Privacy Policy
LegalBitchief Technology Services Private Limited ("Bitchief", "we", "us") decides how the personal data described here is used, and is responsible for looking after it. This is the notice we give you before we use anything you send us through this website, as India's data protection law requires.
It is written to be read. Each section says what we collect, the purpose we collect it for, who else sees it, how long we keep it, and what you can ask us to do about it.
What this notice covers
This notice covers the personal data we handle through this website: the contact form, the careers application form, the certificate verification page, cookies, and our website analytics. It applies to any information that identifies a person.
It does not cover data we handle under a separate written agreement with a client organisation. Where we operate infrastructure on a client's behalf, we work to that client's instructions and their own notice governs it rather than this one.
The personal data we collect
We collect only what the specific interaction needs. Nothing on this site requires you to create an account, and we do not buy personal data from third parties or build profiles of visitors.
When you submit the contact form we collect the first and last name, email address and mobile number you enter, together with the company name, job title, service of interest, preferred contact method, how you heard about us, the subject and the message. The email address and mobile number are mandatory because they are how we reply; the rest helps us route the enquiry.
When you apply through the careers form we collect your name, email address, phone number, the position applied for, years of experience, current salary, current organisation, current city, your key skills, and the resume and photograph you attach.
Both forms show a short notice about how these details are used and ask you to agree per purpose before you send anything. When you do, we record which purposes you agreed to, which you were offered and left unticked, the version of the notice you were shown, the time, the email address you entered, your IP address, the details your browser reports about itself, and whether the notice was read to the end. That record is how we can show what was agreed to, and how we find the right records if you later ask us to change or remove them. It is used for nothing else - not marketing, and not analytics. You are given its reference when the form is sent.
When you verify a certificate we process the certificate number you enter, in order to look it up. We do not use it to identify you.
If you consent to analytics, we and Google Analytics collect your IP address, browser and device type, the pages you view, the page that referred you and the times of those visits. If you do not consent, none of this is recorded and the site works exactly as before.
If you consent to live chat, Tawk.to processes the messages you send in the chat widget and the identifiers it stores in your browser to keep a conversation together.
Why we process it, and on what basis
We use each item for a stated purpose and no other. Where we rely on your agreement, you gave it by ticking a box or turning on a setting, and you can withdraw it at any time.
- To answer your enquiry - the contact form data. Basis: the consent you give on the form itself, which is also necessary to do the thing you asked for.
- To email you about our services - your name and email address. Basis: the separate optional consent on the contact form. Off unless you tick it, and ticking it is not a condition of sending an enquiry.
- To assess your job application - the careers form data and attachments. Basis: the consent you give on the form itself.
- To consider you for future openings - the same application. Basis: the separate optional consent on the careers form. Off unless you tick it, and the application is assessed for the advertised role either way.
- To evidence the consent you gave on a form - the consent record described above. Basis: necessary to comply with our own obligation to show that consent was given, for what, and when.
- To confirm whether a certificate is genuine - the certificate number. Basis: necessary to perform the look-up you requested.
- To keep the site and its forms secure - the session cookie that carries the anti-forgery token, and rate-limit counters. Basis: necessary to provide the service safely.
- To understand which pages are read - analytics. Basis: your consent, given through the cookie notice. Off unless you turn it on.
- To let you chat with us from the site - the live chat widget. Basis: your consent, given through the cookie notice. Off unless you turn it on.
- To evidence your cookie choice - the consent record described below. Basis: necessary to comply with our own obligation to show that consent was given.
Who else sees your data
We do not sell personal data, and we do not share it for anyone else's marketing. We share it only with the providers we need to run the service, each of which handles it on our instructions and for nothing of their own.
- Google (Google Analytics) - website usage data, only if you consent to analytics.
- Tawk.to - chat messages and chat identifiers, only if you consent to live chat.
- Our email provider - the contents of a form submission, in order to deliver it to the responsible team.
- Our hosting provider - everything necessarily present on the server that runs this site.
- Professional advisers, auditors, or a government agency or court where we are required by law to disclose it.
Transfers outside India
Google and Tawk.to process data on infrastructure outside India, so agreeing to analytics or to live chat involves a transfer outside India. Such transfers are permitted to any country the Government has not restricted. If a country we transfer to is restricted, we will stop transferring to it.
The contact and careers forms do not require any transfer outside India beyond ordinary email delivery.
How long we keep it
We keep what you send us while your agreement stands, and until you choose to revoke it. Where a law requires us to keep something for a period, that takes precedence, and we will say so if you ask.
We do not put a countdown on your data that we cannot keep to. Rather than name a period and let it pass unnoticed, the position is simple: it is here because you agreed to it being here, and it goes when you say so.
- Enquiry details - kept in the receiving mailbox and our records while your agreement stands, and until you revoke it.
- Job applications, including the resume and photograph - the same, whether or not you ticked the optional box about future openings.
- Form consent records - kept while we hold the details they cover, and for as long afterwards as we may need to show that their use was agreed to.
- Cookie consent records - 395 days, which is the life of the consent cookie itself.
- Analytics data - up to 2 years, a period set by Google rather than by us.
- Website page-view logs - recorded only if you agree to analytics.
- Rate-limit counters - short-lived, and keyed by a hash rather than a readable address.
How we protect it
The site is served over HTTPS with HSTS, a Content Security Policy and related response headers. Forms are protected against cross-site request forgery with per-session tokens, against automation with timing and honeypot checks, and against abuse with rate limiting. Uploads are validated by actual file type, not by the name they arrive with. Credentials live outside the codebase, and access to the administrative panel is authenticated and rate-limited.
No safeguard is complete. If a breach affects your personal data we will notify you and the Data Protection Board of India, as we are required to.
Your rights
You have the following rights over the personal data we hold about you. There is no charge, and we will respond within a reasonable period.
- Access - a summary of the personal data we hold about you, what we do with it, and who else it has been shared with.
- Correction and completion - to have inaccurate or misleading data corrected, and incomplete data completed.
- Erasure - to have your personal data erased, unless we still need it for the purpose you gave it for or a law requires us to keep it.
- Withdrawal - to withdraw your agreement at any time, as easily as you gave it. Withdrawing does not undo anything already done properly beforehand.
- Raising a concern - to have a complaint answered by us before taking it further.
- Nomination - to nominate someone else to exercise these rights on your behalf in the event of your death or incapacity.
How to exercise your rights
For cookies, use the cookie preferences panel: it gives and withdraws your agreement immediately and needs no request to us.
For anything else, email us from the address you gave us, saying what you want. If we cannot tell which records are yours from the request, we will ask for the minimum needed to find them and nothing further. If you have a consent reference from one of our forms, quoting it is the quickest route.
Please make requests in good faith. We may not act on one that is false or frivolous, and a request to correct something has to give us accurate information to correct it to.
Grievance redressal
If you are not satisfied with how we have handled your personal data or your request, contact our Grievance Officer at the address below. We will acknowledge it and respond within the period the law allows.
If we do not resolve it, you may take the matter to the Data Protection Board of India.
Children and persons under guardianship
This site and our services are directed at businesses, not at children. We do not knowingly collect the personal data of anyone under 18.
Where a child's personal data is involved, verifiable agreement from a parent or lawful guardian is required first, and tracking, behavioural monitoring and advertising aimed at children are not permitted. We do not carry advertising, and analytics run only if you allow them and are never used to build profiles.
If you believe a child has given us personal data through this site, contact us and we will erase it.
Changes to this notice
If we materially change what we collect, why, or who we share it with, we will update this notice and increment the version attached to the cookie notice, which asks for your choice again rather than carrying forward a decision you made about a different notice. The notice on the contact and careers forms carries its own version for the same reason: a consent recorded against an earlier wording is not consent to the current one.
The date at the top of this page is when it was last changed.
Contact us
For any question about this notice, or to exercise a right described in it, email us at the address shown below. Please put "Data protection" in the subject so it reaches the right person.