Privacy Policy
Last updated: February 2026 (updated to reflect DPDP Rules 2025)
1. Who We Are
This website is operated by ANEK Solutions, a company registered in Gurugram, Haryana, India, trading as The MVP Studio.
Data controller contact: [email protected]
2. Data Protection Officer
We have assessed that no Data Protection Officer (DPO) appointment is required under GDPR Article 37. Our core activities do not involve large-scale systematic monitoring of individuals or large-scale processing of special categories of data.
3. What Data We Collect
- Contact form: Name, email address, and phone number when you submit an enquiry via our website.
- Consent records: IP address and User-Agent string, recorded when you save cookie preferences, as proof of consent.
- Analytics data (two tiers — see Section 4): Pageview events, click interactions, element labels, CSS selectors, and page structure captured via PostHog. In cookieless mode no data is stored on your device; in persistent analytics mode a pseudonymous browser identifier is stored.
4. Analytics — How We Use PostHog
We use PostHog, a product analytics platform, in two distinct modes depending on your consent:
Tier 1 — Anonymous Cookieless Analytics (always active)
By default — whether you accept, decline, or dismiss the cookie banner — we collect anonymous session analytics using PostHog in memory persistence mode.
- No cookies or localStorage entries are written to your device.
- Your session identity is discarded when you close the browser tab.
- Events include: pageviews, click interactions, element labels, and page structure (autocapture).
- Event data is transmitted to PostHog's servers; your IP address is included in the request.
Lawful basis (EU): Legitimate interest under GDPR Art. 6(1)(f) — no device storage access occurs, so the ePrivacy Directive Art. 5(3) consent obligation does not apply. We use this data only to understand aggregate traffic patterns.
Tier 2 — Persistent Analytics (measurement consent required)
If you accept “Analytics” cookies, PostHog switches to localStorage + cookie persistence mode, which:
- Stores a pseudonymous browser identifier in
ph_*cookies and localStorage. - Allows us to recognise returning visits from the same browser across sessions.
- Does not identify you personally — no name, email, or login is linked to this ID.
Lawful basis (EU): Consent under GDPR Art. 6(1)(a) and ePrivacy Directive. You may withdraw at any time via “Manage cookies” in the footer.
5. Cookies & Storage
| Cookie / Storage | Provider | Purpose | Duration | Consent |
|---|---|---|---|---|
| c15t-subject-id | c15t (self-hosted) | Stores your consent choice | 1 year | Necessary (exempt) |
| ph_* (localStorage + cookie) | PostHog Inc. | Persistent pseudonymous analytics identity | Session / 1 year | Measurement |
| PostHog in-memory state | PostHog (client-side only) | Anonymous session analytics — pageviews and autocapture interactions; no device storage; transmitted to PostHog servers | Tab session only | None required |
6. Lawful Basis Summary
| Processing activity | Lawful basis |
|---|---|
| Responding to contact form enquiries | Legitimate interest — Art. 6(1)(f) GDPR |
| Cookieless (memory) analytics | Legitimate interest — Art. 6(1)(f) GDPR |
| Persistent (cookie) analytics | Consent — Art. 6(1)(a) GDPR |
| Consent records | Legal obligation — Art. 6(1)(c) GDPR |
7. Sub-processors & International Transfers
- PostHog Inc. (USA) — Product analytics platform. We transmit anonymous session data (including IP addresses) to PostHog's servers. International transfers from the EU/EEA are protected by Standard Contractual Clauses (EU Commission Decision 2021/914). PostHog's Data Processing Agreement is in place.
- c15t (self-hosted) — Consent management. Your consent choice is stored in our own PostgreSQL database hosted within our infrastructure.
- Infrastructure / CDN provider — Our website is served via a hosting and content delivery provider. Contact [email protected] for current provider details.
8. Data Retention
- Contact form enquiries: 3 years from last contact.
- Consent records: 5 years, as required for accountability under GDPR Art. 5(2).
- Analytics data: PostHog default retention — 1 year.
9. Your Rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Rectification of inaccurate data.
- Erasure (“right to be forgotten”) where processing is no longer necessary.
- Portability — receive your data in a structured, machine-readable format.
- Object to processing based on legitimate interest.
- Withdraw consent at any time (see Section 10 below).
To exercise any of these rights, email [email protected]. We will respond within 30 days.
10. How to Withdraw Consent
Click “Manage cookies” in the footer of any page on this website. You can toggle off analytics cookies and save your preferences at any time. Withdrawing consent will clear all ph_* cookies and localStorage entries from your browser immediately.
11. India — Digital Personal Data Protection Act 2023 & Rules 2025
ANEK Solutions is an Indian entity and acts as a Data Fiduciary under the Digital Personal Data Protection (DPDP) Act 2023 and the DPDP Rules 2025 (notified January 2025). If you are a Data Principal resident in India, you have the following rights:
- Access a summary of your personal data being processed and the processing activities undertaken.
- Correction and erasure of your personal data.
- Grievance redressal — lodge a complaint with us before approaching the Data Protection Board of India.
- Right to Nominate (Rule 13): You may nominate another individual to exercise your data principal rights on your behalf in the event of your death or incapacity. To register a nominee, contact [email protected].
Grievance Officer: [email protected] — We will acknowledge your complaint within 48 hours and endeavour to resolve it within 30 days as required by DPDP Rule 12.
Children's data: Our website is not directed at individuals under 18 years of age. If you believe a minor has submitted personal data via our contact form, please contact us at [email protected] for immediate erasure.
Legitimate uses (Section 7 DPDP Act): The DPDP Act does not recognise “legitimate interest” as a lawful basis. We process contact-form data to respond to enquiries (“voluntary provision” under Section 7(c)) and retain consent records to demonstrate legal compliance. Cookieless analytics (PostHog memory mode) transmits IP addresses to PostHog's US servers in real-time but does not store personal data against an identifiable individual on our systems. We are monitoring Data Protection Board guidance on whether such transmission constitutes processing of personal data under the DPDP Act and will update this policy when guidance is issued.
Cross-border data transfers (Rule 22): The DPDP Rules 2025 permit cross-border transfer of personal data to countries notified by the Central Government. The government whitelist has not yet been published. Until it is, we rely on our assessment that PostHog (USA) provides adequate contractual and technical safeguards (see Section 7, Sub-processors). We will update our transfer mechanisms when the whitelist is published.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page indicates when it was last revised. Material changes will be communicated via a notice on our website.
13. Contact Us
For any privacy-related questions or to exercise your rights, contact us at [email protected].