Privacy and data

Short version: I collect an email address when you ask me for something, I use it to reply to you, and I do not sell it, share it or add you to anything you did not ask for.

The longer version is below, because you are entitled to it and because a consultancy that advises on data governance should be able to describe its own.

Who is responsible

The Modern Analytics, operating from Bengaluru, India, is responsible for the personal data described here. If you want anything on this page actioned, email chinmaya@themodernanalytics.com and it will be handled by a person, not a queue.

What I collect, and when

• The free gate check. Nothing at all. The seven questions run entirely in your browser, your answers never leave the device, and no email address is asked for. There is no field on the page capable of sending them, which is a stronger guarantee than my word for it.
• The 7D Baseline. Your name, your email address, and optionally your organisation and role. Your answers to the twenty eight items are scored in your browser and stay there. What reaches me is the request and your contact details, so I can send the report and follow up once. The report itself is generated on your own device.
• Keeping a baseline, if you choose to. At the end you are offered the option to store your answers so you can come back to them, and a separate option to be reminded in ninety days. Both are unticked, and neither happens unless you tick it. If you do, your answers and scores are stored and you get a private link by email. Untick nothing and nothing is kept.
• The contact form. Whatever you type into it, which is normally your name, email address and a description of the problem.
• Email you send me directly. Held in my mailbox like any other correspondence.

What I do not do

• No advertising trackers, no analytics pixels, no third party cookies, no session recording.
• No selling, renting or sharing your details with anybody for marketing.
• No adding you to a newsletter because you downloaded something. If you want writing from me it is on LinkedIn, where you choose to follow.
• No automated decisions about you, and no profiling.

Why I am allowed to hold it

Because you asked me for something and I need your details to provide it, and because I have a legitimate interest in replying to a business enquiry. If you would rather I did not hold it, say so and it goes.

Who else can see it

This site runs on Amazon Web Services. The pages are served from S3 through CloudFront. When you submit a form it goes to a small function of mine on AWS Lambda, which checks it and emails it to me through Amazon SES. Nothing is written to a database, because nothing needs to be.

AWS is a processor acting on my instructions and does not use your details for its own purposes. The AWS region handling this is in India, and email may cross borders in the ordinary course of being delivered to my mailbox.

If you create an account to keep your baseline and compare it later, that account and those answers are held in a Supabase Postgres database in the Mumbai region. Supabase is a processor on the same terms. Your answers are readable by you and by me, and by nobody else. Where the site shows how a score compares to others, it uses figures aggregated across at least five organisations, so no individual response can be picked out of it.

No other third party receives anything.

How long it is kept

• Enquiries that do not become work: twelve months, then deleted.
• Client records: for the engagement and six years afterwards, because tax and professional obligations require it.
• Baseline responses: the scored result is kept only if you become a client, so a later review has something to compare against. Otherwise it goes with the enquiry.

What you can ask for

A copy of what I hold, a correction, deletion, or a stop on any further contact. Email me and it will be done inside thirty days, usually the same week. You do not need to give a reason and you will not be asked for one.

If you are in the UK or the EU you can complain to your supervisory authority. If you are in India you may raise it under the Digital Personal Data Protection Act. I would rather you told me first, because I can usually fix it faster than either.

How it is kept safe

The site is served over HTTPS only, and form submissions travel encrypted. Enquiries live in a mailbox with two factor authentication on it, not in a database, because a database I do not need is a breach I do not need either. Nobody but me reads them.

If something did go wrong and your data were affected, I would tell you directly and without being asked, and I would do it in days rather than after a review.

If you are unhappy

Email me first at chinmaya@themodernanalytics.com. I am a one person practice, so the grievance officer under India's Digital Personal Data Protection Act is me, and there is no queue to get through.

You will get a reply within seven days and a resolution inside thirty. If that does not satisfy you, the escalation routes are the Data Protection Board of India, or your own supervisory authority if you are in the UK or the EU.

Children

This is a site for people buying consulting services for their organisation. It is not directed at children, I do not knowingly collect data about anyone under eighteen, and if you believe I have, tell me and it will be deleted.

Client data during an engagement

Different question, and it is answered in the statement of work rather than here. In short: mutual NDA as standard, I do not take copies of client data off site, and I work in your systems where practical. The full position is in the terms.

Changes

If this page changes materially I will date the change here. Last updated August 2026.