Privacy policy

Effective 25 October 2026

This policy explains what personal data Brand E5 collects on brande5.com, why, who else handles it and what rights you have. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, and it also follows the EU General Data Protection Regulation (GDPR) and US privacy laws such as the California Online Privacy Protection Act, so visitors from those places get the same protection.

Who we are

Brand E5 is run by Bharath Yadav, a sole proprietorship being registered in India, based in Hyderabad, Telangana, India. For this website we decide why and how your data is used, which makes us the Data Fiduciary under the DPDP Act and the controller under the GDPR.

Contact for anything in this policy: bharath@brande5.com.

The short version

  • We collect only what you choose to send us, plus anonymous page statistics.
  • We set no cookies and run no advertising or tracking scripts, so there is no cookie banner.
  • We never sell your data or share it for advertising.
  • Contact form messages are stored in Mumbai and deleted after 24 months unless you become a client.
  • You can ask us at any time to see, correct or delete your data.

What we collect

When you use the contact form

Your name, phone number, email (optional), the service and budget you pick, your message and the page you sent it from. We also record your browser's user agent (for example "Chrome on Android") and a scrambled (hashed) form of your IP address. The hash is made with a secret value that changes every month, so it cannot be turned back into your IP address or linked across months. We never store the IP address itself.

When you rate a blog post

Whether you found the post helpful, an optional comment and the same monthly IP hash, so one visitor counts once.

When you contact us by WhatsApp, phone or email

Whatever you choose to send us, such as your number, name and messages. WhatsApp is run by Meta under its own privacy policy.

When you book a call

The booking link opens Cal.com, which collects your name, email and chosen time under its own privacy policy and passes the booking to us.

When you browse

We use Vercel Web Analytics to count visits. It records the page, the referring site, country, device type and browser, without cookies and without an identifier that follows you across sites or days. We cannot identify you from it. Our hosting provider also processes your IP address briefly to deliver pages and protect the site from attacks.

Cookies and local storage

We do not set cookies. If you switch the site to dark mode, that choice is saved in your own browser's local storage under the name be5-theme. It never leaves your device and you can clear it in your browser settings. Because nothing on the site tracks you, we do not show a consent banner.

Why we use your data and on what basis

  • To reply to your enquiry and prepare a quote. You give us the data for this purpose. Under the DPDP Act this is data you provide voluntarily for a specified purpose (section 7(a)) and your consent. Under the GDPR it is steps you ask for before a contract (Article 6(1)(b)).
  • To deliver work if you become a client. DPDP: the purpose you agreed to. GDPR: performance of a contract (Article 6(1)(b)).
  • To stop spam and abuse of our forms. DPDP: incidental to the purpose you gave us the data for. GDPR: our legitimate interest in keeping the site secure (Article 6(1)(f)).
  • To understand which pages are useful. Anonymous statistics only, so no personal data is used.
  • To meet legal duties, such as tax records for clients. DPDP section 7 and GDPR Article 6(1)(c).

We do not use your data for automated decisions about you, and we do not build marketing profiles.

Who processes your data for us

These providers handle data on our behalf, only to run the services described here:

  • Vercel (USA): hosts the site, runs the contact form and provides the page statistics. Our server functions run in Mumbai.
  • Turso (USA): stores contact form messages and post ratings in its Mumbai region.
  • Telegram (UAE): delivers a copy of each contact form message to our private chat so we can reply quickly.
  • Cal.com (USA): handles bookings made through the booking link.

We may also disclose data if Indian law, a court or a government authority lawfully requires it. We never sell personal data and never share it with advertisers.

Transfers outside India and the EU

Some providers above are based outside India, so a copy of your data may be processed in other countries. Under the DPDP Act this is allowed except to countries the Indian government restricts, and we will stop any transfer to such a country. For visitors from the EU, where a provider is in the USA we rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses that the provider offers.

How long we keep it

  • Contact form messages: deleted automatically after 24 months, unless you become a client.
  • Post ratings and comments: deleted after 12 months.
  • Spam protection records (IP hashes): deleted after 2 days.
  • Client records: for as long as the work runs and then as long as Indian tax and accounting law requires.
  • The Telegram copy of a message stays in our private chat until we delete it, which we do when you ask us to erase your data.

How we protect it

The site runs only over HTTPS with a strict security policy and no third party scripts. Only our server functions and the owner can access stored messages. We collect the minimum needed and hash IP addresses instead of storing them. If a breach affecting your data ever happens, we will inform you and the authorities as the law requires.

Your rights

Wherever you live, you can ask us to:

  • tell you what data we hold about you and who we shared it with,
  • correct, complete or update it,
  • erase it,
  • withdraw your consent, as easily as you gave it (this does not affect what we did before),
  • send you your data in a common format (GDPR),
  • stop or restrict a use you object to (GDPR).

Under the DPDP Act you can also nominate someone to use these rights for you if you die or cannot act yourself. Residents of US states with privacy laws, such as California, have the right to know, delete and correct their data and to opt out of its sale or sharing. We do not sell or share data, so there is nothing to opt out of, and we will never treat you differently for using your rights.

To use any right, email bharath@brande5.com. We may ask you to confirm your identity, and we reply within 30 days.

Grievances and complaints

Our grievance officer is Bharath Yadav, reachable at bharath@brande5.com. Please write to us first. If you are in India and not satisfied with our answer, you can complain to the Data Protection Board of India. If you are in the EU, you can complain to the data protection authority in your country.

Children

This site is meant for businesses and adults. We do not knowingly collect data from anyone under 18. If you believe a child has sent us their details, email us and we will delete them.

Do Not Track and Global Privacy Control

We do not track visitors across sites, so these browser signals change nothing here. We respect them by default.

Changes to this policy

If we change how we use data, we will update this page and the effective date above. For important changes that affect data we already hold, we will tell the people concerned.