Privacy Policy
Privacy Policy
We make brands for a living, which means we handle ideas, briefs, faces, voices and the occasional secret. Here is
exactly what we do with them
| Last updated | Entity | CIN | Governing law |
|---|---|---|---|
| 28 September 2026 | Finding Enki Dot Com Pvt Ltd | U74999HR2018PTC074249 | DPDP Act, 2023 |
01
Who we are
Enki Studio is a brand strategy and creative agency, and a brand of Finding Enki Dot Com Private Limited, a company incorporated in India under the Companies Act, 2013 (CIN: U74999HR2018PTC074249), with its registered office at 305 C, 3rd Floor, IRIS Tech Park, Sohna Road, Sector 48, Gurugram, Haryana 122002, India. In this policy, “Enki Studio”, “we”, “us” and “our” mean that company.
This policy explains what personal data we collect, why we collect it, how long we keep it, and what you can ask us to do with it. We have tried to write it the way we would want one written for us: plainly.
Scope
It applies to personal data we process when you visit enki.studio, contact us, work with us as a client or partner, apply for a job, attend our events, appear in our podcasts or productions, or subscribe to our communications.
Applicable law
We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Digital Personal Data Protection Rules, 2025, and, to the extent still in force, the Information Technology Act, 2000 and its rules. Under the DPDP Act, we act as a Data Fiduciary for the personal data whose use we decide, and you are the Data Principal.
02
What we collect
We collect only what we need to do the work, and we try hard not to need much.
| Category | Examples | How we get it |
|---|---|---|
| Identity and contact |
Name, designation, company, email, phone number |
Forms, emails, calls, meetings, business cards |
| Engagement and commercial |
Briefs, proposals, contracts, invoices, billing and GST details, correspondence |
From you or your organisation |
| Recruitment |
CV, portfolio, work history, education, references, interview notes |
Applications, job portals, referrals |
| Content and likeness |
Photographs, video, voice recordings, quotes, bios |
Shoots, podcasts, events and productions you take part in |
| Website and device |
IP address, browser type, pages viewed, referring site, approximate location |
Cookies and analytics tools |
| Marketing preferences |
Newsletter subscriptions, event registrations, communication choices |
Sign-ups and your settings |
We do not knowingly collect financial account numbers, government ID numbers, health data or similar sensitive information, except where the law requires it for employment, payroll or tax purposes. When we do, we collect the minimum and guard it accordingly.
03
Why we use it, and on what basis
Every use of your data rests on one of two grounds the DPDP Act allows: your consent, or a legitimate use, such as data you have voluntarily given us for a specified purpose, or processing the law requires.
| Category | Examples |
|---|---|
| Responding to enquiries and preparing proposals | Voluntarily provided for that purpose |
| Delivering client engagements and managing contracts | Voluntarily provided; contract performance |
| Invoicing, accounting, tax and statutory records | Legal obligation |
| Evaluating job applications | Voluntarily provided for that purpose |
| Featuring you in podcasts, case studies, films or social content | Consent, obtained in writing before publication |
| Sending newsletters, event invitations and updates | Consent, withdrawable at any time |
| Improving our website through analytics | Consent, through your cookie choices |
| Security, fraud prevention and resolving disputes | Legitimate use; legal obligation |
We do not knowingly collect financial account numbers, government ID numbers, health data or similar sensitive information, except where the law requires it for employment, payroll or tax purposes. When we do, we collect the minimum and guard it accordingly.
We do not sell personal data. We do not rent it, trade it, or use it to train anyone's AI models.
We do not use it for purposes you would find surprising. If we ever want to use it for a new purpose, we will tell you first and, where required, ask.
04
Data we handle for our clients
Sometimes clients hand us personal data belonging to their own customers, employees or audiences: a contact list for a campaign, testimonials for a microsite, speaker details for an event. In those cases the client decides the purpose, and we act as a Data Processor on their behalf. When we do, we:
We do not knowingly collect financial account numbers, government ID numbers, health data or similar sensitive information, except where the law requires it for employment, payroll or tax purposes. When we do, we collect the minimum and guard it accordingly.
- process the data only on the client's documented instructions and under a written agreement;
- use it for nothing else, including our own marketing;
- apply the same security safeguards described in Section 07;
- inform the client without delay if we become aware of a breach; and
- return or delete the data when the engagement ends, unless the law requires us to keep it.
If your data reached us through one of our clients, that client’s privacy policy governs it, and requests to exercise your rights are best directed to them first. We will help them respond.
05
Cookies and analytics
| Type | What it does | Can you refuse it? |
|---|---|---|
| Strictly necessary | Keeps the site running and remembers your cookie choices | No |
| Analytics | Counts visits and measures page performance, for example Google Analytics | Yes |
| Embedded media | Loads videos or content hosted by third parties, for example YouTube or Vimeo | Yes |
06
Who we share it with
- Service providers who help us run the studio: cloud storage and email, project management tools, website hosting, analytics, accounting and payroll software, and payment processors.
- Freelancers and production partners such as photographers, videographers, voice artists and printers, engaged under confidentiality terms for a specific project.
- Our clients, where you are a vendor, collaborator or participant in work we deliver for them.
- Professional advisers such as lawyers, auditors and chartered accountants.
- Authorities, when the law, a court or a government body lawfully requires it.
- A successor business, if Finding Enki Dot Com Pvt Ltd is merged, acquired or restructured, subject to the same protections in this policy.
Transfers outside India
We work across Gurgaon, Paris and Boston, and some of our service providers store data on servers outside India. We transfer personal data abroad only as the DPDP Act permits, and never to a country the Central Government has restricted. We choose providers with recognised security standards and contractual safeguards.
07
How long we keep it , and how we protect it
| Data | Typical retention |
|---|---|
| Enquiries that did not become engagements | 1 year from last contact |
| Client and vendor records, contracts, invoices | 8 years, as tax and company law require |
| Unsuccessful job applications | 1 year, unless you ask us to keep your profile longer |
| Published content featuring you | For the life of the published work, unless you withdraw consent for future use |
| Newsletter and marketing lists | Until you unsubscribe |
| Website analytics | Up to 14 months |
Security
We use safeguards suited to a studio of our size: access limited to people who need it, encrypted storage and transfer where available, multi-factor authentication on key systems, confidentiality obligations for our team and partners, and periodic review of who can see what.
If something goes wrong
No system is unbreakable, including ours. If a personal data breach occurs, we will inform affected individuals without delay and notify the Data Protection Board of India within the timelines the DPDP Rules set, telling you what happened, what it means for you, and what we are doing about it.
08
Your, rights
- Access a summary of the personal data we hold about you, how we use it, and who we have shared it with.
- Correct, complete or update data that is inaccurate or out of date.
- Erase data we no longer need, unless the law requires us to keep it.
- Withdraw consent at any time, as easily as you gave it. Withdrawal does not undo processing that already happened lawfully, and it may mean we cannot continue a service that depends on that data.
- Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
- Raise a grievance with us and, if it is not resolved, complain to the Data Protection Board of India.
- To exercise any of these, write to our Grievance Officer (Section 09). We may ask you to verify your identity first, which protects you from someone pretending to be you.
Children
Our services are meant for businesses and adults. We do not knowingly collect personal data from anyone under 18 without verifiable consent from a parent or lawful guardian. Where a production or campaign involves a child, we obtain that consent in writing first, and we never use a child’s data for tracking, behavioural monitoring or targeted advertising. If you believe we hold a child’s data without such consent, tell us and we will delete it.
09
Grievance Officer
| NAME | Kartik Murali |
| COMPANY | Finding Enki Dot Com Private Limited |
| ADDRESS | 305 C, 3rd Floor, IRIS Tech Park, Sohna Road, Sector 48, Gurugram, Haryana 122002, India |
| kartik@enki.studio | |
| PHONE | 998331896 |
We will acknowledge your request within 7 working days and resolve it within 30 days, and in any case within the period the DPDP Rules allow. If you are not satisfied with our response, you may approach the Data Protection Board of India.
For anything else, write to hello@enki.studio.
10
Changes to this policy
We will update this policy when the law, our services or our practices change. The date at the top tells you when it was last revised. For significant changes, we will notify you by email or through a prominent notice on our website before they take effect.