Overview
Please read this notice carefully to understand what data we collect, how we use it, how long we retain it, and the rights available to visitors, clients, and candidates across the markets we serve.
1. Who We Are
KastHunt Consulting LLP ('KastHunt', 'we', 'us', 'our') is a limited liability partnership registered in India under the Limited Liability Partnership Act 2008, with its principal place of business at Prospect Hill, Shimla, Himachal Pradesh, India 171005.
We operate the website kasthunt.com and provide AI-native technology consulting, software development, and healthcare technology services to clients in the United Kingdom, United States of America, Australia, Canada, and other markets.
We are a data controller in respect of personal data collected through kasthunt.com and our direct client relationships. Where we process personal data on behalf of clients as part of a service delivery engagement, we act as a data processor under written instruction from the client as data controller.
Data protection contact: info@kasthunt.com
2. What Personal Data We Collect
We collect the following categories of personal data:
- (a) Identity data - your name, job title, professional role, and company or organisation name, provided when you complete our contact forms, enquiry questionnaires, job applications, or report download forms.
- (b) Contact data - email address, telephone number, and business address.
- (c) Professional data - your industry, clinical role, organisation type, and professional interests, provided voluntarily through our forms or inferred from your correspondence with us.
- (d) Technical data - IP address, browser type and version, operating system, device type, referral URL, pages viewed, session duration, and interaction data, collected automatically when you visit kasthunt.com.
- (e) Usage data - information about how you use our website, which pages you visit, which resources you download, and how you interact with our forms.
- (f) Communications data - the content of messages, requirements, and questions you submit through our contact forms, enquiry questionnaires, and email correspondence.
- (g) Consent records - records of your cookie consent preferences and any marketing consent you have provided or withdrawn.
We do not collect or process special category personal data, including health data, biometric data, or financial data, through kasthunt.com. Where clients engage KastHunt to build or deploy healthcare technology products, any health data involved is processed on behalf of the client under a separate Data Processing Agreement, and the client is the data controller of that data.
2A. Special Category and Health Data
KastHunt does not process special category personal data - including data concerning health, biometric data, genetic data, or data revealing racial or ethnic origin, religious beliefs, sex life, or sexual orientation - about visitors to kasthunt.com. The public website is a business-to-business information and enquiry site and is not used to collect health or other sensitive information from individuals.
Where health data or other special category data is processed in the course of a client engagement, for example when KastHunt builds, configures, or deploys a healthcare technology product for a client, the following applies:
- (a) KastHunt acts as a data processor and the client is the data controller of that data.
- (b) The lawful basis for processing and the applicable special category condition are determined and documented by the client as controller. For UK and EEA data subjects this is typically UK GDPR Article 9(2)(h) or Article 9(2)(a), in combination with an Article 6 lawful basis, as recorded in the applicable Data Processing Agreement. For Indian data principals, processing is carried out on the grounds set out in the Digital Personal Data Protection Act 2023, principally consent for a specified purpose.
- (c) KastHunt processes such data only on the documented instructions of the client and applies the technical and organisational safeguards described in this policy and the relevant Data Processing Agreement.
3. How We Collect Your Data
We collect personal data through:
- (a) Direct interactions - when you complete our Talk to Us enquiry form, download a research report, subscribe to our newsletter, apply for a role, or correspond with us by email or other means.
- (b) Automated technologies - cookies, server logs, Google Analytics, LinkedIn Insight Tag, and Microsoft Clarity when you visit kasthunt.com. See our Cookie Policy for full details.
- (c) Third-party referrals - where a third party shares your contact information with us in accordance with their own privacy policy and your consent, for example through Upwork or LinkedIn.
4. How We Use Your Data and Our Lawful Basis
We process personal data for the following purposes. For UK and EEA data subjects, we identify the lawful basis under UK GDPR Article 6 for each purpose. For Indian data subjects, we process data under the grounds provided in the Digital Personal Data Protection Act 2023.
UK GDPR lawful bases
- (a) To respond to your inquiry and provide our services - lawful basis: performance of a contract or pre-contractual steps (Article 6(1)(b)).
- (b) To deliver research reports, compliance guides, and resources you have requested - lawful basis: consent (Article 6(1)(a)) where provided; legitimate interests (Article 6(1)(f)) for existing client contacts.
- (c) To improve our website through analytics and heatmapping - lawful basis: legitimate interests (Article 6(1)(f)), assessed as not overriding data subjects' rights given the pseudonymous nature of analytics data and the availability of opt-out.
- (d) To send marketing communications to business contacts in the UK - lawful basis: legitimate interests (Article 6(1)(f)) under PECR for B2B email marketing, with opt-out available at any time.
- (e) To comply with legal obligations - lawful basis: legal obligation (Article 6(1)(c)).
- (f) For recruitment purposes - to process job applications - lawful basis: pre-contractual steps (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)).
Indian DPDP Act 2023 grounds
We process personal data of Indian data principals on the basis of: (a) consent freely given for a specific purpose; (b) certain legitimate uses as defined in the DPDP Act including processing necessary for the performance of a contract and for compliance with any law.
4A. AI Tools and Automated Technologies
KastHunt is an AI-native firm and we believe in transparency about where artificial intelligence is used. This clause discloses our use of AI tools, chatbots, automated triage, and transcription or scribe services.
- (a) On kasthunt.com. The public website does not use AI chatbots, automated clinical triage, or automated transcription or scribe tools that process visitors personal data. Confirm and amend this statement if an AI chatbot, assistant, or similar tool is enabled on the site.
- (b) PoC Lab and demonstration products. AI-powered Proof of Concept products demonstrated on kasthunt.com operate on synthetic and sample data only and do not process real personal or patient data.
- (c) Client engagements. Where KastHunt builds or deploys AI tools, chatbots, automated triage, or transcription or scribe services as part of a client product, any processing of personal or health data by those tools is carried out as a processor on the clients documented instructions and is governed by the applicable Data Processing Agreement, with the client as controller.
- (d) No solely automated decisions. KastHunt does not make solely automated decisions producing legal or similarly significant effects on individuals through kasthunt.com.
- (e) Changes. If we introduce a new AI tool that processes personal data on kasthunt.com, we will update this policy and disclose it before or at the point of deployment.
5. Data Sharing and Disclosure
We do not sell your personal data to third parties. We do not share personal data for advertising purposes. We share personal data only in the following limited circumstances.
Categories of recipients. The recipients, or categories of recipients, of personal data are: (i) our data processors and sub-processors, including analytics vendors, form-handling, CRM, communications, and scheduling providers listed below; (ii) professional advisors such as solicitors, accountants, and compliance consultants; (iii) payment providers and banks where you make or receive payment; (iv) courts, law enforcement, regulators, and other public authorities where required; and (v) parties to a business transfer. We do not, through kasthunt.com, disclose personal data to insurers, laboratories, or health bodies on our own account. Where KastHunt processes data within a healthcare client engagement, any onward recipients are determined by the client as controller and are set out in the applicable Data Processing Agreement.
(a) Service providers acting as data processors
- Google Analytics - website analytics (Google LLC, USA)
- LinkedIn Insight Tag - professional audience analytics (LinkedIn Corporation, USA)
- Microsoft Clarity - website heatmapping and session recording (Microsoft Corporation, USA)
- Tally.so or equivalent form provider - form processing and submission handling
- Notion - internal CRM and project management
- Slack Technologies - internal team communications
- Calendly - meeting scheduling
- Google Workspace - email and document management (Google LLC, USA)
(b) Legal and regulatory requirements - where required by law, court order, or regulatory authority in India, the United Kingdom, or any jurisdiction in which we operate.
(c) Professional advisors - solicitors, accountants, and compliance consultants under obligations of professional confidentiality.
(d) Business transfers - in the event of a merger, acquisition, restructuring, or asset sale involving KastHunt, personal data may be disclosed to the relevant parties subject to equivalent privacy protections.
(e) With your consent - in any other circumstances, only with your explicit prior consent.
6. International Data Transfers
KastHunt is based in India. When you interact with kasthunt.com or engage our services from the United Kingdom, European Economic Area, United States, Australia, or Canada, your personal data is transferred to and processed in India.
We apply appropriate contractual and organisational safeguards to all international transfers and regularly review these safeguards to ensure they remain adequate.
7. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, having regard to applicable legal obligations. Our standard retention periods are:
- (a) Client engagement records - 7 years from the end of the engagement. Required under Indian tax and accounting law and consistent with UK HMRC requirements for cross-border services.
- (b) Enquiry and contact form submissions - 2 years from the date of last contact, or the duration of the client relationship if longer.
- (c) Job applications - 6 months from the conclusion of the recruitment process where the application is unsuccessful. Successful applications are retained as employment records for the duration of employment plus 7 years.
- (d) Marketing consent records - for the duration of the consent and 3 years thereafter to demonstrate compliance.
- (e) Website analytics data - 26 months (Google Analytics default retention period).
- (f) Cookie consent records - 13 months from the date of consent.
- (g) Research report download records - 3 years from download date.
At the end of each retention period, personal data is securely deleted or anonymised. We do not retain data in identifiable form beyond these periods without a specific legal justification.
8. Your Rights
Rights of UK and EEA data subjects
If you are located in the United Kingdom or European Economic Area, you have the following rights in respect of your personal data processed by KastHunt:
- (a) Right of access - to receive a copy of the personal data we hold about you, within one month of your request.
- (b) Right to rectification - to have inaccurate or incomplete personal data corrected without undue delay.
- (c) Right to erasure - to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where you object to processing and there are no overriding legitimate grounds.
- (d) Right to restrict processing - to limit how we use your data in certain circumstances, for example where you contest its accuracy.
- (e) Right to data portability - to receive your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract.
- (f) Right to object - to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop processing immediately.
- (g) Rights related to automated decision-making - KastHunt does not make solely automated decisions with legal or similarly significant effects on individuals.
To exercise any of these rights, email info@kasthunt.com with the subject line 'Data Rights Request' and your full name and email address. We will respond within one calendar month. Where requests are complex or numerous, we may extend this by a further two months with notice.
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you are dissatisfied with how we have handled your personal data.
Rights of Indian data principals
If you are located in India, you have the following rights under the Digital Personal Data Protection Act 2023:
- (a) Right to access information - to obtain a summary of the personal data we process and the processing activities.
- (b) Right to correction and erasure - to correct inaccurate or misleading data and to erase data we no longer need to retain.
- (c) Right to grievance redressal - to have your complaints addressed by our designated grievance officer within the timeframes prescribed under the DPDP Act.
- (d) Right to nominate - to nominate an individual to exercise your rights on your behalf in the event of your death or incapacity.
Grievance Officer for Indian data principals: info@kasthunt.com · KastHunt Consulting LLP · Prospect Hill, Shimla, Himachal Pradesh, India 171005
Rights of Australian data subjects
If you are located in Australia, you have the right to access the personal information we hold about you and to request correction of inaccurate information. Complaints may be directed to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. To exercise your rights, contact info@kasthunt.com.
Rights of US data subjects
If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information, including the right to know, delete, and opt-out of the sale or sharing of personal information. KastHunt does not sell or share personal information for cross-context behavioural advertising.
11. Children's Privacy
kasthunt.com is not directed at children under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact info@kasthunt.com and we will delete it promptly.
12. Changes, Version Control, and Review
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or our services. The version and last updated details at the top of this page reflect the current edition and the date of the most recent revision.
This policy is version-controlled and dated. We review it at least once every 12 months, and additionally whenever there is any material change to our processing activities, the tools or third parties we use, or the applicable law. The next scheduled review date is shown at the top of this policy.
We will notify registered newsletter subscribers and active clients of material changes by email where we hold valid contact details. Your continued use of kasthunt.com after the effective date of any changes constitutes your acknowledgment of the revised policy.
12A. Accessibility of this Notice
We aim to make this Privacy Policy easy to find and easy to understand. It is written in plain language and structured so that you can locate the information that matters to you. We will provide this notice in accessible formats, for example large print or a screen-reader-friendly version, on request, and we will provide a translation where the audience for a particular service warrants it. To request an alternative format or a translation, contact info@kasthunt.com.
13. Contact
For any questions about this Privacy Policy, to exercise your data rights, or to raise a data protection concern:
- Email: info@kasthunt.com
- Post: KastHunt Consulting LLP · Prospect Hill · Shimla · Himachal Pradesh · India 171005
- Response time: We respond to all data rights requests within one calendar month.