Legal
Privacy Policy
Effective date: [date]
Ojas Design Ltd (“ojas.design”, “we”, “us”, “our”) is a company registered in England and Wales, registered office at 124 City Road, London EC1V 2NX, United Kingdom.
This policy explains how we collect, use, and protect personal data when you visit ojas.design, complete the Legitimacy Read, register for the Reading Room, or book a consultation with us. Because we work with clients internationally, this policy is written to UK GDPR standards and reflects the equivalent standards of the EU GDPR for personal data belonging to individuals in the EU.
This policy covers ojas.design only. ojas.foundry, our separate venture-building platform at ojasfoundry.com, operates under its own terms and privacy policy, available on that site, because it collects different categories of data, including venture and financial information, under a different access model.
1. What we collect
- Contact details you provide directly: name, email address, phone number, organisation, and role, when you register, complete the Legitimacy Read, or book time with us via Calendly.
- Legitimacy Read responses: your answers to the six diagnostic questions and the resulting gap classification, stored against your account once you verify your email.
- Communications: anything sent via email, the contact form, or the preparation field in our booking form.
- Technical data: IP address, browser type, device information, and pages visited, collected automatically.
- Cookies: see Section 6.
We do not knowingly collect financial, health, or other special category data through ojas.design itself. If an engagement later involves sharing sensitive business, financial, or governmental information, that happens through a separate, agreed channel as part of the engagement, not through this website.
2. Why we collect it, and our legal basis
- To provide the Legitimacy Read and send your results: consent, and legitimate interest in operating the service requested.
- To manage your registered account and Reading Room access: contract / legitimate interest.
- To respond to enquiries and manage bookings: legitimate interest, and performance of a contract where a booking leads to one.
- To send updates if you’ve joined the register: consent, withdrawable at any time.
- To meet legal and regulatory obligations, including UK tax and company law requirements.
3. Who we share it with
We use a small number of processors to run this site and do not sell personal data.
- Supabase, for account authentication and storing registration and diagnostic data.
- Calendly, for scheduling calls, subject also to Calendly’s own privacy policy.
- Lovable, our website hosting and development platform.
Where these processors store or process data outside the UK, we rely on Standard Contractual Clauses or an equivalent recognised safeguard.
4. International clients and data transfers
Because we work with organisations internationally, personal data we collect may be transferred to and processed in countries outside the UK and European Economic Area, including the United States, where several of our service providers are based. Where this happens, we put appropriate safeguards in place, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, so data is protected to UK GDPR standards regardless of where it is processed.
5. How long we keep it
- Waitlist and registered account data: for as long as the account is active, and a reasonable period after if inactive, before deletion.
- Legitimacy Read responses: linked to the account for as long as it exists.
- Booking and enquiry data: as long as necessary to manage the relationship and meet accounting and legal obligations, typically no more than seven years for anything connected to a contracted engagement.
6. Cookies
We use essential cookies to keep you signed in and remember session state. If analytics or marketing cookies are added in future, this policy will be updated and, where required, consent requested first.
7. Your rights
Wherever you’re based, you can ask us to: confirm what personal data we hold and provide a copy; correct inaccurate data; delete your data, subject to legal retention obligations; restrict or object to certain processing; receive your data in a portable format; withdraw consent at any time.
If you’re in the UK or EU, you also have the right to complain to your local data protection authority, in the UK, the Information Commissioner’s Office (ico.org.uk).
To exercise any of these rights: hello@ojas.design.
8. Children
Our services are intended for business use by adults. We don’t knowingly collect personal data from anyone under 18.
9. Changes to this policy
We may update this policy as our services evolve. Revisions are posted here with an updated effective date; material changes will be made clear on the site.
10. Contact us
Ojas Design Ltd, 124 City Road, London EC1V 2NX, United Kingdom