Privacy policy

1. Who we are and what this policy covers

Build to Sustain is the trading name of Buildtosustain Solutions Private Limited, a private limited company in India. In this policy, ‘we’, ‘us’ and ‘our’ mean Buildtosustain Solutions Private Limited.

This policy explains how we handle personal data that we collect through this website, buildtosustain.net, including through cookies, and when you contact us by email, phone or WhatsApp. We decide why and how that data is used, so we are its Data Fiduciary under India’s Digital Personal Data Protection Act 2023 (the DPDP Act).

This policy is written to meet our duties under India’s Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011. It also reflects the DPDP Act and the Digital Personal Data Protection Rules 2025, which are coming into force in stages.

Client data. If your organisation is our client, data entered into the platforms we use for client work (Pulse, Karbon, Bridge and Lenz) is handled under your organisation’s engagement with us, not under this policy.

2. What we collect and why

We collect the personal data you choose to send us and, if you accept analytics cookies, information about how you use this website, as set out below. Our website does not keep form submissions in its database: they are sent to us by email at [email protected].

Where it comes from	What we collect	Why we use it	Legal basis
Contact form (Contact page)	Name, email address and message; optionally, your company, phone number and topic	To reply to your enquiry	You gave it to us for this purpose
Newsletter sign-up (foot of every page)	Email address	To send you our insights	Your consent
CV sent by email (Careers page)	What you put in your CV and email, usually your name, contact details, education and work history	To assess your application and contact you about it	You gave it to us for this purpose
Email, phone or WhatsApp	Your name, email address or phone number, and what you tell us	To reply to you	You gave it to us for this purpose
Visiting this website, if you accept analytics cookies	Pages you view and information about your visit, device and browser, collected through Google Analytics cookies	To understand how visitors use this website and improve it	Your consent
Cookie banner (every page)	Your cookie choices, stored in cookies on your device (listed in our cookie policy)	To apply and remember your choices	You gave it to us for this purpose

‘You gave it to us for this purpose’ refers to section 7(a) of the DPDP Act: when you give us information for a specific purpose, we may use it for that purpose. We do not use it for anything else. If you tell us you no longer want us to use it, we will stop, although we may have to keep it where the law requires.

We use your newsletter email address only to send you our insights. You can withdraw your consent at any time by emailing [email protected], and we will stop sending the newsletter. Withdrawing consent does not affect what we did before you withdrew it.

Please do not include sensitive information we have not asked for, such as identity numbers, bank details or health information, in your messages or your CV.

3. Who we share your data with

We share personal data only with:

• Our team: the people at Build to Sustain who need it to reply to you, send the newsletter or consider your application.
• Our service providers: the companies that host and deliver our website and host our email, and any service we use to send our newsletter. They handle the data to provide their services to us.
• GrantCookie, which provides our cookie banner, and Google, which provides Google Analytics (see section 7). Google may also use some of this information under its own terms.
• Authorities, where the law requires it: for example, a court, regulator or law enforcement agency.

If you message us on WhatsApp, WhatsApp handles your messages under its own terms and privacy policy.

We do not sell your personal data.

4. Where your data is stored

We are based in India, with offices in Bangalore and Kerala. Our service providers, including Google and GrantCookie, may store or process data on servers in India or in other countries. If the Government of India restricts transfers of personal data to a particular country, we will follow that restriction.

5. How long we keep your data

We keep personal data only for as long as we need it to do what you asked, or until you withdraw your consent, unless the law requires us to keep it longer. We then delete it.

Analytics cookies and your cookie choice stay on your device for the periods listed in our cookie policy. Google keeps analytics data according to the data retention settings in our Google Analytics account.

6. How we protect your data

We use reasonable security safeguards to protect personal data from loss, misuse and unauthorised access. This website uses an encrypted (HTTPS) connection. No way of sending or storing data over the internet is completely secure, so please do not send us sensitive information we have not asked for.

If a personal data breach affects your data, we will inform you and the authorities as the law requires.

7. Cookies and analytics

When you first visit this website, a cookie banner asks for your choice about cookies. It offers Accept All, Reject All and Customise, so saying no is as easy as saying yes. The banner is provided by GrantCookie and is loaded from GrantCookie’s servers. It saves your choice on your device in cookies whose names start with gc_consent.

We use Google Analytics 4, provided by Google, to understand how visitors use this website, for example which pages are viewed. If you accept analytics cookies, it sets cookies on your device (_ga and _ga_VRL88T4MCC) and collects information about your visit, your device and your browser. If you reject them, Google Analytics does not run on your visit: it sets no cookies and sends nothing to Google.

You can change your choice at any time with the Cookie settings link at the foot of every page. If you delete this website’s cookies in your browser, your saved choice is removed and the banner asks you again. Our cookie policy lists each cookie this website sets and how long it lasts. To see how Google uses information from websites that use its services, visit policies.google.com/technologies/partner-sites.

We do not use advertising or social media tracking. Our fonts, images and videos are hosted on our own website, so viewing a page does not send your details to font or video services.

8. Your rights

You can ask us to:

• Give you a summary of the personal data we hold about you, how we use it and who we have shared it with.
• Correct, complete or update it.
• Delete it, unless the law requires us to keep it.
• Stop using it where we rely on your consent. You can withdraw consent at any time: for the newsletter, by emailing us; for analytics cookies, by changing your choice as explained in section 7.
• Deal with a grievance about how we have handled your data.

You can also nominate someone to use these rights for you if you die or become unable to act for yourself.

These rights reflect the DPDP Act. We offer them to everyone, wherever they are.

How to make a request

Email [email protected] with ‘Data protection’ in the subject line. Please write from the email address you used with us, or tell us the phone number you used, so that we can find your data. We may ask you to confirm who you are before we act on a request. We will respond within one month.

9. If you are in the UAE

The UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) may also apply to personal data of people in the UAE. For the newsletter and analytics cookies, we rely on your consent. For enquiries and job applications, we rely on your consent or on the need to take steps you have asked for before entering into a contract with you.

Your data is transferred to India, and to wherever our service providers store it, so that we can deal with your enquiry, application or newsletter sign-up and, if you accept analytics cookies, measure how our website is used. We make these transfers with your consent or because they are needed for the steps you asked us to take.

As well as the rights in section 8, you can ask us to restrict or stop using your data, and to give you the data you provided in a commonly used electronic format.

10. Children

This website and our services are for businesses and professionals, not for children. If you are under 18, please do not send us your personal data. If we learn that we have received personal data from someone under 18, we will delete it.

11. Changes to this policy

We will update this policy when our practices or the law change. The date at the top of this page shows when it was last updated. If a change significantly affects how we use data you have already given us, we will tell you directly where we can.

Version 1, 12 October 2026.

12. Contact and complaints

For questions about this policy, to exercise your rights or to raise a grievance, contact us:

• Email: [email protected], with ‘Data protection’ in the subject line
• Phone or WhatsApp: +91 81291 68649
• Bangalore office: A R Splendor Park, Agara Horamavu, Bangalore North, Karnataka
• Kerala office: KV Narayanan Nair Memorial, Anamangad, Perintalmanna, Malappuram, Kerala

Please raise any grievance with us first, as the DPDP Act requires. If you are not satisfied with our response, you can then complain to the Data Protection Board of India, where the Act gives you the right to do so. If you are in the UAE, you can complain to the relevant UAE data protection authority.