Privacy Policy

1. Who we are

"Praxis-Q", "we" and "us" means PraxisQ Consulting LLP (India, LLPIN ACZ-2972) and Techtweek Infotech LLC (Wyoming, USA), the two companies operating the Praxis-Q brand. Which one is the controller of your data depends on which one you deal with; see our Terms for how engagements are allocated. For this website, PraxisQ Consulting LLP is the controller.

Privacy contact: Sahil Dubey, Managing Director — hello@praxis-q.com, +91 90234 44183 (India), +1 917-508-5334 (USA). Postal: SB Tower, E-190, Phase 8B, Sector 74, Mohali 160055, India.

2. What we collect and why

Contact and enquiry forms: name, email, phone, company, the service you are interested in and your message. Used to respond to you and, if you become a client, to set up the engagement. Legal basis: steps prior to a contract / legitimate interest in responding to enquiries.

Client engagements: contact details of your staff involved in the engagement and the evidence you upload to the compliance portal (which may contain personal data of your employees or customers). Used only to deliver the contracted services. Legal basis: performance of the contract. For evidence you upload, you are the controller and we act as your processor.

Certificate verification: the certificate identifier you enter at praxis-q.com/verify. Used to look up and display the certificate's status.

Website analytics: Google Analytics 4 collects device, browser, approximate location (city level), pages viewed and interaction events (such as button clicks and form submissions) using cookies. Used to understand how the site is used. Legal basis: consent where required, otherwise legitimate interest in improving the site.

Communications: if you email us, call us or message us on WhatsApp, we keep the correspondence for as long as needed to deal with your request and any resulting engagement.

We do not collect special-category (sensitive) personal data through this website, and we do not knowingly collect data from children under 16.

3. Cookies and analytics

praxis-q.com sets two kinds of cookie: Google Analytics 4 (property G-LDDMP4B0M0), and a 30-day cookie named pq_geo holding only your two-letter country code, derived from your IP address so we can show region-relevant navigation first. The country lookup uses the DB-IP Country Lite database (db-ip.com, CC BY 4.0) on our own server; your IP is not sent to a third party for this. We do not run advertising, retargeting or social-media pixels.

You can block analytics cookies in your browser settings or with the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). Doing so does not affect your ability to use the site.

4. Who we share data with

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

We use a small number of service providers (subprocessors) to run the site and deliver services: hosting, object storage, transactional email, analytics and AI-assisted evidence scoring. The current list, with locations, is on our Security page. Each provider processes data only on our instructions.

Independent certification bodies, CPA firms and Qualified Security Assessors receive engagement information where that is necessary for the certificate, attestation report or Report on Compliance you have contracted for.

We may disclose data where required by law, regulation, court order or a lawful request from a public authority, or to protect our legal rights.

5. International transfers

Praxis-Q delivers services from India. Website and portal data is hosted in India and Singapore; email notifications are sent from Mumbai, India; AI-assisted scoring is processed in the United States. Details are on the Security page.

Where data of EU/UK residents is transferred outside the EEA/UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) with the receiving party, together with the technical measures described on our Security page. A data processing agreement including these clauses is available on request.

6. How long we keep data

Enquiries that do not become engagements: 24 months from last contact, then deleted.

Engagement records and evidence: for the term of the engagement plus the retention period the relevant standard or law requires (for example, audit working papers for attestation engagements), then securely deleted. Clients can request export or earlier deletion of evidence after an engagement closes, subject to those obligations.

Analytics data: retained by Google Analytics under its standard event-data retention setting, then aggregated.

7. Security

Data is encrypted in transit (TLS 1.3) and at rest, access is role-based with a second factor on portal logins, and backups are taken daily and restore-tested monthly. We hold ISO/IEC 27001:2022 certification for our own information security management system. Full details are on the Security page.

8. Your rights

Everyone: you can ask us what personal data we hold about you, ask us to correct or delete it, object to or restrict processing, ask for a copy in a portable format, and withdraw consent where processing is based on consent. Write to hello@praxis-q.com; we respond within the timeframe the applicable law sets (30 days under GDPR, 45 days under CCPA/CPRA, and as required under DPDP). We will verify your identity before acting on a request.

EU / UK residents (GDPR / UK GDPR): in addition to the above, you can complain to your local supervisory authority. We do not carry out automated decision-making with legal or similarly significant effects.

California residents (CCPA / CPRA): you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of "sale" or "sharing" (we do neither); and not to be discriminated against for exercising these rights. Categories collected in the last 12 months: identifiers (name, email, phone), professional information (company, role), internet activity (analytics), and content you send us. You can authorise an agent to make a request on your behalf.

India residents (Digital Personal Data Protection Act 2023): you have the right to access a summary of your personal data and the processing activities, to correction and erasure, to grievance redressal, and to nominate another person to exercise your rights in the event of death or incapacity. Our Grievance Officer for DPDP purposes is Sahil Dubey, reachable at hello@praxis-q.com.

9. Changes

We update this policy when our practices change; the date at the top tells you when. Material changes affecting an active engagement are notified to the client contact directly.