Statutory legal framework governing personal data processing, enterprise subprocessor guarantees, and data subject rights under EU GDPR (Regulation 2016/679) and the UK Data Protection Act.
This Privacy Policy outlines how Subid Das (“we”, “us”, or “consultant”) collects, processes, and protects personal data obtained through this web property (https://subid-das.vercel.app) and related commercial scoping correspondence.
We practice strict data minimization: we do not maintain marketing mailing lists, do not profile visitors, and only process information strictly required to evaluate project scope, execute consulting agreements, and ensure infrastructure resilience.
Key data processing operations summarized for legal counsel and compliance officers:
| Activity | Legal Basis (GDPR) | Data Elements | Retention |
|---|---|---|---|
| Scoping & Inquiries | Art. 6(1)(b) Contractual | Name, work email, technical specs | 24 months post-inquiry |
| Call Scheduling | Art. 6(1)(b) Pre-contractual | Name, email, timezone, notes | Duration of engagement |
| Security & DDoS Defense | Art. 6(1)(f) Legitimate Int. | Ephemeral IP address, User-Agent | 30 days rolling cache |
| Client Billing & Accounting | Art. 6(1)(c) Legal Obligation | Corporate invoices, VAT/tax IDs | 7 years (statutory tax) |
The statutory controller responsible for data processing on this platform is:
Every data processing operation is anchored in a defined statutory ground under Article 6(1) of the GDPR:
When you submit a technical brief, request a statement of work, or book an architecture review, processing your name, professional email, and infrastructure scope is strictly necessary to prepare estimates, verify feasibility, and negotiate commercial terms.
We process network-level telemetry (ephemeral IP addresses, request latency, and HTTP headers) for the legitimate operational purpose of mitigating malicious bots, preventing brute-force and DDoS attacks, and ensuring platform uptime.
Commercial engagement invoices, contract signatures, and milestone payments are processed and archived in strict conformity with mandatory commercial accounting and tax retention regulations.
We partition data intake into two mutually exclusive channels:
We contract exclusively with enterprise infrastructure providers that guarantee strict technical and organizational safeguards (TOMs) under GDPR Article 28:
| Provider | Role | Datacenter Region | Transfer Safeguard |
|---|---|---|---|
| Vercel Inc. | Serverless Edge Hosting & CDN | Global Edge (incl. EU Frankfurt/London) | EU Standard Contractual Clauses (SCCs) |
| Cal.com Inc. | Scoping Session Scheduling | EU / US (SOC 2 Type II Certified) | Data Processing Addendum (DPA) + SCCs |
| Zoho Corporation | Transactional Email Routing | Tier-3 ISO 27001 Datacenters (TLS 1.3) | Enterprise DPA + GDPR Compliance |
In adherence to storage limitation principles (Art. 5(1)(e) GDPR), data is purged automatically once its operational purpose has lapsed:
Retained to maintain consulting continuity; deleted upon client request or expiration.
Stored in rolling FIFO security caches for automated DDoS mitigation and error debugging.
Signed statements of work and financial receipts retained under statutory accounting requirements.
If you reside in the EU/EEA, United Kingdom, or Switzerland, you possess the following statutory rights under Articles 15–22 of the GDPR:
All verifiable requests are acknowledged and executed within 30 days free of statutory charge.
Statutory identification details according to Section 5 of the German Digital Services Act (Digitale-Dienste-Gesetz - DDG):