such as YouTube may set their own cookies when you play them | Only when you play them |
* When you first visit, a banner offers Accept all, Reject additional (strictly necessary cookies only) and Custom, where each type above has its own switch. If your browser is set to a time zone in the European Economic Area, the United Kingdom or Switzerland, no additional cookies are set until you choose; elsewhere Google Analytics, Microsoft Clarity and Google Ads measurement are on until you reject them. You can change your preferences at any time through the cookie settings on our site (see section 13), and you can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site from working.
12Your rights
Subject to applicable law, you may ask us to:
To exercise a right, contact us using the details in section 16. We may need to verify your identity before acting. We will respond within the time the applicable law requires, and we will not charge you or treat you differently for exercising your rights.
Rights that apply where you live
Under the Digital Personal Data Protection Act, 2023 and its Rules, you have the right to obtain a summary of the personal data we process and the processing activities involved, to know the identities of those we have shared it with, to correct, complete, update and erase your data, to withdraw consent, and to nominate another person to exercise your rights if you die or become incapacitated.
You have the right to readily available grievance redressal: please raise any concern with our Grievance Officer first. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation (or the UK GDPR) gives you the rights listed above, including the rights of access, rectification, erasure, restriction, portability and objection, and the right not to be subject to solely automated decisions with significant effects.
You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work or the place of the alleged infringement.
If you are in the United Arab Emirates, the Federal Decree-Law on the Protection of Personal Data gives you rights to obtain information about, correct, erase and restrict processing of your personal data, to object to processing, and to request transfer of your data, subject to the conditions and exceptions in that law. You may raise a complaint with the UAE Data Office.
If your information is processed by us within a financial free zone with its own data protection law, the rights and authority under that law apply.
If you are in Kenya, the Data Protection Act, 2019 gives you the right to be informed of how your data is used, to access it, to object to its processing, to have false or misleading data corrected, and to have it deleted, subject to the law's conditions.
You may lodge a complaint with the Office of the Data Protection Commissioner.
If you live elsewhere, including in a US state with a consumer privacy law, you may have additional rights under local law. We will honour the rights that apply to you. As noted in section 8, we do not sell personal information or share it for cross-context behavioural advertising unless you switch on personalised ads; a Global Privacy Control signal turns off everything that is not strictly necessary.
13Your privacy choices
You are in control of how we contact you and what we collect when you use our website. These are the choices available to you, and how to use each one.
Marketing emails and newsletters
We send insights, articles and invitations only to people who have asked for them, or to existing clients where the law allows. You can stop them at any time:
- use the unsubscribe link at the foot of any marketing email — it takes effect without you needing to sign in or explain why;
- or email our Grievance Officer asking to be removed from all marketing.
We will act on your request promptly, and within ten working days at most. Opting out of marketing does not stop service messages we must send about an engagement, invoice, training booking or request you have made.
Phone and in-person contact
We do not run cold-calling or postal marketing campaigns. If a Rythium advisor contacts you by phone and you would rather they did not, tell them or our Grievance Officer and we will record your preference so no one calls you again for marketing.
Cookie preferences
When you first visit our website you can accept all cookies, reject those that are not strictly necessary, or choose type by type. You can change your choice at any time using the cookie settings control below, which is also available at the foot of every page.
Your choice is stored in a cookie on the browser and device you are using. If you clear your cookies, or visit from a different browser or device, you will need to set your preferences again. You can also block cookies entirely in your browser settings.
Browser privacy signals
If your browser sends a Global Privacy Control signal, we treat it as a request to decline all non-essential cookies on that browser, and we do not load analytics or embedded third-party content until you choose otherwise. Because industry standards for “Do Not Track” were never agreed, we rely on your cookie settings and the Global Privacy Control signal instead.
Training, events and recruitment
If you attend a masterclass or event, we will only add you to our updates list if you tick the box to agree. If you apply for a role and are not successful, we will ask before keeping your details for future opportunities, and you can ask us to delete them at any time.
Requests about your data
To access, correct, erase or obtain a copy of your personal information, withdraw consent, nominate someone to act for you, or object to how we use it, send your request to our Grievance Officer (see section 16). To help us respond quickly, please include:
- your name and the email address or organisation you have dealt with us through;
- which right you want to exercise and, if you can, which information it concerns;
- if you are acting for someone else, proof that you are authorised to do so.
We will confirm receipt, may ask for reasonable information to verify your identity, and will respond within the time required by the law that applies to you. If we cannot meet your request in full — for example, because the law requires us to keep certain records — we will explain why.
Privacy questions and concerns
For any other question, comment or concern about how we handle personal information — including about our marketing — contact our Grievance Officer. If you are not satisfied with our answer, you can escalate to the data protection authority where you live, as described in section 12.
14Sensitive data and children
Sensitive information. We do not seek to collect sensitive categories of personal information — such as health, financial account, biometric, religious or political data — and ask that you do not send it to us. If it reaches us unintentionally, we delete it unless we must keep it by law. During recruitment we collect only what employment law requires.
Children. Our services are intended for business professionals. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.
15Changes to this policy
We review this policy regularly and will update it when our practices or the law change. The current version will always be on this page. If we make a material change, we will highlight it here and, where we have a direct relationship with you or the law requires it, notify you before the change takes effect.
16Contact and grievances
If you have a question about this policy, want to exercise your rights, or wish to make a complaint, please contact our Grievance Officer. We aim to acknowledge every request promptly and resolve it within the time required by applicable law.
Sheshagiri Anegondi
Designated Partner
Rythium Technologies LLP
408, Vashi Infotech Park, Sector 30 A,
Navi Mumbai, Maharashtra, India
Please include enough detail for us to understand your request, and tell us how you would prefer us to reply.