KairoPact Private Limited
Privacy Policy
How we collect, use, store, and protect your personal data.
1. Who We Are
KairoPact Private Limited ("KairoPact", "we", "us", "our") is a bionic execution infrastructure company, human-led and AI-supported, registered in India, providing technology services to non-governmental organisations (NGOs), development sector entities, and corporate social responsibility (CSR) teams.
Registered address: KairoPact Private Limited, India
Data Fiduciary & Grievance Officer: Abhilash (Founder, CEO & Grievance Officer), abhilash@kairopact.com
Note: Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), the entity that determines the purpose and means of processing personal data is referred to as the "Data Fiduciary".
2. Scope of This Policy
This policy applies to all personal data we collect through:
- Our website at kairopact.com and any subdomains
- Our product platform, Axon™
- Our consultant and partner onboarding processes (including the ImpactMatch network)
- Email communications and enquiry forms
It does not apply to third-party websites we may link to. We are not responsible for the privacy practices of those sites.
3. What Personal Data We Collect
3.1 Data you provide to us
When you contact us, register interest, or apply to join the ImpactMatch consultant network, we may collect:
- Name, email address, phone number, and location
- Professional profile information (experience, thematic areas, availability)
- Organisation affiliation and role
- Information submitted via contact or enquiry forms
Sensitive credentials (PAN, GST, bank details, identity documents) are not collected through this website. Where required for contractual purposes, these are requested separately over secure, direct channels.
3.2 Data collected automatically
When you visit our website, we may collect:
- IP address and approximate location
- Browser type, operating system, and device type
- Pages visited, time spent, and navigation patterns
- Referring URL
This data is collected through standard web analytics tools and is used in aggregate form. We do not currently use advertising trackers or sell this data.
3.3 Data processed through AI systems
KairoPact's products and services are AI-assisted. Where organisational data, project information, or other content is shared with us as part of a service engagement, it may be processed through AI pipelines as part of delivering that service. This includes our Axon™ grant intelligence platform, FieldPulse™ field reporting system, KairoQuant™ analytics tools, and bespoke AI-assisted delivery engagements.
The following principles apply to all AI processing at KairoPact:
- Client and organisational data is never used to train, fine-tune, or prompt-engineer AI models for any purpose other than the contracted engagement.
- Data shared with us is processed only to the extent required to deliver the agreed service.
- AI outputs in client-facing workflows are subject to mandatory human review before delivery. AI drafts; our practitioners approve.
- We use third-party AI model providers as part of our technology stack. We select providers whose published terms do not permit training on customer data. You may request a current list of AI model providers used in active engagements by contacting abhilash@kairopact.com.
For full details of how we govern AI in our products and services, including our six AI principles, incident response process, and your rights as a client, see our AI Policy at kairopact.com/ai-policy.
4. Why We Use Your Data
We use your personal data only for the following purposes, and only where we have a lawful basis under the DPDP Act, 2023:
| Purpose | Legal basis (DPDP Act, 2023) |
|---|---|
| Responding to your enquiries | Consent / certain legitimate uses under Section 7, DPDP Act |
| Evaluating consultant applications | Consent / pre-contractual steps |
| Providing our platform services | Processing necessary to provide requested services |
| Improving security and service functionality | Certain legitimate uses / legal obligations where applicable |
| Complying with law | Legal obligation |
5. How We Share Your Data
We do not sell your personal data. We share it only in the following limited circumstances:
- With technology service providers who process data on our behalf, subject to appropriate data processing agreements
- With NGO or CSR clients where your profile is relevant to a specific engagement, and only with your prior knowledge
- With legal or regulatory authorities if required by applicable law
Where we engage third-party data processors, we require them to maintain adequate security standards consistent with the DPDP Act and applicable Indian law.
6. Data Storage, Security, and Breach Notification
Personal data collected through our website and platform may be processed by trusted service providers in India and other jurisdictions where they operate, consistent with applicable law. We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or misuse, including:
- Access controls limiting who can view personal data internally
- Encryption in transit (HTTPS/TLS)
- Regular review of third-party vendor security practices
In the event of a personal data breach, we will notify the Data Protection Board of India and affected individuals in accordance with the requirements of the DPDP Act.
No internet transmission is completely secure. While we take reasonable steps, we cannot guarantee absolute security.
7. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purpose it was collected, or as required by law. Specifically:
- Enquiry and contact data: up to 2 years from last contact
- Consultant profile data: for the duration of your engagement with ImpactMatch, plus 1 year
- Platform usage data: per our service agreement with the relevant client organisation
You may request deletion of your data at any time (see Section 9).
8. Your Rights Under the DPDP Act
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- Access information about the personal data we hold about you and how it is being processed
- Correct inaccurate or incomplete personal data
- Request erasure of personal data where the purpose for which it was collected is no longer being served, subject to any legal obligations that require us to retain it
- Withdraw consent at any time where consent is the basis for processing, without affecting the lawfulness of processing carried out before withdrawal
- Raise a grievance with us regarding our handling of your personal data
9. Consent and How You Give It
Where we rely on consent as our legal basis, we will ask for it clearly and separately before collecting your data, for example, through an unticked checkbox on our onboarding forms. You may withdraw consent at any time by contacting us at abhilash@kairopact.com. Withdrawal of consent does not affect the validity of processing carried out before the withdrawal.
10. Cookies and Tracking
Our website may use essential cookies necessary for basic functionality. We do not currently use advertising cookies or cross-site tracking. Where we use analytics tools, we configure them to minimise personal data collection.
- You can control cookie settings through your browser at any time.
11. Children's Data
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently done so, please contact us immediately at abhilash@kairopact.com and we will take prompt steps to delete the data.
12. Changes to This Policy
We may update this policy from time to time to reflect changes in our services, technology, or legal obligations. When we do, we will revise the version number and effective date at the top of this page. If changes are material, we will provide a more prominent notice. We encourage you to review this policy periodically.
13. Contact Us and Grievance Redressal
If you have questions, concerns, or complaints about how we handle your personal data, or wish to exercise any of your rights under the DPDP Act, please contact our designated Grievance Officer:
| Name | Abhilash |
| Designation | Founder, CEO & Grievance Officer, KairoPact Private Limited |
| abhilash@kairopact.com |
We take all data privacy concerns seriously. We will acknowledge your request promptly and respond within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India once it is operationally constituted under the DPDP Act.
KairoPact Private Limited · kairopact.com · Version 1.3, March 2026