01Who we are and what this policy covers

This Privacy Policy explains how Raymond Cardoza Enterprises (“RCE”, “we”, “us”, “our”), a sole proprietorship owned by Raymond Ronald Cardoza and based in Mangaluru, Karnataka, India, collects, uses, stores, shares and protects personal data. Some of our services are delivered under our Y5 MEDIA™ brand; this policy applies to them as well.

It applies to personal data we process when you:

• visit or use raymondcardoza.com (the “Website”);
• contact us through the Website contact form, email, phone, WhatsApp, Google Meet or our online appointment booking page;
• request a quotation, a free workflow audit or other consultation;
• engage us as a client (business automation, IT/BPO and remote teams, NRI asset management, education projects, business solutions, e-commerce and trading, or digital marketing);
• apply for a job or work opportunity with us.

It does not cover personal data we process only on behalf of our clients under a contract (see Section 13), or third-party websites and products linked from the Website, which have their own privacy policies.

02Legal framework and our role

We have prepared this policy with reference to the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), as well as the Information Technology Act, 2000 and the rules made under it.

• Data Fiduciary: for personal data we collect for our own purposes (Website enquiries, client relationships, billing, recruitment), we decide why and how the data is processed and act as a Data Fiduciary under the DPDP Act.
• Data Processor: where we process personal data on behalf of a client (for example, their customers’ data inside a CRM, WhatsApp automation, school ERP or back-office process we run for them), the client is the Data Fiduciary and we act as its Data Processor under a contract.
• Significant Data Fiduciary: we have not been notified as a Significant Data Fiduciary. If that ever changes, we will meet the additional obligations that apply (such as appointing a Data Protection Officer based in India, independent data audits and periodic Data Protection Impact Assessments) and will update this policy.

03Personal data we collect

We collect only the personal data that is reasonably necessary for the purpose for which it is provided. Depending on how you interact with us, this may include:

Please do not send us sensitive information, such as health information, passwords or full bank or card details, through the contact form or chat. If a service genuinely needs sensitive documents, we will tell you what is required and how to share it securely.

04Where we get personal data from

• Directly from you when you fill in forms, write to us, speak to us or share documents.
• From people acting for you, such as a family member, employee or authorised representative (for example, a relative who manages an NRI property on your behalf). If you give us someone else’s personal data, please make sure you are entitled to do so and that they are aware of this policy.
• From your organisation when you are its contact person for an engagement.
• From government portals, banks, registries and other public or official sources, only where you instruct us to obtain records for a service (for example, property tax or land records).
• From service providers we use, such as our appointment-booking tool, email provider and, where enabled, website analytics.
• Automatically from your device when you browse the Website.

05Why we use your data and on what basis

The DPDP Act allows personal data to be processed on the basis of consent or for certain legitimate uses listed in Section 7 of the Act. We use personal data for the following purposes:

We will not use your personal data for a new purpose that is unrelated to the purpose for which it was collected without telling you and, where required, obtaining your consent.

06Notice, consent and withdrawing consent

Where we rely on consent, it will be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action (for example, choosing to submit a form or book a meeting after being shown this policy), and limited to the data needed for the stated purpose. Simply browsing the Website is not treated as consent to anything beyond what is strictly necessary to display it securely.

You may withdraw your consent at any time, as easily as you gave it, by emailing privacy@raymondcardoza.com with the subject line “Withdraw Consent”, or by replying to any marketing message asking us to stop. After withdrawal we will stop processing the data for that purpose within a reasonable time and ask our processors to do the same, unless the law requires or permits us to keep it.

• Withdrawal does not affect processing that took place before you withdrew.
• If the data is needed to deliver a service you have engaged us for, withdrawing consent may mean we can no longer provide that service. We will explain the consequences if this applies.
• Once the Consent Manager framework under the DPDP Rules is operational, you may also be able to give, manage and withdraw consent through a registered Consent Manager where we support one.

07Cookies, analytics and similar technologies

The Website uses cookies and similar technologies for the following purposes:

We do not use cookies to sell personal data, and we do not use tracking, behavioural monitoring or targeted advertising directed at children. If we introduce advertising or remarketing cookies in future, we will update this policy and seek consent where required.

08Who we share personal data with

We do not sell or rent personal data. We share it only where necessary for the purposes in Section 5, and only to the extent needed:

• Our team: authorised staff and contractors who need it to do their work and are bound by confidentiality obligations.
• Service providers acting as our Data Processors: website hosting and security, email and cloud productivity tools, the Contact Form 7 plugin running on our Website, Google (Calendar appointment booking, Meet, Maps, Translate, Fonts and, where enabled, Analytics), Meta (WhatsApp), accounting software and IT support. We engage them under contracts or terms that require them to protect personal data and to process it only for the services they provide to us.
• Professional advisers such as chartered accountants, auditors and lawyers, who are bound by professional confidentiality.
• Banks and payment providers, to receive or refund payments.
• Parties you ask us to deal with: for NRI asset management and similar services, this may include tenants, property managers, contractors, banks, utility providers, housing societies, registration offices and other government departments, but only as required by your instructions.
• Technology partners whose products we refer you to (such as PharmaDesk, GymDrive or FlyLib), only if you ask us to connect you with them.
• Authorities, where required by law, court order or a lawful request from a government agency, or to protect our legal rights.
• A successor business, if our business or a part of it is transferred, subject to this policy.

When you contact us through WhatsApp or book through Google, those platforms also process your data under their own privacy policies as independent providers.

09Cross-border transfers

We serve clients in India, Nepal, Bangladesh and the GCC, and several of the service providers we use (for example, cloud email, calendar and messaging services) may store or process data on servers outside India. Section 16 of the DPDP Act permits transfer of personal data outside India except to countries or territories that the Central Government restricts by notification. We will not transfer personal data to any restricted country or territory, and we will follow any stricter requirements that apply under other Indian laws. Where we transfer data abroad, we use reputable providers and contractual safeguards to protect it.

10How long we keep personal data

We keep personal data only for as long as it is needed for the purpose it was collected for, or as long as the law requires. As a guide:

When the retention period ends, or when you withdraw consent and no law requires us to keep the data, we will delete it or anonymise it so that it can no longer identify you. Where the DPDP Rules require us to give you advance notice before erasing data because of inactivity, we will do so.

11How we protect personal data

We take reasonable security safeguards to prevent personal data breaches, appropriate to the size of our business and the nature of the data. These include:

• encrypted connections (HTTPS/SSL) on the Website, and a firewall and bot-protection layer;
• access to personal data limited to people who need it, with strong passwords and two-factor authentication where available;
• secure storage of documents, with encryption where practical for sensitive files;
• regular software updates, malware protection and backups;
• logging and monitoring of access to our systems, so that unauthorised access can be detected and investigated;
• confidentiality commitments from staff and contractors, and contractual obligations on our processors.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please help protect your information by using secure channels and never sharing passwords or OTPs with anyone claiming to be from us.

12Personal data breaches

If a personal data breach occurs, we will act promptly to contain it, assess its impact and reduce harm. Where required by the DPDP Act and Rules, we will inform the Data Protection Board of India and each affected Data Principal without delay, describing the nature, extent, timing and likely consequences of the breach, the steps we are taking, and what you can do to protect yourself, and we will provide the Board with the further details required within the prescribed period (currently 72 hours). Where applicable, we will also report cyber security incidents to CERT-In within the time required by its directions. Where we act as a Data Processor, we will notify the relevant client promptly so that it can meet its own obligations.

13When we process data for our clients

Many of our services involve handling personal data that belongs to our clients’ customers, students, parents, employees or tenants, for example in business automation and CRM workflows, WhatsApp and email messaging, remote-team and BPO processes, school ERP systems and student or parent apps. In those cases:

• the client is the Data Fiduciary and is responsible for giving notice, obtaining any consent required (including verifiable parental consent for children), and handling the rights of its Data Principals;
• we act as the client’s Data Processor, processing the data only on the client’s documented instructions and under a contract;
• we apply the security safeguards in Section 11, keep the data confidential, assist the client with breach notification and rights requests, and return or delete the data when the engagement ends, unless the law requires us to keep it.

If you are a customer, student, parent or employee of one of our clients, please send requests about your data to that organisation. If you contact us, we will pass your request to the client.

14Children’s personal data

Under the DPDP Act, a “child” is anyone under 18 years of age. The Website and our services are intended for adults and businesses and are not directed at children. We do not knowingly collect a child’s personal data for our own purposes without the verifiable consent of a parent or lawful guardian, obtained in the manner set out in the DPDP Rules. If we learn that we have collected a child’s personal data without such consent, we will delete it. The same safeguards apply to a person with a disability who has a lawful guardian.

We do not carry out tracking, behavioural monitoring or targeted advertising directed at children, or any processing likely to harm a child’s well-being. For education projects, the school or institution is the Data Fiduciary for student and parent data and is responsible for obtaining verifiable parental consent; we process that data only as its Data Processor (see Section 13).

15Your rights as a Data Principal

Subject to the DPDP Act and Rules (and as those provisions come into force), you have the right to:

• Access information: obtain a summary of the personal data we process about you, the processing activities, and the identities of other Data Fiduciaries and Data Processors we have shared it with, together with a description of what was shared;
• Correction, completion and updating of inaccurate or incomplete personal data;
• Erasure of personal data that is no longer needed for the purpose for which it was collected, unless we must keep it to comply with law;
• Withdraw consent at any time (see Section 6);
• Grievance redressal: have your complaint about our handling of your data addressed by us (see Section 19);
• Nominate another person to exercise your rights in the event of your death or incapacity.

How to make a request

Email privacy@raymondcardoza.com with the subject line “Data Principal Request”, stating your name, how you have dealt with us and what you are asking for. We may ask for information to verify your identity (or the authority of a person acting for you) before acting on the request, and we will use that information only for verification. We will acknowledge your request promptly and aim to respond within 30 days, and in any case within the period prescribed under the DPDP Rules (currently no more than 90 days). There is no fee for a reasonable request.

16Your duties as a Data Principal

The DPDP Act also places duties on Data Principals. When exercising your rights you must comply with applicable law, not impersonate another person, not suppress material information when providing personal data, not file false or frivolous grievances or complaints, and provide only verifiably authentic information when asking for correction or updating.

17Marketing communications

We send promotional messages by email or WhatsApp only to people who have agreed to receive them or have an existing relationship with us where the law allows it. Every marketing message will tell you how to opt out, and you can also opt out at any time by emailing us. Service messages about an active enquiry or engagement (such as quotations, invoices and progress updates) are not marketing.

18Third-party websites and products

The Website links to third-party websites, tools and products, including Google, WhatsApp and technology partners such as PharmaDesk, GymDrive and FlyLib. Those services are operated by their own providers under their own privacy policies, and we are not responsible for their practices. Please read their policies before sharing personal data with them.

19Grievance Officer and escalation

If you have a question or complaint about how we handle personal data, please contact our Grievance Officer, who is also the person able to answer questions about our processing of personal data:

We will acknowledge your grievance with a reference number within 48 hours, send a progress update within 15 days if the matter is complex, and give you a final written response within 30 days of receipt, well within the 90-day maximum under the DPDP Rules, 2025. If you are not satisfied with our response, you may, once you have exhausted this grievance process, file a complaint with the Data Protection Board of India in the manner prescribed under the DPDP Act and Rules.

20Changes to this policy

We may update this policy to reflect changes in the law (including the phased commencement of the DPDP Rules), our services or our practices. The “Last Updated” date at the top shows when it was last changed. If we make a material change that affects how we use personal data you have already given us, we will notify you by reasonable means and seek fresh consent where required.

This policy forms part of one legal framework together with our Business Policy, Refund Policy, Terms & Conditions and Disclaimer. Where a signed agreement, proposal or statement of work with you says something different, that document prevails for your engagement.

Effective Date: 29 September 2026 · Last Updated: 29 September 2026 · This version replaces all earlier versions of our Privacy Policy.