1. Scope of this notice
This notice covers SINTRIX.in — the public marketing website you are reading right now, operated by SINTRIX.in.
It does not cover personal data that SINTRIX processes on behalf of a client institution under a signed engagement. In that capacity SINTRIX acts as a data processor, the client institution is the data fiduciary, and the processing is governed by a separate data processing agreement. Please direct enquiries about that processing to the institution concerned.
2. Summary
- This website sets no cookies and runs no analytics, advertising or tracking of any kind.
- We load no third-party scripts at runtime. Webfonts are self-hosted from our own domain at build time.
- We collect personal data in one place only: the “Schedule a 40-Minute CCO Briefing” form.
- We do not sell personal data, and we do not use it for advertising or model training.
3. What we collect, and why
When you submit the briefing request form, we collect the following. Fields marked “required” are needed for us to respond; the rest are technical data generated by your browser automatically.
| Data | Required | Why we need it |
|---|---|---|
| Full name and job title | Yes | To address you correctly and route your enquiry to the right person. |
| Institutional work email address | Yes | The primary purpose of the form — we reply to it. |
| Institution type | Yes | To understand which regulatory regime applies to you. |
| Approximate monthly bundled loan volume | Yes | To gauge whether our service is a fit, and to avoid wasting your time if it is not. |
| IP address | Automatic | Abuse prevention only. Used transiently in memory to rate-limit repeated submissions. Not stored in the lead record. |
| Browser user-agent and referring page | Automatic | Diagnosing delivery problems and understanding which channels bring genuine enquiries. |
| Submission timestamp | Automatic | Response-time tracking and record-keeping. |
We do not ask for, and ask that you do not send us, any special-category data — including customer records, loan files, Aadhaar or PAN numbers, financial account details, or health information. If you need to share such material with us, we will put a non-disclosure agreement and a data processing agreement in place first.
4. What we do not do
- No cookies. This site sets no cookies — not even strictly-necessary ones. That is why you are not being asked to dismiss a consent banner: there is nothing to consent to.
- No analytics or tracking. No Google Analytics, no pixels, no session recording, no fingerprinting.
- No advertising. We do not sell, rent or share personal data with advertisers or data brokers.
- No cross-site profiling. We do not build behavioural profiles or track you across other websites.
- No model training. Data you submit is not used to train machine-learning models, whether ours or a third party’s.
5. Lawful basis
We process your personal data on the basis of your consent, given under Section 6 of the Digital Personal Data Protection Act, 2023. The form carries a consent notice that identifies the data being sought and the purpose, and you actively tick it before submitting. Consent must be free, specific, informed, unconditional and unambiguous, given by clear affirmative action — which is why the box is not pre-ticked.
Where you make contact following a referral, a conference, or an existing business relationship, we may also rely on the legitimate uses recognised under Section 7 of the Act.
6. Withdrawing consent
You may withdraw your consent at any time by emailing privacy@sintrix.in. Withdrawal is as easy as giving consent. Once we receive your request we will stop processing your data and delete it, unless we are required by law to retain it — typically for a statutory audit or record-keeping obligation. We will tell you if that is the case.
7. Who else is involved
We share personal data only with the service providers we need in order to operate this website. Each is bound by contract and processes data only on our instructions:
- Airtable — the system of record where enquiry submissions are stored, viewable and exportable by our team. This is the durable copy.
- Netlify — hosts the website and receives the form submission as a serverless function.
- Resend — sends the internal notification email, when email notifications are enabled. This processor is only engaged if we have configured it; if we have not, your submission stays entirely within our hosting provider.
- your configured webhook endpoint (e.g. Slack, Zapier or Make) — receives the submission so the team is alerted in real time, when this route is enabled.
We may also disclose data where we are legally compelled to do so by a court order, statutory authority, or applicable law, or where necessary to establish, exercise or defend a legal claim.
8. Where your data is processed
Our hosting, storage and email providers operate globally distributed infrastructure, so your submission may be processed and stored outside India — including by Airtable, which holds our lead store on infrastructure it operates internationally. Section 16 of the Act permits transfer of personal data outside India unless the Central Government restricts transfer to a specified country or territory by notification, and no such restriction currently applies to the countries in which our providers operate. We will update this notice if that changes.
This paragraph concerns this website. Residency commitments described elsewhere in our marketing materials relate to client production deployments governed by a separate data processing agreement, and are scoped accordingly.
9. How long we keep it
- Enquiry records — held in our lead store (Airtable) for up to 24 months from your last interaction with us, then deleted. If we enter into an engagement, the engagement contract governs retention instead.
- Operational log entries — our hosting provider records each submission in its function log. That log is retained for a short, fixed period set by the provider (currently 24 hours on our plan) and is used for troubleshooting only, not as our record of your enquiry. We treat those log entries as transient.
- Rate-limiting data — held in the memory of a single function instance for at most 60 seconds, and never persisted.
If you would like your enquiry deleted before the retention period ends, contact us at privacy@sintrix.in and we will act on it.
10. How we protect it
Submissions are transmitted over TLS and stored in access-controlled infrastructure operated by our hosting provider. Access is limited to personnel who need it to respond to your enquiry. We apply rate limiting and bot-detection measures to the submission endpoint. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we will notify you and the Data Protection Board of India of a personal data breach affecting you, as required by Section 8 of the Act.
11. Your rights
As a Data Principal you have the following rights under the Act. To exercise any of them, email privacy@sintrix.in. We will respond within the timeframe required by law.
- Right to access — a summary of the personal data we hold about you and the identities of the parties with whom we have shared it.
- Right to correction and erasure — correction of inaccurate or misleading data, and erasure of data we no longer need for the purpose it was collected.
- Right of grievance redressal — a readily available means of complaining to us. We will respond to a grievance within the period prescribed by the Act.
- Right to nominate — to nominate another individual to exercise your rights in the event of your death or incapacity.
If we do not resolve your grievance, you may complain to the Data Protection Board of India. Please give us the opportunity to fix the issue first.
12. Children
This website is a business-to-business service and is not directed at children. We do not knowingly process the personal data of a child. The briefing form requires a corporate email address and is intended for professional use. If you believe a child has submitted personal data to us, contact us and we will delete it.
13. Automated processing
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects. The automated measures we do apply — rate limiting and spam filtering — exist to protect the service from abuse, act only on transient technical data, and do not evaluate you as an individual.
Separately, the SINTRIX product evaluates the conduct records of a client institution’s customers under that institution’s instruction. It is not a decision-maker about you as a website visitor, and it does not make decisions about creditworthiness or insurance eligibility.
14. Changes to this notice
If we change how we handle personal data we will update this page and move the “last updated” date at the top. Material changes affecting data we already hold will be notified to affected individuals directly.
15. Contact us
Data protection enquiries: privacy@sintrix.in
Grievance Officer: grievance@sintrix.in
Security disclosures: security@sintrix.in
For the terms governing your use of this website, see our Terms of Service.