Privacy Policy

Rootcode Solutions Private Limited ("Rootcode", "we", "our", or "us") is a software consultancy incorporated in India with its registered office at Mohali, Punjab 140306. We build AI-powered products and scalable SaaS applications for clients across India, the United States, the United Kingdom, and the UAE.

For the purposes of the General Data Protection Regulation (GDPR) and UK GDPR, Rootcode Solutions Pvt. Ltd. is the data controller in respect of personal data collected through this website and our client engagements.

We collect personal data in the following categories:

Information you provide directly

• Contact form submissions: name, email address, company name, project description, and any other information you choose to include.
• Email correspondence: messages and attachments you send us.
• Job applications: CV/résumé, cover letter, LinkedIn profile, and work samples.

Information collected automatically

• Usage data: pages visited, time on site, click events, scroll depth, and referral source via Google Analytics 4 (GA4).
• Technical data: IP address (anonymised), browser type, device type, operating system, and screen resolution.
• Performance data: page load times and Web Vitals collected by Vercel Analytics.

Information from third parties

• Publicly available professional profiles (e.g. LinkedIn) when we research prospective clients or partners.

We use the personal data we collect to:

• Respond to enquiries and provide you with information about our services.
• Prepare and deliver client proposals, statements of work, and project deliverables.
• Process and manage job applications.
• Improve the performance, usability, and content of our website.
• Analyse aggregated traffic patterns and marketing effectiveness.
• Comply with legal obligations and enforce our agreements.
• Prevent fraud and ensure the security of our systems.

We do not sell your personal data to third parties, use it for automated decision-making that produces legal or similarly significant effects, or send unsolicited marketing communications.

Where the GDPR or UK GDPR applies, we rely on the following lawful bases:

• Legitimate interests (Article 6(1)(f)): responding to business enquiries, improving our website, and fraud prevention — where these interests are not overridden by your rights.
• Contractual necessity (Article 6(1)(b)): processing data necessary to perform a contract with you or take pre-contractual steps at your request.
• Consent (Article 6(1)(a)): placing non-essential cookies, where we request your consent separately via our Cookie banner.
• Legal obligation (Article 6(1)(c)): retaining accounting records and complying with applicable law.

We share your data only in limited circumstances:

• Service providers: Google LLC (GA4 analytics), Vercel Inc. (hosting and analytics), and our email service provider — each bound by data processing agreements and, where applicable, Standard Contractual Clauses.
• Professional advisers: lawyers, accountants, and auditors under confidentiality obligations.
• Legal requirements: regulatory or law-enforcement bodies when required by applicable law.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to confidentiality protections.

All third-party processors are required to process personal data only on our documented instructions and to maintain appropriate technical and organisational security measures.

We use cookies and similar tracking technologies on our website. For full details — including how to manage your preferences — please read our Cookie Policy.

We retain personal data for no longer than is necessary for the purposes for which it was collected:

• Contact enquiries: up to 3 years from the date of last contact, or until you request deletion.
• Client project data: 7 years from project completion to satisfy statutory accounting requirements under Indian law.
• Job applications (unsuccessful): 6 months, after which data is securely deleted unless you consent to a longer period.
• Website analytics: 14 months (Google Analytics default retention period).

After these periods, we securely erase or anonymise your data so that it can no longer be associated with you.

Depending on your location, you may have the following rights regarding your personal data:

Under GDPR / UK GDPR (EU & UK residents)

• Access: obtain a copy of the data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion where there is no overriding legal ground to retain it.
• Restriction: limit how we process your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests at any time.
• Withdraw consent: where processing is based on consent, withdraw it without affecting prior lawful processing.

Under CCPA (California residents)

• Right to know what personal information is collected, used, shared, or sold.
• Right to delete personal information (with exceptions).
• Right to opt-out of the sale of personal information (we do not sell personal information).
• Right to non-discrimination for exercising your rights.

To exercise any of these rights, email us at privacy@rootcode.in. We will respond within 30 days (GDPR) or 45 days (CCPA). We may ask you to verify your identity before fulfilling your request. If you are in the EU or UK and are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.

Our servers are hosted by Vercel Inc. in data centres primarily in the United States. When we transfer personal data from the European Economic Area (EEA), the UK, or Switzerland to countries that do not provide an equivalent level of data protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or the UK International Data Transfer Agreement (IDTA), as applicable.

Data originating from India is processed in accordance with the Digital Personal Data Protection Act 2023 (DPDPA) and associated rules as they come into force.

Our website and services are directed to businesses and professional individuals. We do not knowingly collect personal data from anyone under the age of 18. If you believe we have inadvertently collected data about a child, please contact us immediately at privacy@rootcode.in and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will update the effective date at the top of this page whenever we make material changes. Where changes are significant, we will notify you by email (if we hold your email address) or by placing a prominent notice on our website.

Your continued use of our website following any changes constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please reach out to us:

• Email: privacy@rootcode.in
• Post: Rootcode Solutions Pvt. Ltd., Mohali, Punjab 140306, India

We aim to respond to all legitimate requests within 30 days. In complex or high-volume situations, this may take up to 60 days, in which case we will notify you.