Privacy Notice

This notice explains how Brand Defence Consulting Private Limited, trading as Brand Defence & Integrity ("BDI", "we"), handles personal data collected through www.branddefenceglobal.com and www.branddefenceindia.com, including our forms, our website assistant Vigil and The BDI Lookout briefing. It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025.

It does not cover personal data we process when we act for clients. That work is governed by our engagement terms and the law. Nor does it cover speak-up reports made through Whistle Sentinel, which carries its own privacy notice for each organisation that uses it.

1. Who is responsible for your data

BDI is the data fiduciary for personal data collected through this website. For any question about this notice or your data, contact our Grievance Officer:

E-mail: Contact@branddefenceindia.com (subject line: "Privacy")
Post: Grievance Officer, Brand Defence Consulting Private Limited, Office No. 10, 3rd Floor, Vivekanand Villa, S V Road, Next to Shoppers Stop, Andheri (W), Mumbai, Maharashtra 400058
Registered office: D/65, Piknik Apartment, Jeet Nagar, JP Road, Versova, Azad Nagar, Andheri West, Mumbai, Maharashtra 400053

2. What we collect, why, and for how long

We collect only what you choose to give us, plus the minimum technical data needed to run the website. We do not use advertising or analytics cookies, and we do not buy personal data.

Personal data	Purpose	Retention
Enquiry form: name, work e-mail, organisation, designation, phone, market, topic and your message	To respond to your enquiry and, if you wish, arrange a confidential call	Up to 24 months after our last contact with you
Demo request: name, work e-mail, organisation, designation, organisation size, preferred date and your notes	To schedule and run a platform demonstration	Up to 24 months after our last contact with you
Vigil chat call-back request: name, work e-mail, organisation, phone, the topic and the questions you typed	To call you back about the service you asked about	Up to 24 months after our last contact with you
CV submission: name, e-mail, phone, city, area of interest, experience, LinkedIn profile, CV and covering note	To consider you for current and future roles at BDI	Up to 12 months, unless you ask us to delete it sooner
The BDI Lookout briefing: e-mail address	To send the briefing	Until you unsubscribe
Server logs: IP address, browser type, pages requested, date and time	To deliver the website securely and investigate misuse	Up to 90 days

Please do not send sensitive personal data, names of people you suspect, or confidential documents through our forms or the chat. A BDI partner will agree a secure way to receive them once a confidentiality agreement is in place.

3. Our legal basis

We process the data in the table above on the basis of your consent, which you give when you tick the consent box on a form, request a call back in the chat or subscribe to the briefing. Server logs are kept for the legitimate purpose of securing the website and meeting our legal obligations. We use your data only for the purpose you gave it for.

4. Withdrawing consent

You can withdraw consent at any time, as easily as you gave it: write to Contact@branddefenceindia.com, or use the unsubscribe link in any briefing. We will then stop processing your data and delete it, unless the law requires us to keep it. Withdrawal does not affect processing that took place before it.

5. Mr Vigil, our website assistant

Mr Vigil answers questions about BDI, its services, the rules it helps clients meet, careers and the Academy. He gives general information, not legal advice, and he does not make decisions about you. You can ask to be connected with a BDI partner at any time.
If you choose to talk by voice, your browser turns your speech into text. Depending on your browser, this may be done by the browser provider's speech service (for example, Google in Chrome or Apple in Safari) under that provider's own privacy terms. The assistant receives only the resulting text, which is treated like a typed message.
Replies read aloud use the voices built into your device. Nothing is sent to BDI to do this.
If you choose hand-sign mode, your camera is used only to recognise a small set of hand signs. The recognition runs entirely in your browser: the video is never recorded, stored or sent to BDI or anyone else. The recognition software and model are downloaded from jsDelivr and Google's servers when you first switch the mode on.
Your conversation is kept in your browser's session storage so it survives page changes. It is cleared when you close the tab. We do not receive it unless you submit a call-back request.
If you submit a call-back request, we receive your contact details, the topic and the questions you typed, so that the partner who calls you understands your need.
Where Vigil is connected to an AI service to write its replies, the text of your messages is sent to that service provider to generate a response. The provider acts on our instructions and does not use the data to train its models.

6. Who we share data with

We do not sell personal data. We share it only with:

service providers who host the website, process form submissions, send e-mail or power Vigil, acting on our instructions under contract;
our professional advisers, under a duty of confidentiality; and
courts, regulators or law-enforcement agencies, where the law requires it.

The map on our Contact page is provided by Google Maps and loads from Google's servers, subject to Google's own privacy policy.

7. Transfers outside India

Some of our service providers may process data outside India. We transfer personal data only to countries the Government of India has not restricted under section 16 of the DPDP Act, and only with contractual safeguards in place.

8. How we protect your data

This website is served over encrypted connections (HTTPS). Access to the data we receive is limited to the people who need it to respond to you, and BDI staff are bound by confidentiality obligations. If a personal data breach occurs, we will inform you and the Data Protection Board of India as the DPDP Act and Rules require.

9. Your rights

Under the DPDP Act you have the right to:

obtain a summary of the personal data we hold about you and how we process it, and the identities of those we have shared it with;
have inaccurate or incomplete data corrected, completed or updated, and have data erased once it is no longer needed for the purpose you gave it for;
withdraw your consent;
have a grievance redressed by us; and
nominate another person to exercise these rights if you die or are unable to.

To exercise a right, write to Contact@branddefenceindia.com with the subject "Privacy". We may ask you to verify your identity. We will respond within the timelines the DPDP Rules set.

10. Complaints

If you are not satisfied with how we handle your data, please contact our Grievance Officer first. If you remain unsatisfied after our response, you may complain to the Data Protection Board of India.

11. Children

This website is meant for businesses and professionals. It is not directed at anyone under 18, and we do not knowingly collect children's personal data. If you believe a child has sent us personal data, contact us and we will delete it.

12. Visitors from the UAE and other countries

If you contact us from the UAE or elsewhere, we will also respect the rights you hold under your local data-protection law, including the UAE's Personal Data Protection Law where it applies. Contact us to exercise them.

13. Cookies and storage

This website does not set advertising or analytics cookies. See our cookie notice for the limited browser storage it uses.

14. Changes to this notice

We will post any change to this notice on this page and update the date at the top. If a change affects how we use data you have already given us, we will ask for your consent again where the law requires it.