Legal

Privacy policy

This policy describes how Hexovance Transformation Pvt Ltd (“HEXOVANCE”, “we”) handles personal data, in line with India’s Digital Personal Data Protection Act, 2023.

What personal data we collect

We collect only what is needed to respond to you and, where you ask, to work with you. In practice this falls into three categories:

Information you give us. When you use the contact form or email us: your name (or company name), email address, phone or WhatsApp number, and the content of your message. When you choose to join the HexAssess founding cohort or send us your result: your company name, work email, optional phone number, and your HexAssess scores (your six dimension ratings, overall score, and maturity band) together with the date of assessment.

Information collected automatically. Like most websites, our hosting provider records standard technical data such as your IP address, browser type, and the pages you view, for security and to keep the site running. Cookies and similar technologies are described in our Cookie Policy.

Tools that run in your browser. The HexAssess diagnostic and the Cost of Chaos calculator compute entirely on your device. Your answers are not sent to us automatically - they reach us only if you deliberately submit the founding-cohort form or email us your result. If you do not take one of those actions, we never see your inputs.

Why we collect it and our lawful basis

We use your personal data to reply to your enquiry, to discuss a potential engagement where you ask us to, and - for founding-cohort participants - to prepare and send you your benchmarked position in our India Mid-Market Operating Maturity Report. We also use aggregated, de-identified assessment data (with no company or contact details attached) to produce that report's industry benchmarks.

Under India's DPDP Act we process your data on the basis of your consent and for the legitimate purposes for which you provided it. Where the UK or EU GDPR applies, our lawful bases are your consent (which you give when you submit a form) and our legitimate interest in responding to a business approach you initiated. We do not sell personal data, run advertising, or profile you.

Who we share it with

We share personal data only with the service providers that operate this website and process our forms, and only so they can perform those functions for us:

• our website hosting and content-delivery provider, which serves the site and keeps security logs; and
• Google LLC (Google Workspace, Apps Script, and Google Sheets), which receives contact and founding-cohort form submissions, stores them in our account, and sends us email notifications.

These providers act as our processors under contract and are not permitted to use your data for their own purposes. We do not otherwise disclose your data, except where we are legally required to.

How long we keep it

Enquiry details are retained while the conversation is live and for up to 24 months afterwards, unless you ask us to delete them sooner. Founding-cohort submissions are kept for as long as needed to prepare and deliver your benchmarked position and to compile the report, and for up to 24 months after, after which contact details are deleted or the record is anonymised. Aggregated, de-identified benchmark statistics may be retained indefinitely, as they no longer identify you.

How we protect your data

Personal data is held in access-controlled Google Workspace accounts and is transmitted over encrypted (HTTPS) connections. We limit access to those who need it to respond to you, and we review our security measures periodically. No method of transmission or storage is perfectly secure, but we take reasonable technical and organisational measures appropriate to the sensitivity of the data.

Children's data

This is a business website not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

Automated decision-making

HexAssess produces an indicative maturity score to help you think about your operation; it is not an automated decision that produces a legal or similarly significant effect. Any engagement decision involves human judgement. We do not carry out automated profiling of individuals.

Your rights

You may request access to, correction of, or deletion of your personal data at any time by writing to info@hexovance.com. We will respond within the timelines the DPDP Act prescribes.

Who is responsible for your data

Hexovance Transformation Pvt Ltd, registered in India, is the data fiduciary under the DPDP Act and the data controller for the purposes of the UK and EU General Data Protection Regulation. Our registered office is Gurugram, Haryana, India 122505, and enquiries may be sent to info@hexovance.com.

Visitors from the EU, UK, and other jurisdictions

Where the GDPR or a comparable law applies to you, we process your data on the lawful basis of your consent (when you submit an enquiry) or our legitimate interest in responding to a business approach you initiated. You may withdraw consent at any time, and you additionally have the rights of access, rectification, erasure, restriction, objection, and data portability.

Because we operate from India, personal data you send us is processed in India, which the European Commission has not designated as providing an adequate level of protection. Where we transfer personal data internationally we rely on appropriate safeguards, including standard contractual clauses with our service providers, and we transfer only the minimum data needed to respond to you.

If you believe we have handled your data improperly, we would prefer you tell us first so we can put it right. You also have the right to complain to your local supervisory authority - for example the Information Commissioner’s Office in the United Kingdom, your national data protection authority in the EU, or the Data Protection Board of India.

Grievance officer

If you have a concern about how your personal data is handled, you may contact our Grievance Officer, appointed under the DPDP Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011:

Grievance Officer
grievance@hexovance.com

We will acknowledge and address grievances within the timelines prescribed under applicable law.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The current version is always published here, with the revision date shown below. Material changes will be highlighted on this page.

Last updated: July 2026.