Privacy Policy

1 Who We Are

CodeToday Technologies LLP (operating as codetoday.io) is an engineering consulting firm registered in Bangalore, Karnataka, India. We provide DevOps, MLOps, Data Engineering, Big Data, and AI/LLM Agent services to startups and enterprises worldwide.

For purposes of EU/UK GDPR, codetoday.io acts as the data controller for personal data collected through this website and our direct communication channels.

Registered Address: Bangalore, Karnataka, India
Contact: team@codetoday.io

2 Scope of This Policy

This Privacy Policy applies to:

• All visitors to codetoday.io and its subdomains
• Individuals who submit enquiries, book consultations, or contact us via any form on this site
• Subscribers to our engineering blog, newsletters, or content updates
• Prospective and current clients who interact with us digitally prior to or during engagement
• Referral and partner programme participants

This policy does not cover data processed under separate Data Processing Agreements (DPAs) executed with clients as part of contracted engagements. Those are governed by the applicable DPA and Statement of Work.

3 Data We Collect

We collect the minimum data necessary to operate our website and respond to commercial enquiries.

3.1 Data You Provide Directly

3.2 Data Collected Automatically

3.3 Data We Do NOT Collect

• We do not collect payment card numbers or financial account details through this website.
• We do not collect special category data (health, biometric, political, religious) unless volunteered in a message.
• We do not knowingly collect data from children under 16.
• We do not purchase third-party marketing lists or enrich profiles without consent.

4 How We Collect Data

Data is collected through the following channels:

• Contact & enquiry forms — When you fill in any form on codetoday.io, the submitted data is sent to our CRM and email inbox.
• Email and calendar — When you email us or book a consultation call, your details are stored in our email system and calendar tool.
• Cookies and pixel tags — We use first-party and third-party cookies as described in Section 6. You may manage cookie preferences at any time.
• LinkedIn Insight Tag — An invisible pixel placed by LinkedIn that allows us to run retargeting ads and understand aggregate professional demographics of our visitors. LinkedIn processes this data as a separate controller under their own privacy policy.
• Google Analytics 4 — JavaScript analytics code that measures page interactions. GA4 uses cookieless measurement by default and anonymises IP addresses before processing.
• Google Tag Manager — A tag container that fires other tags (GA4, LinkedIn, custom events) based on user behaviour. GTM itself does not collect personally identifiable data independently.
• Direct communication — Telephone calls, video calls, LinkedIn messages, or other direct communications where you provide data voluntarily.

5 Purposes & Legal Basis (GDPR Article 6)

6 Cookies & Tracking Technologies

We use cookies and similar technologies to operate the website, measure performance, and personalise marketing. Below is a summary of cookies deployed on codetoday.io:

6.1 Strictly Necessary Cookies

These cookies are essential for the website to function and cannot be switched off. They are usually set only in response to actions you take, such as setting privacy preferences or filling in forms.

6.2 Analytics Cookies

These cookies allow us to count visits and traffic sources to measure and improve site performance. All information is aggregated and anonymous.

6.3 Marketing & Retargeting Cookies

Set by third-party advertising platforms. These cookies track your activity across sites to deliver relevant adverts.

6.4 Managing Your Cookie Preferences

You can manage cookies through:

• Our cookie banner — Shown on first visit; click "Cookie Preferences" at any time to change settings.
• Browser settings — Most browsers allow you to block or delete cookies. Note that blocking strictly necessary cookies may break site functionality.
• Google Analytics opt-out — Install the Google Analytics Opt-out Browser Add-on.
• LinkedIn opt-out — Visit LinkedIn ad preferences.
• Your Ad Choices — Visit aboutads.info or youronlinechoices.eu.

7 Third-Party Services & Data Sharing

We do not sell your personal data to third parties. We may share data with the following categories of trusted processors and partners:

We may also disclose personal data to: (a) comply with legal obligations, court orders, or regulatory requests; (b) enforce our Terms of Service; (c) protect the rights, property, or safety of codetoday.io, our clients, or others; (d) in connection with a merger, acquisition, or sale of assets, in which case we will notify you.

8 Data Retention

We retain personal data only as long as necessary for the purposes described in this policy, or as required by applicable law.

At the end of the applicable retention period, data is securely deleted or anonymised. Where data is anonymised, it may be retained indefinitely for aggregate statistical purposes.

9 International Data Transfers

codetoday.io is based in India. We work with clients and use service providers globally, which means your personal data may be transferred to and processed in countries outside your country of residence, including the United States, the European Economic Area, and India.

For transfers of personal data from the EEA/UK to third countries without an adequacy decision, we rely on:

• Standard Contractual Clauses (SCCs) — The EU Commission's approved transfer mechanism included in our Data Processing Agreements with processors such as Google and LinkedIn.
• EU-US Data Privacy Framework (DPF) — For processors that are certified under the DPF.
• Adequacy decisions — Where the European Commission has determined that a country provides adequate protection.

10 Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit — All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS enforced site-wide).
• Encryption at rest — Data stored on our infrastructure (AWS) is encrypted at rest using AES-256.
• Access controls — Role-based access control (RBAC) ensures only authorised personnel can access personal data, governed by least-privilege principles.
• Multi-factor authentication — Required for all staff accessing systems that store personal data.
• Vendor security assessments — We evaluate the security posture of third-party processors before onboarding.
• Incident response — We maintain an incident response plan. In the event of a personal data breach, we will notify affected individuals and relevant authorities as required by applicable law (72-hour notification under GDPR; disclosure as required under DPDPA).
• Regular audits — Periodic internal security reviews of data handling practices.

11 Your Rights Under GDPR (EU/EEA/UK Residents)

If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights under the GDPR (and the UK GDPR where applicable):

• Right of access (Art. 15) — You have the right to request a copy of the personal data we hold about you and information about how we process it.
• Right to rectification (Art. 16) — You have the right to request correction of inaccurate or incomplete personal data.
• Right to erasure / "right to be forgotten" (Art. 17) — You may request deletion of your personal data where there is no compelling reason to continue processing it.
• Right to restrict processing (Art. 18) — You may ask us to pause processing of your data in certain circumstances (e.g., while accuracy is contested).
• Right to data portability (Art. 20) — Where processing is based on consent or contract, you may request your data in a structured, machine-readable format.
• Right to object (Art. 21) — You may object to processing based on legitimate interests, including for direct marketing (which we will always honour immediately).
• Rights related to automated decision-making (Art. 22) — We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
• Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at team@codetoday.io. We will respond within 30 days (extendable to 90 days for complex requests with notice). We do not charge a fee for exercising your rights unless the request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with your local supervisory authority. If you are in the EEA, you can find your national authority at edpb.europa.eu. In the UK, contact the Information Commissioner's Office (ICO).

12 California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you specific rights regarding your personal information.

12.1 Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information as defined by the CCPA: Identifiers (name, email), Internet or other electronic network activity information (browsing history on our site via GA4), Professional or employment-related information (company, job title), and Geolocation data (approximate, country-level only).

12.2 Your California Rights

• Right to Know — You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, purposes, and third parties with whom we share it.
• Right to Delete — You may request deletion of personal information we have collected, subject to certain exceptions (e.g., legal obligation to retain).
• Right to Correct — You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing — We do not sell personal information. We do not share personal information for cross-context behavioural advertising as defined by CPRA.
• Right to Limit Use of Sensitive Personal Information — We do not collect sensitive personal information as defined by CPRA (e.g., SSN, financial account data, precise geolocation) through this website.
• Right to Non-Discrimination — We will not discriminate against you for exercising any of these rights.

12.3 How to Submit a California Rights Request

Email us at team@codetoday.io with the subject line "California Privacy Request". We will verify your identity and respond within 45 days (extendable by an additional 45 days with notice). You may designate an authorised agent to make a request on your behalf by providing written authorisation.

12.4 Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

13 Children's Privacy

Our website and services are directed at business professionals and are not intended for individuals under the age of 16 (or under 13 in the United States). We do not knowingly collect personal data from children.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at team@codetoday.io and we will promptly delete such information.

14 Third-Party Links

Our website may contain links to third-party websites, including our client case studies, engineering blog references, partner sites, and social media platforms. We are not responsible for the privacy practices or content of those sites.

We encourage you to review the privacy policies of any third-party site you visit. Our inclusion of a link does not constitute endorsement of their privacy practices.

Specifically, our site links to:

• LinkedIn (linkedin.com) — governed by LinkedIn's Privacy Policy
• YouTube (youtube.com) — governed by Google's Privacy Policy
• GitHub (github.com) — governed by GitHub's Privacy Statement
• AWS Marketplace / Partner listings — governed by Amazon's Privacy Notice

15 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Post the revised policy at this URL (codetoday.io/assets/legal/privacy.html)
• Where required by applicable law, notify you by email or prominent notice on our website

We encourage you to review this policy periodically. Your continued use of the website after the effective date of a revised policy constitutes your acceptance of the changes, to the extent permitted by applicable law.

16 Contact Us & Data Protection Officer

For all privacy-related enquiries, requests to exercise your rights, or concerns about our data practices, please contact us through the following channels:

While we are not currently required to appoint a formal Data Protection Officer under applicable Indian law, the individual responsible for overseeing data protection compliance at codetoday.io can be reached at the contact details above. EU/EEA data subjects may also contact us via our primary email for GDPR-specific requests.