1. About this policy
The Pixel and Pine Studio (“we”, “us”, “our”) operates www.thepixelandpinestudio.com and provides data and analytics, digital marketing and IT staffing services. For personal data we collect for our own purposes, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023. Where we process personal data on behalf of a client as part of a project, we act as that client's Data Processor and process it only on their documented instructions under our agreement with them.
This notice is provided in English. You may request it in any language listed in the Eighth Schedule to the Constitution of India by writing to privacy@pixelandpinestudio.com.
2. Laws we follow
- The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025, as they come into force.
- The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”).
- Other applicable Indian laws, and, where we serve clients outside India, the data protection laws that apply to that engagement.
3. Personal data we collect
Information you give us
- Enquiries: your name, email address, phone number, company and the contents of your message when you use our contact form or write to us.
- Candidates: if you apply for a role or join our talent network, your CV, work history, skills, qualifications, current and expected compensation, notice period, location preferences and references you choose to share.
- Clients and suppliers: business contact details of the people we work with, and information needed for contracts, invoicing and tax compliance.
Information collected automatically
- Technical data processed by our hosting provider when you visit the website, such as IP address, browser type, device information, pages requested and time of visit. This is used for security and to keep the website running.
We do not ask for passwords, financial account details, health data or biometric data through this website. Please do not include them in messages. If we need sensitive information for a specific purpose, such as a background check you have agreed to, we will ask for it separately and explain why.
4. Why we use your personal data
| Purpose | Basis under the DPDP Act |
|---|---|
| Responding to your enquiry and preparing proposals | Your consent, and the legitimate use of data you voluntarily provide for that purpose (Section 7(a)) |
| Delivering services under a contract with you or your employer | Consent and the specified purpose for which you provided the data |
| Recruitment: assessing your profile and, with your agreement, presenting it to client companies | Your consent, which we ask for before sharing your profile with any client |
| Invoicing, accounting, tax and other legal obligations | Compliance with law (Section 7) |
| Keeping the website secure and preventing fraud or misuse | Legitimate uses permitted by law |
| Sending occasional updates about our services | Only with your separate, opt-in consent. You can unsubscribe at any time |
We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
5. Consent and withdrawal
Where we rely on consent, it is free, specific, informed, unconditional and unambiguous, and limited to the purpose stated when we ask for it. You can withdraw consent at any time by writing to privacy@pixelandpinestudio.com or through our contact form; withdrawing is as easy as giving consent. Withdrawal does not affect processing already carried out, and we will stop processing and erase the data within a reasonable time unless we must keep it by law. You may also manage consent through a Consent Manager registered with the Data Protection Board of India, once such managers are available.
6. Who we share it with
- Service providers (Data Processors) that help us run our business, such as website hosting (Vercel), domain and email routing (Cloudflare), email delivery and productivity tools. They process data only on our instructions under contracts that require appropriate safeguards.
- Client companies, when you are a candidate and you have agreed to us presenting your profile for a specific role.
- Professional advisers such as lawyers, auditors and accountants, under a duty of confidentiality.
- Government and law enforcement authorities, when required by law, court order or a lawful request.
- A successor business, in the event of a merger, acquisition or restructuring, subject to this policy.
7. Transfers outside India
Some of our service providers store or process data on servers outside India. We transfer personal data outside India only as permitted under Section 16 of the DPDP Act and will not transfer it to any country or territory the Central Government has restricted by notification. We require providers to protect data to a standard no lower than this policy.
8. How long we keep it
- Enquiries that do not lead to an engagement: up to 24 months after our last contact.
- Candidate profiles: up to 24 months after our last contact, or until you ask us to delete them.
- Client and contract records: for the term of the engagement and as long as required by tax, accounting and other laws, typically eight years.
- Security logs: for at least one year where required by law, and otherwise no longer than needed.
When personal data is no longer needed for its purpose or the law, we erase it and ask our processors to do the same.
9. How we protect it
We maintain reasonable security safeguards, as required by Section 8(5) of the DPDP Act and Rule 8 of the SPDI Rules, including encryption in transit (HTTPS), access limited to people who need it, strong authentication on business accounts, confidentiality obligations for our team and contractors, and regular review of access. No system is completely secure, but we work to protect your data and to respond quickly if something goes wrong.
10. Personal data breaches
If a personal data breach occurs, we will inform the Data Protection Board of India and each affected person as required by the DPDP Act and Rules, describing what happened, the likely impact, the steps we are taking and what you can do to protect yourself.
11. Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we process about you, the processing activities, and the identities of others we have shared it with (Section 11).
- Correction, completion, updating and erasure of your personal data (Section 12).
- Grievance redressal through our Grievance Officer (Section 13).
- Nominate another person to exercise your rights in the event of your death or incapacity (Section 14).
- Withdraw consent at any time, as described above.
To exercise any right, write to privacy@pixelandpinestudio.com from the email address we hold, or use our contact form. We may need to verify your identity. We aim to respond within 30 days and in any case within the period prescribed under the DPDP Rules.
12. Your duties
Under Section 15 of the DPDP Act, please give us accurate information, do not impersonate anyone, do not suppress material information, and do not file false or frivolous complaints.
13. Children
Our website and services are intended for businesses and adult professionals. We do not knowingly collect personal data of anyone under 18 without verifiable consent of a parent or lawful guardian, and we do not track, monitor behaviour of, or target advertising at children. If you believe a child has sent us personal data, contact privacy@pixelandpinestudio.com and we will delete it.
14. Cookies
This website does not use advertising or analytics cookies. See our Cookie policy for details.
15. Grievance officer
In line with Section 13 of the DPDP Act and Rule 5(9) of the SPDI Rules, you can raise any question, complaint or request about your personal data with our Grievance Officer:
We will acknowledge your grievance promptly and resolve it within one month of receipt. If you are not satisfied with our response, you may complain to the Data Protection Board of India after exhausting this grievance process, as provided under the DPDP Act.
16. Changes to this policy
We may update this policy to reflect changes in law or in how we work. The latest version will always be on this page with its date. If changes are significant, we will tell you through the website or by email before they take effect.