Privacy Policy

1.What information do we collect?

In short: We collect what you choose to give us, plus standard technical information from your browser.

Information you give us

We collect personal information that you provide voluntarily when you contact us, apply for a role, or subscribe to the newsletter. What we hold depends on which of those you use:

• Name and work email address
• Organisation and the industry you selected
• The outcome you described in the contact form
• Links you share, such as LinkedIn, GitHub or a portfolio
• Anything written in your introduction if you apply for a role

Information collected automatically

Our servers record standard technical information with every request, including IP address, browser type and the pages you opened. This is used for security and to understand which material is read. We do not use it to identify you.

2.How do we process your information?

In short: To answer you, to assess an application, to send what you asked for, and to keep the site secure.

We process personal information for a limited set of purposes, and we do not repurpose it later:

• To answer an enquiry and continue a conversation you started
• To assess an application and reply to the applicant
• To send the newsletter, where you asked us to
• To keep the site secure, available and free of abuse
• To meet obligations that apply to us under Indian law

If you subscribe, every issue carries an unsubscribe link, and we stop when you use it.

3.When and with whom do we share your information?

In short: With a small number of service providers, and with nobody else unless the law requires it.

A small number of providers help us operate the business: hosting, email delivery and applicant tracking. They act only on our instructions and are bound by contract to do so.

We do not sell personal data. We do not share it with advertising networks. We do not display advertising on this site. We disclose personal information to anyone else only where a law or a lawful order requires it.

4.Do we use cookies or tracking technologies?

In short: One local preference for light or dark appearance. No third-party tracking cookies.

This site stores a single preference in your browser to remember whether you chose the light or the dark appearance. It stays on your device, it is never sent to us, and clearing your browser storage removes it.

We do not use third-party tracking cookies, advertising pixels or cross-site profiling of any kind.

5.How long do we keep your information?

In short: For as long as the reason we collected it lasts, and no longer.

• Enquiries are held while the conversation is live and for a reasonable period afterwards, then deleted
• Applications are held for the hiring cycle and a short period afterwards, unless you ask us to keep them on file
• Newsletter subscriptions are held until you unsubscribe
• Technical logs are held for a short operational window

Data we process on behalf of a client follows that client’s retention schedule.

6.How do we keep your information safe?

In short: Encryption, isolated hosting, least-privilege access, and an ISO 27001 certified management system.

We hold ISO/IEC 27001:2022 certification. Data is encrypted in transit and at rest, hosting is isolated, and access is granted on the least a person needs to do their job.

No system is beyond compromise, so we also plan for the day one is. If a breach affects your personal data we will tell you and the relevant authority, within the time the law allows.

7.What happens to data inside the systems we operate?

In short: It stays in the client’s environment, under the client’s policy, and every decision is logged.

Systems we deploy operate inside the client’s own environment. Data residency, retention and access follow that client’s policy and the contract we hold with them, and we act on their instructions.

Where a use case calls for it, personal data is masked or redacted before a model sees it. Access is role-based and inherited from the client’s existing entitlements, so a person sees only what they were already cleared to see. Every decision the system makes is logged with its inputs, so a specific case can be reconstructed months later.

8.Do we collect information from minors?

In short: No. This site and our services are intended for business use by adults.

We do not knowingly collect personal data from anyone under 18, and nothing on this site is directed at children. If you believe a minor has given us personal information, write to connect@esmagico.com and we will delete it.

9.What are your privacy rights?

In short: Access, correction, erasure, withdrawal of consent, and the right to nominate someone to act for you.

Under the Digital Personal Data Protection Act, 2023 you may:

• Ask what personal data we hold about you
• Ask us to correct or complete it
• Ask us to erase it, where we have no reason to keep it
• Withdraw a consent you previously gave
• Nominate someone to exercise these rights on your behalf

Write to connect@esmagico.com and we will respond within the period the law allows. If your data is processed by us on behalf of a client, please raise the request with that client and we will support them in answering it.

If you are unhappy with our response, you may complain to the Data Protection Board of India.

10.Do we make updates to this notice?

In short: Yes, when our practice changes. The date at the top records the last change.

We revise this notice when what we do changes. The version published here is the one that applies, and the date at the top tells you when it last changed. Where a change is material, we will say so.

11.How can you contact us about this notice?

In short: Write to connect@esmagico.com.

Es Magico Experiences Private Limited, with offices in Mumbai and Bengaluru. For anything in this notice, including a request to access, correct or erase your data, write to connect@esmagico.com.