Privacy Policy.
Tranquility Cybersecurity Services Private Limited (“Tranquility Cybersecurity”, “TCSA”, “we”, “us”), with its registered office in Gurugram, India, is the data fiduciary (DPDP Act, 2023) and data controller (GDPR / UK GDPR) for personal data processed through this website, tcsa.in. We provide compliance consulting and audit-coordination services across India, the USA, the UK, Australia & the UAE — and we hold our own data practices to the standards we audit against.
1. What we collect, and why.
| Data | Source | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Name, work e-mail, phone, company, message, service interest, and the IP address you sent the form from with the approximate location it indicates (city, region, country) | Contact / intake forms | Responding to your enquiry, scoping and delivering services, and screening spam and verifying enquiries | Art. 6(1)(b) pre-contract steps; 6(1)(f) legitimate interest |
| Scheduling details (name, e-mail, chosen slot) | Calendly booking calendar, embedded on our pages | Booking and holding consultations | Art. 6(1)(b) |
| Usage analytics (pages viewed, approximate location, device) | Google Analytics. In the UK, the EEA and Switzerland only after you accept (until then, only the basic signals described in Section 2), elsewhere on every visit | Understanding and improving the site | In the UK, the EEA and Switzerland, consent (Art. 6(1)(a)). We ask first, and you can withdraw at any time with “Cookie notice” in the footer. Elsewhere, Art. 6(1)(f) legitimate interest in understanding how visitors use the site so we can improve it. You can object at any time. The tag runs in your browser, so the way to object is there, most simply with Google’s Analytics opt-out add-on (see Section 2) |
| Ad-click identifiers (gclid, gbraid, wbraid) and campaign tags (utm_*) linked to an enquiry or booking | Google Ads and the link you arrived by (first-party cookies, 90 days). In the UK, the EEA and Switzerland the cookies are set only after you accept | Measuring which campaigns lead to genuine enquiries | In the UK, the EEA and Switzerland, consent (Art. 6(1)(a)). We ask first, and you can withdraw at any time with “Cookie notice” in the footer. Elsewhere, Art. 6(1)(f) legitimate interest in knowing which campaigns bring genuine enquiries. You can object at any time by e-mailing us or by deleting these cookies in your browser (see Section 2) |
| Ad measurement events (page visits, enquiries) | Google Ads (including remarketing) and ChatGPT Ads measurement by OpenAI. In the UK, the EEA and Switzerland only after you accept (until then, only Google’s basic signals described in Section 2), elsewhere on every visit | Measuring which ads bring visits and enquiries. Google remarketing also lets us show our ads again to people who have visited | In the UK, the EEA and Switzerland, consent (Art. 6(1)(a)). We ask first, and you can withdraw at any time with “Cookie notice” in the footer. Elsewhere, Art. 6(1)(f) legitimate interest in seeing which of our ads work and in showing our ads again to people who have visited. You can object at any time. These tags run in your browser, so you object there and in your Google account, by blocking this site’s cookies and third-party cookies and by turning off ad personalisation in Google’s My Ad Center (see Section 2) |
| Server logs (IP, timestamps, requested URLs) | Hosting infrastructure | Security, abuse prevention, availability | Art. 6(1)(f) |
Under the DPDP Act, we process the form and scheduling data for the specified purpose you provide it for, with notice at the point of collection. In the UK, the EEA and Switzerland, analytics and advertising tags wait until you accept. Elsewhere they load on every visit. Section 2 explains what they do and how to opt out.
2. Cookies and tracking tags.
If you visit from the UK, the EEA or Switzerland, we ask first and the tags wait. Until you accept, Google Analytics and Google Ads run in Google’s consent mode, which sets none of their cookies and sends Google only basic signals that carry no cookie identifiers, and the OpenAI pixel does not load. “Reject” keeps it that way, and you can change your answer at any time with “Cookie notice” in the footer.
Everywhere else, Google Analytics, Google Ads (including remarketing) and ChatGPT Ads measurement by OpenAI load on every visit to this site. Our cookie notice tells you they are there. It does not switch them off. The Cookie Policy lists each cookie, what it does and how long it lasts, and shows how to opt out through your browser, Google’s own tools or by e-mailing us:
3. Who processes data for us.
- Google — Analytics, Ads measurement and remarketing, and Workspace (enquiry records are stored in access-controlled Google Workspace).
- OpenAI OpCo, LLC — ChatGPT Ads measurement (the OpenAI pixel records visits and enquiries so we can see which ChatGPT ads work).
- Calendly — consultation scheduling (its own privacy notice applies when you book).
- Attio — our CRM, where enquiries and bookings are recorded.
- E-mail delivery and hosting/CDN providers — to deliver notifications and serve the site.
We do not sell personal data for money, and we do not give or rent our enquiry records to anyone for their own marketing. The Google and OpenAI tags described in Section 2 work differently. They send those companies details of your visit, such as the pages you view, your IP address and browser, cookie and ad-click identifiers, and whether you sent an enquiry or booked a call. In the UK, the EEA and Switzerland they do this only after you accept, apart from the basic signals without cookie identifiers that Google’s consent mode sends before then. When you send an enquiry, the Google tag also sends Google a hashed (one-way scrambled) copy of the e-mail address and phone number you entered, and the OpenAI pixel sends OpenAI a hashed copy of the e-mail address, so each can match the enquiry to an ad click and tell us which ads work. In the UK, the EEA and Switzerland this happens only after you accept. If you arrived from a Google ad, we may also tell Google whether your enquiry went on to become a genuine lead or a client, identifying it only by the ad-click identifier, so we can see which ads work. Google and OpenAI may use these details for their own purposes too, under their own privacy policies, and for those uses they are not acting on our instructions. Google’s page on how it uses information from sites that use its services explains its part. Processors act under contract, only on our instructions.
4. International transfers.
We operate from India and serve clients in the USA, UK, Australia & UAE. Where data moves across borders (for example to processors above), we rely on the processor’s recognised safeguards — for EU/UK data, standard contractual clauses or an adequacy mechanism.
5. Retention.
Enquiry records are kept while we correspond with you and for up to 24 months after last contact, then deleted or anonymised, unless an engagement (governed by its own agreement) or a legal obligation requires longer. The cookie-notice record (tq_consent) is kept 12 months. The region marker (tq_region), set only for visitors in the UK, the EEA and Switzerland, lasts 30 days. Server logs rotate on short cycles.
6. Your rights.
India — DPDP Act, 2023
- Access a summary of your personal data and processing activities;
- Correction, completion, updating and erasure;
- Withdraw consent as easily as you gave it;
- Grievance redressal with us, and thereafter complaint to the Data Protection Board of India;
- Nominate another person to exercise your rights in case of death or incapacity.
EU / UK — GDPR & UK GDPR
- Access, rectification, erasure, restriction, portability, and objection (including to legitimate-interest processing);
- Withdraw consent at any time without affecting prior processing;
- Complain to your supervisory authority (in the UK, the ICO).
California — CCPA/CPRA
Rights to know, delete and correct. We do not sell personal information for money. Under the CPRA’s broad definitions, though, what we pass to Google and OpenAI through the tags in Section 2, and the ad results described in Section 3, may count as “selling” or “sharing” it. The tags pass details of your visit, including whether you sent an enquiry or booked a call, to those companies for analytics, ad measurement and Google remarketing, and those companies may also use them for their own purposes. There is no setting on this site that turns them off. You can limit them yourself with the browser and Google controls in our Cookie Policy, or with a tracker-blocking browser extension, which usually stops tags like these loading at all. To use any of the rights above, e-mail info@tcsa.in.
Australia
We handle personal information consistently with the Australian Privacy Principles.
7. Grievance officer & contact.
E-mail: info@tcsa.in · Phone: +91 98715 79705
Tranquility Cybersecurity Services Private Limited · GSTIN 06AAMCT8934F1ZY
Registered office: 7th Floor, Worxspace, Welldone Tech Park, Sohna Road, Sector 48, Gurugram, Haryana 122018
Bengaluru office: Mangalam Ecstasy, 8th Floor, Hosabasavanapura, Bengaluru, Karnataka 560049
We acknowledge grievances promptly and resolve them within the timelines the DPDP Act prescribes.
8. Security.
Access-controlled storage, least-privilege access, encrypted transport (TLS) everywhere, and internal practices aligned with the frameworks we implement for clients (ISO/IEC 27001 among them).
9. Children.
Our services and site are addressed to businesses. We do not knowingly process children’s data.
10. Changes.
We update this notice when our practices change and revise the date above. Material changes are flagged on this page.