Privacy Policy

1. Who controls your data

Vikash Sharma, based in New Delhi, India, controls personal data collected through vikash-sharma.com. Privacy questions, rights requests, and grievances can be sent to contact@vikash-sharma.com.

2. Data collected

• Contact details and message content submitted through the contact form.
• Booking details such as name, email, phone, service, time, and policy acceptance.
• Payment status, amount, provider references, and refund records; not complete payment credentials.
• Outlook event and Teams meeting identifiers needed to deliver the consultation.
• Approved public comments plus security-limited, pseudonymous abuse-control records.
• Consent preference and, only with permission, Google Analytics usage data.
• Limited server and security logs needed to operate and protect the website.

3. Purposes and legal grounds

• Perform the requested booking, payment, consultation, support, and refund contract.
• Respond to enquiries and comments that you choose to submit.
• Meet accounting, tax, consumer-protection, fraud-prevention, and legal obligations.
• Protect the website and users through proportionate security and abuse controls.
• Measure site use through optional analytics only after consent.

4. Service providers and sharing

Data is shared only as needed with hosting and email providers, Microsoft 365 and Teams, PhonePe, Google reCAPTCHA, and Google Analytics when consented. Information may also be disclosed where legally required or necessary to establish or defend legal claims. Personal data is not sold.

5. International processing

Some technology providers may process data outside your country. Their contractual, security, and lawful-transfer mechanisms apply alongside the safeguards described here. Only information necessary for the relevant service is shared.

6. Retention

• Private contact-enquiry content is normally retained for up to 90 days after the last interaction, unless an active matter requires it.
• Booking contact details and meeting-access links are normally anonymized after 90 days from terminal resolution.
• Payment, invoice, refund, dispute, and audit records may be retained longer where tax, accounting, contractual, or legal obligations require it.
• Comment content remains until removed; short-lived abuse records are routinely deleted.
• Analytics data should be configured for no more than 14 months.
• The local privacy choice expires after six months and is then requested again.
• Deleted data may remain temporarily in two rotating recovery backups until those copies are replaced.

7. Cookies, local storage, and analytics

Essential local storage remembers theme and privacy choices. Administrative sessions use a secure cookie. Google reCAPTCHA may process device and interaction data to protect the contact form. Google Analytics remains disabled unless you allow it.

You can reject optional analytics without losing access, and later change your choice through “Privacy choices” in the footer. Withdrawal does not affect processing already completed lawfully.

8. Your rights

Depending on applicable law, you may request access, correction, completion, deletion, restriction, objection, portability, withdrawal of consent, or information about processing. Indian data principals may also use applicable grievance and nomination rights as the DPDP framework comes into force. Identity may be verified before a request is fulfilled.

9. Security and incidents

Reasonable technical and organizational safeguards include encrypted transport, server-only credentials, least-privilege calendar access, input limits, rate controls, and restricted administrative functions. No internet service can promise absolute security. A material incident will be handled and notified as required by applicable law.

10. Children and updates

The paid consultation is intended for adults acting in a professional or business capacity and is not directed to children. Material policy changes will be posted here with a revised effective date.