GDPR | The Demandverse

This page explains how The Demandverse complies with the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR together with the Data Protection Act 2018. It summarises and supplements our Privacy Policy, which contains the full details.

Data controller

The Demandverse (thedemandverse.com) is a publication owned and operated by Demand Kings Media Private Limited, a private limited company incorporated in India, with its office at Camp, Pune - 411001, Maharashtra, India ("we", "us", "our"). For any question about this policy or your personal information, email Sherlyn@thedemandverse.com or call +91 7057867883.

We are established outside the European Union and the United Kingdom. Our processing of personal data from those regions is limited to reading the website, our free newsletter and correspondence; it does not involve large-scale processing or special categories of data.

Lawfulness, fairness and transparency: we process personal data only on the legal bases set out below and explain our practices in plain language.
Purpose limitation: we use your data only for the purposes we collected it for.
Data minimisation: the newsletter asks only for an email address, and we use no analytics or advertising trackers.
Accuracy: you can correct your information at any time.
Storage limitation: we keep data only as long as described in our retention schedule.
Integrity and confidentiality: we protect data with encryption in transit, access controls and secure storage.
Accountability: we keep records of our processing and of the requests we receive.

Personal data we process and our legal bases

Data	Purpose	Legal basis	Retention
Email address and sign-up date	Sending the newsletter you requested	Consent, Article 6(1)(a)	Until you unsubscribe; a suppression record afterwards
Name, email address and message content	Responding to your messages and requests	Legitimate interests, Article 6(1)(f); legal obligation, Article 6(1)(c)	Up to 2 years after the matter is closed
IP address, user agent, pages requested, referrer, timestamps (server logs)	Delivering and securing the website	Legitimate interests, Article 6(1)(f)	Up to 90 days

We do not process special categories of personal data, we do not carry out automated decision-making or profiling within the meaning of Article 22, and providing your email address for the newsletter is entirely voluntary.

Right to be informed (Articles 13 and 14), which this page and our Privacy Policy fulfil
Right of access (Article 15)
Right to rectification (Article 16)
Right to erasure, the "right to be forgotten" (Article 17)
Right to restriction of processing (Article 18)
Right to data portability (Article 20)
Right to object, including to processing based on legitimate interests (Article 21)
Right to withdraw consent at any time, without affecting earlier processing (Article 7(3))
Right to lodge a complaint with a supervisory authority (Article 77), in particular in the EU member state where you live, work or where an alleged infringement took place, or, in the UK, with the Information Commissioner's Office (ico.org.uk)

How to make a request

Email Sherlyn@thedemandverse.com with the subject "GDPR request" and tell us which right you wish to exercise. We will verify that you control the email address concerned, and respond within one month of receiving your request. If your request is complex or we receive many requests, we may extend this by up to two further months, and we will tell you within the first month. Requests are free unless they are manifestly unfounded or excessive.

Processors

We use a small number of processors: our web hosting provider and, for newsletters, an email delivery provider. Each processes personal data only on our documented instructions under a data processing agreement meeting the requirements of Article 28.

International transfers

Our website is hosted in the United States and we are based in India. Transfers of personal data from the EEA, the UK or Switzerland are protected by the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) or another valid mechanism under Chapter V of the GDPR.

Personal data breaches

If a personal data breach occurs, we will assess it promptly, notify the competent supervisory authority within 72 hours where required by Article 33, and inform affected people without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Article 34).

Cookies and ePrivacy

We do not use non-essential cookies or similar technologies, so we do not need to ask for cookie consent under the ePrivacy Directive or the UK PECR. Details are in our Cookie Policy.