Privacy notice
Version 2026-08-16 · in force from 16 August 2026 · Anvesan, India
1.The controller
1.1
The controller of the personal data described in this notice is Anvesan, a research company registered in India (Anvesan, we, us). Anvesan is a controller within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the GDPR) and a Data Fiduciary within the meaning of section 2 of the Digital Personal Data Protection Act 2023 of India (the DPDP Act).
1.2
In this notice, the Atlas means the company dataset published at anvesan.org/atlas; an account means a registered Atlas account; you means the individual to whom the personal data relates, being a data subject for the purposes of the GDPR and a Data Principal for the purposes of the DPDP Act; and a reference to a clause is a reference to a clause of this notice.
1.3
All correspondence under this notice is to be addressed to research@anvesan.org.
1.4
No data protection officer has been appointed.
2.Scope and applicable law
2.1
This notice applies to personal data processed by Anvesan in connection with the Atlas and with accounts, and to no other processing.
2.2
This notice is drafted to the standard of the GDPR. Where the GDPR and the DPDP Act impose different obligations in respect of the same processing, the stricter is applied.
2.3
Nothing in this notice restricts any right conferred on you by either enactment.
3.Use of the Atlas without an account
3.1
The Atlas may be read without an account. No personal data is required in order to do so and none is requested.
3.2
One cookie is set, named
av_meter. It records the identifiers of the company records already opened by the browser, so that a record opened a second time is not counted a second time against the metering limit. It contains company identifiers only, contains no identifier of the reader, and expires 30 days after it is set.3.3
That cookie is strictly necessary for the provision of the metered service explicitly requested by the reader. Consent is accordingly not sought for it, by operation of the exemption in Article 5(3) of Directive 2002/58/EC.
3.4
No other cookie or comparable technology is set on the Atlas.
4.Personal data processed on the opening of an account
4.1
On the opening of an account, and in the course of its operation, Anvesan processes the following categories of personal data.
| Category | Content | Source |
|---|---|---|
| (a) Email address | The work email address given on signup. It identifies the account and is the address to which sign-in email is sent. | Given by you |
| (b) Name | Your full name. | Given by you |
| (c) Job title | Optional. | Given by you |
| (d) Company | The organisation associated with the domain of the address at (a), shown to you so that it may be corrected. | Derived from (a), or given by you |
| (e) Account timestamps | The times at which the account was opened, the address verified, and the record last modified. | Generated |
| (f) Rate limit counters | The number of company records requested in the current hour and in the current day. Counts alone. | Generated |
| (g) Consent records | For each consent decision: its subject matter, whether it was given or refused, the time, the version of this notice then in force, the interface through which it was made, a one-way hash of the originating IP address, and the browser user agent string. | Generated |
4.2
The data at clause 4.1(a), (b) and (d) is required in order to open and hold an account. Without it no account can be opened. The data at clause 4.1(c) is optional and may be left blank.
4.3
Anvesan does not operate advertising trackers, does not disclose personal data for consideration, and does not record which company records a reader has requested.
4.4
The Atlas is not directed to children, and Anvesan does not knowingly process the personal data of a person under the age of 18.
5.Purposes and lawful basis
5.1
Personal data is processed for the following purposes and on the following lawful bases.
| Purpose | Data | Lawful basis |
|---|---|---|
| Opening, operating and authenticating an account | 4.1(a) to (e) | Article 6(1)(b) GDPR: necessary for the performance of a contract to which you are party. |
| Sending verification and sign-in email | 4.1(a) and (b) | Article 6(1)(b) GDPR. |
| Applying the rate limits | 4.1(f) | Article 6(1)(f) GDPR: legitimate interests, stated at clause 5.2. |
| Sending marketing email | 4.1(a) and (b) | Article 6(1)(a) GDPR: consent. |
| Demonstrating that a consent was given or refused | 4.1(g) | Article 6(1)(c) GDPR, read with the obligation in Article 7(1) to be able to demonstrate consent. |
5.2
The legitimate interests pursued under Article 6(1)(f) GDPR are the protection of the Atlas against bulk extraction and the operation of the access control for which accounts exist.
5.3
The DPDP Act contains no general legitimate interests ground. Processing described at clause 5.1 as being carried out under Article 6(1)(f) GDPR is carried out, for the purposes of the DPDP Act, on the consent given on the opening of the account under section 6 of that Act.
6.Marketing communications
6.1
Marketing email is sent only to a person who has consented to receive it. That consent is not a condition of opening or holding an account.
6.2
The consent is requested separately, and is not bundled with any other consent or with acceptance of any other term, as required by Article 7(2) and 7(4) GDPR.
6.3
Consent may be withdrawn at any time under Article 7(3) GDPR and section 6 of the DPDP Act, by the marketing control on the account page or by the unsubscribe link carried by every marketing email. Withdrawal does not affect the lawfulness of processing carried out before it.
6.4
Verification and sign-in email is not marketing. It is sent under Article 6(1)(b) GDPR whether or not a consent under clause 6.1 subsists.
7.Recipients
7.1
Personal data is disclosed to the processors set out below. Each processes it only on documented instructions from Anvesan and under a contract containing the terms required by Article 28(3) GDPR.
| Processor | Function | Place of processing |
|---|---|---|
| Vercel Inc. | Hosting and content delivery. | United States, with edge regions in the European Union |
| Supabase Inc. | Database and authentication. | The region selected on creation of the project |
| Resend | Email delivery. | United States |
7.2
Personal data is disclosed to no other person, save where disclosure is required by law or is necessary for the establishment, exercise or defence of a legal claim. None is disclosed for consideration.
7.3
A processor set out at clause 7.1 may engage a sub-processor, subject to the equivalent obligations required by the contract referred to in that clause.
8.Transfers outside the EEA and outside India
8.1
The processing described at clause 7.1 takes place outside the European Economic Area and outside India.
8.2
Transfers outside the EEA are made under the standard contractual clauses adopted by the European Commission under Article 46(2)(c) GDPR, as incorporated in the data processing agreement of the processor concerned. A copy of the clauses relied on is available on request to the address at clause 1.3.
8.3
Transfers outside India are made in accordance with section 16 of the DPDP Act.
9.Retention
9.1
Personal data is retained for the periods set out below, and is erased or anonymised on their expiry.
| Category | Period |
|---|---|
| The account record | Until erasure under clause 10. |
| The rate limit counters | Deleted with the account record. |
| Backups containing the account record | 30 days from the date of the backup. |
| The record that erasure was requested | Indefinitely, as a one-way hash of the email address with the date of the request. The address is not retained. |
| Consent records | Indefinitely, with the identifying fields removed on erasure under clause 10. |
| Aggregate counts, such as accounts opened in a month | Indefinitely. Not personal data once the identifying fields are removed. |
10.Erasure
10.1
Erasure may be requested at any time from the account page, and is given effect within the period at clause 11.4.
10.2
On erasure, the email address, name, job title, company and every other identifying field are removed from the account record. The consent records are retained with the email address and the link to the account record removed, leaving a one-way hash of the address, and a record that erasure was requested is retained with the date of the request.
10.3
That hash cannot be reversed to produce the email address and identifies no person on its own.
10.4
The retention at clause 10.2 is necessary in order to comply with the obligation in Article 7(1) GDPR to be able to demonstrate that consent was given, and for the establishment, exercise and defence of legal claims within the meaning of Article 17(3)(e) GDPR. It also prevents an erased address from being returned to a mailing list by a later import.
10.5
Backups are retained for 30 days from the date of the backup, and an erasure takes effect in them on their expiry.
11.Your rights
11.1
You have the following rights in respect of the personal data described in this notice.
- Access. Article 15 GDPR and section 11 of the DPDP Act.
- Rectification. Article 16 GDPR and section 12 of the DPDP Act.
- Erasure. Article 17 GDPR and section 12 of the DPDP Act, exercised as set out at clause 10.
- Portability. Article 20 GDPR.
- Restriction. Article 18 GDPR.
- Objection. Article 21 GDPR, on grounds relating to your particular situation, in respect of processing carried out under Article 6(1)(f).
- Withdrawal of consent. Article 7(3) GDPR and section 6 of the DPDP Act, exercised as set out at clause 6.3.
- Complaint. Article 77 GDPR and section 13 of the DPDP Act, exercised as set out at clause 14.
11.2
A right may be exercised on the account page where the account page provides for it, and otherwise by writing to the address at clause 1.3.
11.3
Information and action under this clause are provided free of charge. Article 12(5) GDPR permits a reasonable fee to be charged, or the request to be refused, where a request is manifestly unfounded or excessive, in particular because of its repetitive character.
11.4
A request is answered within one month of receipt, as required by Article 12(3) GDPR. That period may be extended by up to two further months where necessary, taking into account the complexity and number of the requests, in which case you will be informed of the extension and of the reasons for it within the first month.
12.Automated decision-making
12.1
The metering described at clause 3 and the rate limits described at clause 5 operate automatically, and determine how many company records may be requested within a given period.
12.2
That processing produces no legal effect concerning you and does not similarly significantly affect you. No decision within the meaning of Article 22(1) GDPR is taken, and no profiling is carried out.
13.Security
13.1
Anvesan maintains appropriate technical and organisational measures under Article 32 GDPR, and takes reasonable security safeguards under section 8(5) of the DPDP Act.
13.2
In the event of a personal data breach, Anvesan will notify the competent supervisory authority under Article 33 GDPR and the Data Protection Board of India under section 8(6) of the DPDP Act, and will notify you where the breach is likely to result in a high risk to your rights and freedoms.
14.Complaints
14.1
If you are in the European Union or the European Economic Area, you may lodge a complaint with the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement, under Article 77 GDPR.
14.2
If you are in the United Kingdom, you may complain to the Information Commissioner.
14.3
If you are in India, a grievance is to be addressed in the first instance to the address at clause 1.3. Section 13 of the DPDP Act requires that opportunity to be exhausted before the Data Protection Board of India is approached.
15.Amendment of this notice
15.1
This notice is version 2026-08-16, in force from 16 August 2026.
15.2
Each consent record stores the version of this notice in force at the time the consent was given. An amendment to this notice does not operate retrospectively.
15.3
Account holders are notified by email of a material amendment.