Privacy Policy
How Canopus IT Solutions Private Limited handles personal data — what we collect, why, how long we keep it, and what you can ask us to do about it.
We collect the contact details you send us in an enquiry, basic analytics about how this site is used, and — where you become a client — the project data needed to do the work. We don't sell, rent or share personal data with anyone for marketing. You can ask us to delete your details at any time and we'll confirm in writing.
1. Who we are
Canopus IT Solutions Private Limited ("Canopus", "we", "us") is a software engineering company registered in India, operating the website at canopussoft.com. For enquiries submitted through this site and for our own business communications, Canopus acts as the data controller.
Where we build or operate software on behalf of a client, and that software processes personal data belonging to the client's users, the client is the controller and Canopus acts as a data processor under a separate data processing agreement.
Contact for any privacy matter: [email protected].
2. What we collect
Enquiry data
When you submit a form or email us, we collect the name, work email address, company, phone number, country and project description you choose to provide. Only name, email and a project description are required to reply.
Collected automatically with an enquiry
Submitting the form also records, alongside what you typed: the page you submitted from, the address of the site that referred you, any campaign parameters in the link you followed (utm_source, utm_medium, utm_campaign, utm_term, utm_content), your browser's user-agent string, and a one-way keyed hash of your IP address. The hash lets us recognise repeat abuse without storing the address itself. All of it is kept with the enquiry, for the same period.
Website usage data
None. This site runs no analytics, no tag manager, and no advertising or cross-site tracking of any kind. Nothing about your visit is recorded unless you submit the form.
Client project data
During an engagement we may access systems, databases and documents belonging to a client. Access is named, role-scoped and time-limited. Where that data includes personal information, handling is governed by the data processing agreement signed at the start of the engagement, not by this policy alone.
What we don't collect
We don't buy contact lists, don't use tracking pixels to build advertising profiles of visitors, and don't attempt to identify anonymous website visitors through third-party enrichment services.
3. Why we process it, and on what basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Replying to your enquiry | Name, email, phone, company, message | Legitimate interest — you asked us to |
| Preparing a proposal | Enquiry data plus technical detail you share | Steps prior to entering a contract |
| Delivering an engagement | Client contact and project data | Performance of a contract |
| Understanding site usage | Aggregate analytics | Legitimate interest, or consent where required |
| Legal and accounting records | Invoicing and contract records | Legal obligation |
Scroll the table sideways for the full detail.
4. Who we share it with
We do not sell, rent or trade personal data. We share it only with service providers necessary to operate the business, each bound by contract to process it only on our instructions:
- Cloud hosting — Amazon Web Services, Microsoft Azure or Google Cloud, depending on the engagement
- Source control — GitHub, for code and issue tracking
- Business communication — email and collaboration tooling used to run the company
- Accounting and payment processing — where required to invoice and receive payment
Any sub-processor that touches client data is named in the applicable data processing agreement, and we give notice before adding one. We may also disclose data where legally required to do so.
5. International transfers
Canopus is based in India and delivers to clients in the United States, United Kingdom, Europe, the GCC, Australia and Singapore. Personal data may therefore be processed outside your country of residence. Where personal data is transferred out of the UK or the European Economic Area, we rely on Standard Contractual Clauses or an equivalent recognised transfer mechanism.
For client project data specifically, we deploy into the client's own cloud account and chosen region wherever possible, so the data stays where the client requires it.
6. How long we keep it
- Enquiries that don't become projects — 24 months, then deleted
- Client contact and project records — for the duration of the engagement and 7 years afterwards, where accounting and legal obligations require it
- Access credentials to client systems — revoked at engagement end, with written confirmation of what was removed and when
- Server request logs — kept by the hosting provider for operational and security purposes only, and not used to build any profile of a visitor
7. Your rights
Where GDPR, UK GDPR or comparable legislation applies to you, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — have inaccurate data corrected
- Erasure — ask us to delete your data, subject to legal retention obligations
- Restriction — ask us to limit how we use it while a query is resolved
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — where processing relies on consent, at any time
Email [email protected] and we'll respond within 30 days. There's no charge, and we don't require a specific form or wording — a plain email is enough.
Where we process data on behalf of a client, requests from that client's users should go to the client as controller. We'll assist them in responding.
8. Cookies
This site sets two cookies and no others: a session cookie and a CSRF token, both required for the enquiry form to submit safely. There are no analytics cookies, no advertising cookies and no cross-site tracking — which is why there is no consent banner. If that changes, this page changes first and a banner appears with it.
9. Security
We apply the controls described on our security and compliance page: named and role-scoped access, encryption in transit and at rest, secrets held in a secret manager, code review on every change, and dependency and secret scanning in CI. Where an incident affects personal data we hold or process, we notify affected parties without undue delay and provide a written timeline afterwards.
We are not currently ISO 27001 or SOC 2 certified, and we say so plainly rather than implying otherwise.
10. Changes to this policy
We update this policy when our practices change. The date at the top of the page reflects the current version. Material changes affecting existing clients are communicated directly rather than only published here.
11. Contact and complaints
For any privacy question, request or complaint: [email protected], or use the form on our contact page. You can also call +91 817 979 7732.
For the commercial terms that sit alongside this policy — including the data processing agreement, IP assignment and notice periods — see engagement models.
If you're in the UK or EEA and are unhappy with our response, you have the right to complain to your local supervisory authority — in the UK, the Information Commissioner's Office. We'd ask you to raise it with us first, because most complaints turn out to be something we can fix the same week.