01Introduction
Rythium Technologies LLP (“Rythium”, “we”, “us”) is an independent advisory firm specialising in enterprise software licensing and AI procurement. Our clients trust us with commercially sensitive information about their software estates, contracts and negotiations. We apply the same discipline to the personal information of everyone we deal with — website visitors, clients, prospective clients, training participants, job applicants and suppliers.
This policy describes how we collect, use, disclose, store and protect personal information, and how you can exercise your rights. Where we say “personal information” we mean any information that relates to an identified or identifiable individual.
02Scope
This policy applies to personal information we process when you:
- visit our website or watch our content on third-party channels such as YouTube;
- contact us, request a consultation or book Advisor on Call time;
- engage us for advisory services such as licence reviews, audit defence, ULA certification, the SAVE Review Program or AI procurement negotiation;
- register for or attend a masterclass, training session, webinar or event;
- apply to work with us, or supply goods or services to us.
Client engagement data. During an engagement we may handle data that belongs to our client — for example, software deployment records produced by discovery tools such as Euladox, or user lists from licence systems. For that data we act on our client's instructions, and the engagement agreement and any data processing terms in it govern how it is handled. Where those terms differ from this policy, the agreement prevails.
03Who is responsible for your information
Rythium Technologies LLP, headquartered in Navi Mumbai, India, is responsible for the personal information described in this policy and is the “data fiduciary” for the purposes of India's Digital Personal Data Protection Act, 2023 (and the “controller” under laws that use that term).
Our teams in Dubai and Nairobi work under this same policy. Where personal information is collected through one of those offices, that office may also be responsible for it under local law. Contact details for all privacy matters are in section 16.
04Information we collect
We collect only what we need for the purposes in section 5. Most of it you give us directly; some is generated when you use our website; a small amount comes from public or professional sources.
| Category | Examples | Source |
|---|
| Identity & contact | Name, job title, employer, business email, phone number, country | You, or a colleague who introduces you |
| Enquiry content | What you tell us in forms, emails, calls and meetings about your licensing or procurement situation | You |
| Engagement records | Contracts, proposals, invoices, correspondence, meeting notes, project contacts and approvals | You and your organisation |
| Training & events | Registration details, attendance, course feedback, certificates issued | You, or your employer when it registers you |
| Recruitment | CV, qualifications, employment history, interview notes, references | You, referees, recruitment platforms |
| Technical & usage | IP address, browser and device type, pages viewed, referring site, approximate location derived from IP | Our website, cookies and similar technologies |
| Marketing preferences | Your subscription choices and whether you have opted out | You |
| Professional information | Publicly available business profile details, used to understand who we are speaking with | Company websites, professional networks |
We do not ask for, and ask you not to send us, identity numbers, bank or card details, or health information through our website or general email.
05How we use your information
Responding to you
Answering enquiries, arranging consultations, and following up on conversations you started.
Delivering our services
Scoping, contracting, performing and invoicing advisory engagements, Advisor on Call blocks and the SAVE Review Program.
Training & events
Registering participants, running sessions, issuing certificates and improving course content from feedback.
Running our website
Operating, securing and improving the site, understanding which content is useful, and fixing faults.
Keeping in touch
Sending insights, articles and event invitations where you have agreed to receive them, or where the law allows us to contact existing clients. Every message includes a way to opt out.
Recruitment
Assessing applications, arranging interviews and, if you join us, starting your employment record.
Security & integrity
Protecting our systems, detecting misuse and keeping records of who has accessed client information.
Legal obligations
Meeting tax, accounting and regulatory requirements, and establishing, exercising or defending legal claims.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you.
06Our basis for processing
We only process personal information where the law allows it. Depending on the situation and where you are, we rely on one or more of the following:
- Consent — for example, when you subscribe to our updates or accept non-essential cookies. You can withdraw consent at any time, as easily as you gave it; withdrawal does not affect processing that took place before.
- Contract — where the processing is needed to enter into or perform an agreement with you or your organisation.
- Legitimate uses and legitimate interests — such as processing information you voluntarily provide for a specified purpose, running and securing our business, and maintaining relationships with existing clients, always balanced against your rights.
- Legal obligation — where the law requires us to keep or disclose information.
For individuals in India, we process personal information on the basis of your consent or for the legitimate uses permitted by the Digital Personal Data Protection Act, 2023. When we ask for consent, we will tell you clearly what information we want and why.
07How long we keep it
We keep personal information only for as long as the purpose for which we collected it continues, plus any period the law requires. Typical periods are:
| Information | Typical retention |
|---|
| Enquiries that do not become engagements | Up to 2 years from last contact |
| Client engagement and financial records | Duration of the relationship plus the period required by tax, accounting and limitation laws (generally up to 8 years) |
| Client engagement data handled on a client's behalf | As set out in the engagement agreement; returned or securely deleted at the end of the engagement |
| Training and certification records | Up to 5 years, so we can verify certificates |
| Unsuccessful job applications | Up to 1 year, unless you ask us to keep it longer |
| Marketing preferences and opt-outs | Until you change them; opt-outs are kept so we respect them |
| Website analytics data | Up to 14 months |
When information is no longer needed, we delete it or anonymise it so it can no longer identify you.
08When we disclose your information
Our independence commitment
We receive no fees, commissions or referral payments from any software publisher. We never share your information, or your organisation's licensing data, with Oracle, Microsoft, Broadcom, IBM, Red Hat, Adobe, any AI provider or any other publisher unless you instruct us to — for example, when we represent you in an audit or negotiation. We do not sell personal information, and we do not share it for advertising.
We disclose personal information only to:
- Our team and offices — Rythium partners, staff and associates bound by confidentiality, on a need-to-know basis.
- Service providers — carefully selected providers who host our website, handle form submissions and email, provide cloud storage and productivity tools, run analytics, process payments or support recruitment. They act only on our instructions, under written terms that require them to protect the information.
- Professional advisers — lawyers, auditors and insurers, under duties of confidentiality.
- Counterparties you direct us to — such as a software publisher, reseller or legal counsel, when it is part of the work you have engaged us for.
- Authorities — courts, regulators, law enforcement or other public bodies where the law requires it, or where it is necessary to protect rights, safety or property.
- A successor business — if Rythium is reorganised, merged or sold, subject to equivalent protections, and with notice to you where required.
09International transfers
We work with clients around the world and operate from India, the United Arab Emirates and Kenya. Some of our service providers store data in other countries. Your information may therefore be processed outside the country where you live.
Whenever we transfer personal information across borders, we take steps to ensure it remains protected — including transferring only to countries permitted by applicable law, using contractual safeguards such as standard contractual clauses where required, and limiting transfers to what is necessary. You can contact us for more information about the safeguards that apply to your information.
10Security
Confidentiality is central to our work. We use reasonable technical and organisational measures appropriate to the sensitivity of the information, including:
- encryption of data in transit and, where supported, at rest
- role-based access and multi-factor authentication
- confidentiality obligations for everyone who handles client data
- segregation of client engagement data by engagement
- vetting and contractual controls for service providers
- logging and monitoring of access to sensitive systems
No system is perfectly secure. If a personal data breach occurs that affects you, we will notify you and the relevant authorities as required by applicable law, explaining what happened and what we are doing about it.
11Cookies and similar technologies
Cookies are small files placed on your device when you visit a website. We use them sparingly:
| Type | Purpose | Your choice |
|---|
| Strictly necessary | Make the site work and keep it secure, and remember your cookie choices | Always on |
| Analytics | Tell us, in aggregate, which pages are visited and how visitors arrive, so we can improve content | Only with your consent |
| Embedded content | Videos and other content from third parties such as YouTube may set their own cookies when you play them | Only with your consent |
We do not use advertising or cross-site tracking cookies. You can change your preferences at any time through the cookie settings on our site (see section 13), and you can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site from working.
12Your rights
Subject to applicable law, you may ask us to:
AccessConfirm whether we process your information and receive a summary or copy of it
CorrectFix information that is inaccurate, complete what is missing, or update it
EraseDelete information we no longer need or have no right to keep
Withdraw consentStop processing that relies on your consent, including marketing
Object or restrictObject to processing based on legitimate interests, or limit how we use it
PortabilityReceive information you gave us in a portable format, where the law provides for it
To exercise a right, contact us using the details in section 16. We may need to verify your identity before acting. We will respond within the time the applicable law requires, and we will not charge you or treat you differently for exercising your rights.
Rights that apply where you live
Under the Digital Personal Data Protection Act, 2023 and its Rules, you have the right to obtain a summary of the personal data we process and the processing activities involved, to know the identities of those we have shared it with, to correct, complete, update and erase your data, to withdraw consent, and to nominate another person to exercise your rights if you die or become incapacitated.
You have the right to readily available grievance redressal: please raise any concern with our Grievance Officer first. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation (or the UK GDPR) gives you the rights listed above, including the rights of access, rectification, erasure, restriction, portability and objection, and the right not to be subject to solely automated decisions with significant effects.
You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work or the place of the alleged infringement.
If you are in the United Arab Emirates, the Federal Decree-Law on the Protection of Personal Data gives you rights to obtain information about, correct, erase and restrict processing of your personal data, to object to processing, and to request transfer of your data, subject to the conditions and exceptions in that law. You may raise a complaint with the UAE Data Office.
If your information is processed by us within a financial free zone with its own data protection law, the rights and authority under that law apply.
If you are in Kenya, the Data Protection Act, 2019 gives you the right to be informed of how your data is used, to access it, to object to its processing, to have false or misleading data corrected, and to have it deleted, subject to the law's conditions.
You may lodge a complaint with the Office of the Data Protection Commissioner.
If you live elsewhere, including in a US state with a consumer privacy law, you may have additional rights under local law. We will honour the rights that apply to you. As noted in section 8, we do not sell personal information or share it for cross-context behavioural advertising.
13Your privacy choices
You are in control of how we contact you and what we collect when you use our website. These are the choices available to you, and how to use each one.
A
Marketing emails and newsletters
We send insights, articles and invitations only to people who have asked for them, or to existing clients where the law allows. You can stop them at any time:
- use the unsubscribe link at the foot of any marketing email — it takes effect without you needing to sign in or explain why;
- or email our Grievance Officer asking to be removed from all marketing.
We will act on your request promptly, and within ten working days at most. Opting out of marketing does not stop service messages we must send about an engagement, invoice, training booking or request you have made.
B
Phone and in-person contact
We do not run cold-calling or postal marketing campaigns. If a Rythium advisor contacts you by phone and you would rather they did not, tell them or our Grievance Officer and we will record your preference so no one calls you again for marketing.
C
Cookie preferences
When you first visit our website you can accept or decline cookies that are not strictly necessary. You can change your choice at any time using the cookie settings control below, which is also available at the foot of every page.
Your choice is stored in a cookie on the browser and device you are using. If you clear your cookies, or visit from a different browser or device, you will need to set your preferences again. You can also block cookies entirely in your browser settings.
D
Browser privacy signals
If your browser sends a Global Privacy Control signal, we treat it as a request to decline all non-essential cookies on that browser, and we do not load analytics or embedded third-party content until you choose otherwise. Because industry standards for “Do Not Track” were never agreed, we rely on your cookie settings and the Global Privacy Control signal instead.
E
Training, events and recruitment
If you attend a masterclass or event, we will only add you to our updates list if you tick the box to agree. If you apply for a role and are not successful, we will ask before keeping your details for future opportunities, and you can ask us to delete them at any time.
F
Requests about your data
To access, correct, erase or obtain a copy of your personal information, withdraw consent, nominate someone to act for you, or object to how we use it, send your request to our Grievance Officer (see section 16). To help us respond quickly, please include:
- your name and the email address or organisation you have dealt with us through;
- which right you want to exercise and, if you can, which information it concerns;
- if you are acting for someone else, proof that you are authorised to do so.
We will confirm receipt, may ask for reasonable information to verify your identity, and will respond within the time required by the law that applies to you. If we cannot meet your request in full — for example, because the law requires us to keep certain records — we will explain why.
G
Privacy questions and concerns
For any other question, comment or concern about how we handle personal information — including about our marketing — contact our Grievance Officer. If you are not satisfied with our answer, you can escalate to the data protection authority where you live, as described in section 12.
14Sensitive data and children
Sensitive information. We do not seek to collect sensitive categories of personal information — such as health, financial account, biometric, religious or political data — and ask that you do not send it to us. If it reaches us unintentionally, we delete it unless we must keep it by law. During recruitment we collect only what employment law requires.
Children. Our services are intended for business professionals. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.
15Changes to this policy
We review this policy regularly and will update it when our practices or the law change. The current version will always be on this page. If we make a material change, we will highlight it here and, where we have a direct relationship with you or the law requires it, notify you before the change takes effect.