On this page (16)
- 1Introduction
- 2Data controller
- 3Scope of this policy
- 4Categories of personal data we collect
- 5Legal basis for processing (GDPR, Article 6)
- 6Purposes of processing
- 7Cookies and tracking technologies
- 8Third-party service providers
- 9International data transfers
- 10Data retention
- 11Your rights
- 12Automated decision-making
- 13Data security
- 14Children’s data
- 15Changes to this policy
- 16Contact
1Introduction
UnF0ldMart Solutions Private Limited ("UnFoldMart", "we", "us" or "our") respects your privacy and is committed to protecting your personal data in accordance with applicable data protection laws, including:
- The General Data Protection Regulation (EU) 2016/679 ("GDPR")
- For visitors in Germany: the Telecommunications Digital Services Data Protection Act (TDDDG), for cookies and similar technologies
- The Digital Personal Data Protection Act, 2023 (India)
- The Personal Information Protection and Electronic Documents Act (Canada)
- The Personal Data Protection Act (Singapore)
This Privacy Policy explains how we collect, use, disclose and safeguard personal data when you visit our website or engage our services.
2Data controller
For the purposes of applicable data protection laws, the data controller is:
UnF0ldMart Solutions Private LimitedSuite 18, Level 18, The Executive Centre, Tower A, DLF Epitome,
DLF Cyber City, Gurugram 122002, Haryana, India
Email: connect@unfoldmart.com
Data protection officer
Gaurav Aggarwal
Email: accounts@unfoldmart.com
EU representative (Article 27 GDPR)
Our EU representative will be named here shortly. Until then, contact phillip@unfoldmart.com.
UK representative (Article 27 UK GDPR)
Our UK representative will be named here shortly. Until then, contact phillip@unfoldmart.com.
3Scope of this policy
This policy applies to:
- Visitors to our website
- Prospective and current clients
- Business partners
- Job applicants
- Individuals who contact us
It does not apply to third-party websites linked from our website.
4Categories of personal data we collect
We may collect the following categories of personal data:
4.1 Information you provide directly
- Full name
- Email address
- Phone number
- Company name
- Project details or enquiry information
- CVs, résumés, employment history and related job application materials
- Your email address, if you sign up for our newsletter
4.2 Information collected automatically
When you access our website, we may collect:
- IP address
- Device type and operating system
- Browser type
- Pages viewed
- Date and time of the visit
- Referring URLs
- Interaction and engagement data
This data is collected through cookies and similar technologies. Apart from what the website needs to work and stay secure, this only happens after you consent in the cookie banner (see section 7).
5Legal basis for processing (GDPR, Article 6)
If you are located in the European Economic Area (EEA), we process personal data on one or more of the following legal grounds:
- Consent (Article 6(1)(a) GDPR): for analytics, marketing cookies and optional tracking. In Germany, storing or reading information on your device for these purposes also requires consent under § 25(1) TDDDG.
- Contractual necessity (Article 6(1)(b) GDPR): to respond to enquiries and provide services
- Legitimate interests (Article 6(1)(f) GDPR): to keep the website secure, prevent fraud and improve our services. Strictly necessary cookies are used without consent (§ 25(2) TDDDG).
- Legal obligations (Article 6(1)(c) GDPR): where required by applicable law
Where processing is based on consent, you may withdraw your consent at any time, for cookies via Cookie settings.
6Purposes of processing
We use personal data for the following purposes:
- Responding to enquiries and project requests
- Evaluating and processing job applications
- Communicating with prospective and existing clients
- Sending our newsletter, if you signed up
- Improving website performance and user experience
- Measuring engagement and traffic
- Supporting current or future advertising activities
- Keeping the website secure and preventing misuse
We do not sell personal data.
7Cookies and tracking technologies
We use the same four categories as our cookie banner:
- Essential: always active; hosting (Webflow), security and bot protection on forms (Cloudflare, including Turnstile) and storing your cookie choice (Consent Pro)
- Personalization: country code for the phone field (IPinfo), booking calendar (Calendly)
- Analytics: Google Analytics 4
- Marketing: Sortlist Radar and the Google advertising cookies that Google Analytics sets when marketing is allowed
Non-essential cookies and tools are loaded only after you consent in the cookie banner. You can change or withdraw your choice at any time via Cookie settings (also linked in the footer of every page).
Every cookie we measured, with its lifetime, is listed in our Cookie Policy.
8Third-party service providers
We use the following services. Some process personal data on our behalf; some (such as Google) also process data for their own purposes under their own privacy policies.
| Service | What it does on this website | Cookie banner category | Provider, location and safeguard |
|---|---|---|---|
| Webflow | Hosts the website and stores what you send through our website forms (contact form, newsletter sign-up). Newsletter sign-ups are kept in Webflow; we use no separate newsletter tool. | Essential (always active) | Webflow, Inc., USA. Data processing agreement in place. Transfer to the USA covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. |
| Cloudflare | Security, bot protection on all our forms (Cloudflare Turnstile), fast delivery of the site and cookieless page statistics (Cloudflare Web Analytics). | Essential (always active) | Cloudflare, Inc., USA. Transfer to the USA covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. |
| Consent Pro (Finsweet) | Shows the cookie banner and stores your choice. | Essential (always active) | Finsweet Inc., 1732 Pettit Avenue, Unit A, Merrick, New York 11566, USA. Data processing agreement in place. Transfer to the USA covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. |
| Google Fonts and Google Hosted Libraries | Fonts and a standard script library (jQuery) are loaded from Google servers when a page opens. Your IP address is sent to Google. | Loads before any choice | Google Ireland Limited / Google LLC, USA. Transfer to the USA possible. |
| jsDelivr | Delivers animation and slider scripts. | Loads before any choice | jsDelivr open-source content delivery network (global). Transfer outside the EEA possible. |
| Google Consent Mode | Passes your cookie choice to Google tools. Until you choose, all Google storage is set to "denied". | Essential (no cookies) | Google Ireland Limited / Google LLC, USA. |
| Google Analytics 4 | Visitor statistics (pages viewed, device, source of the visit). Measurement ID G-1JMCCD2CZ2. | Analytics (after consent) | Google Ireland Limited, Ireland / Google LLC, USA. Data processing agreement in place. Transfer to the USA covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. |
| Google advertising cookies (DoubleClick) | Set through Google Analytics for advertising measurement, only if you also allow marketing cookies. | Marketing (after consent) | Google Ireland Limited, Ireland / Google LLC, USA. Transfer to the USA covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. |
| HubSpot | Our customer database (CRM), where we keep the enquiry data that we enter. HubSpot is not used for tracking on this website. | Not on the website | HubSpot, Inc., USA (data hosted in the USA). Data processing agreement in place. Transfer to the USA covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. |
| Google Workspace | Our email and office tools. Emails you send us and our replies are stored there. | Not on the website | Google Ireland Limited, Ireland / Google LLC, USA. Data processing agreement in place. Transfer to the USA covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. |
| Sortlist Radar | Recognises which companies visit the site, so that enquiries can be attributed to the Sortlist agency directory; records sessions, clicks, form use and downloads. | Marketing (after consent) | Sortlist SA, Belgium (EU). |
| IPinfo (ipinfo.io) | Looks up your country from your IP address to pre-fill the country code of the phone field. | Personalization and Analytics (after consent) | IPinfo Inc., USA. Transfer to the USA covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. |
| Calendly | Booking calendar for calls. Loads when you click a booking button (if you allowed Personalization, a moment earlier, when you point at the button); Calendly may then set its own cookies. | Personalization; otherwise on your click | Calendly LLC, USA. Data processing agreement in place. Transfer to the USA covered by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses. |
| Semrush badge | Shows our Semrush agency badge. Before consent we show our own copy of the image. | Marketing (after consent) | Semrush Inc., USA. Transfer to the USA. |
We have data processing agreements with Webflow, HubSpot, Google (Workspace and Analytics), Calendly and Finsweet. For transfers to the USA by these providers, and by Cloudflare and IPinfo, we rely on the EU-US Data Privacy Framework (where the provider is certified) and/or the EU Standard Contractual Clauses.
Enquiries are kept in our customer database (HubSpot). We use Google Workspace for email. We do not use a separate newsletter tool: newsletter sign-ups are stored in Webflow.
9International data transfers
UnFoldMart is based in India. When you contact us from the EEA, your personal data is transferred to India. The European Commission has not issued an adequacy decision for India. We apply the GDPR to the personal data of visitors from the EU and EEA, and we comply with India’s Digital Personal Data Protection Act, 2023. Once our EU company is registered, transfers from it to India will be covered by the EU Standard Contractual Clauses.
Some of the providers listed in section 8 are based in the USA.
Where such transfers occur, we use appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions where applicable, including the EU-US Data Privacy Framework for certified US providers
- Contractual data protection obligations
Details per provider: see the table in section 8.
10Data retention
We keep personal data only as long as necessary for the purposes in this policy:
- Enquiries and booking requests that do not lead to a client relationship: deleted after 1 year
- Job application data: up to 12 months unless otherwise agreed
- Client contract and invoice records: kept as long as the law requires
- Google Analytics: data linked to cookies or identifiers is stored for up to 14 months and then deleted automatically
- Newsletter: until you unsubscribe
Cookie lifetimes are listed in our Cookie Policy. Data may be kept longer where the law requires it.
11Your rights
Depending on where you live, you may have the following rights:
Under the GDPR (people in the EU and EEA)
- Right of access
- Right to rectification
- Right to erasure ("right to be forgotten")
- Right to restrict processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent at any time
- Right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work
You can complain to any data protection supervisory authority, in particular in the EU country where you live or work. For example, in Hesse (Germany), where our Frankfurt office is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, datenschutz.hessen.de.
Under other applicable laws (India, Canada, Singapore)
You may have rights to access, correct or request deletion of your personal data in accordance with local law.
Please send requests to connect@unfoldmart.com. We will respond within the time limits required by law.
12Automated decision-making
We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.
13Data security
We use appropriate technical and organisational measures to protect personal data, including:
- TLS (SSL) encryption
- Secure hosting infrastructure
- Access control measures
- Limited internal access to personal data
However, no system can guarantee absolute security.
14Children’s data
Our website and services are not directed at people under 18 years of age. We do not knowingly collect personal data from minors.
15Changes to this policy
We may change this Privacy Policy at any time. Updates will be published on this page with a new "Last updated" date.
16Contact
For questions about this Privacy Policy or to exercise your data protection rights, please contact:
UnF0ldMart Solutions Private LimitedSuite 18, Level 18, The Executive Centre, Tower A, DLF Epitome,
DLF Cyber City, Gurugram 122002, Haryana, India
Email: connect@unfoldmart.com