1. Introduction and Scope
This Privacy Policy describes how Base14 Innovation Private Limited (CIN: U62013KA2025PTC200923), a private limited company incorporated under the laws of India with its registered office at WeWork Vaishnavi Signature, No. 78/9, Outer Ring Road, Bellandur Village, Varthur Hobli, Bengaluru - 560103, Karnataka, India (“Base14”, “we”, or “us”), processes Personal Data of visitors to the public website at base14.io and its public informational subdomains (the “Website”), of prospects, customer business contacts, and marketing recipients, and of job applicants.
For this Personal Data, we act as a Controller (a Data Fiduciary under the Digital Personal Data Protection Act, 2023, or the equivalent role under other Applicable Data Protection Laws).
This Policy does not cover Base14’s products and services (the “Services”). Personal Data that customers transmit to or generate through the Services is processed by Base14 as a Processor on the customer’s behalf, under the written agreement and data processing terms executed with that customer. If you are an end user of a Base14 customer, direct any request about your Personal Data to that customer.
2. Definitions
In this Policy:
- “Applicable Data Protection Laws” means all laws, regulations, codes of practice, and binding regulator guidance applicable to the Processing of Personal Data, including those listed in Section 3.
- “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing”, and “Supervisory Authority” have the meanings given in the GDPR or, where context indicates, the functional equivalents under other Applicable Data Protection Laws. “Data Principal” has the meaning given in the DPDP Act.
3. Applicable Data Protection Laws
This Policy is written to comply with the Digital Personal Data Protection Act, 2023 and Rules, 2025 (“DPDP Act”) and the Information Technology Act, 2000 in India; Regulation (EU) 2016/679 (“GDPR”) in the EEA; the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection (“FADP”); and other data protection laws where they apply to you.
4. Personal Data We Process
Category A - Website Visitors
- Personal Data: IP address, browser type and version, operating system and device type, pages visited, referring URLs, session identifiers, language preferences, cookie data.
- Source: collected automatically when you visit the Website.
- Retention: fourteen (14) months from the date of collection.
Category B - Prospects, Customer Business Contacts, Marketing Recipients, and Form Submitters
- Personal Data: name, business email address, company name, role or title, the content of messages or form submissions, communications metadata.
- Source: contact forms, demo requests, content downloads, newsletter sign-ups, event registrations, business cards exchanged at events, contract, billing, and support correspondence with customer personnel, and lawful third-party sources where permitted (such as professional networking platforms, business-data providers, and Website visitor identification). Where we obtain your Personal Data from a third-party source, we provide this notice at or before our first communication with you.
- Retention: until you opt out, request deletion, or twenty-four (24) months of inactivity (whichever is earliest). Business contact details recorded in contracts and invoices are kept for the period required by tax and company law.
Category C - Job Applicants
- Personal Data: CV, cover letter, references, interview notes, work-eligibility documentation.
- Source: submitted by you when you apply for a role at Base14.
- Retention: twelve (12) months following the conclusion of the recruitment process, unless you consent to retention for future opportunities.
Special Categories of Personal Data
We do not intentionally collect Special Categories of Personal Data (such as racial or ethnic origin, religious beliefs, health data, or biometric identifiers) through the Website. Do not submit such data through contact forms or by email.
5. Purposes of Processing and Legal Bases
We process Personal Data for the purposes described below. Where the GDPR, UK GDPR, or FADP applies, we identify the legal basis. Where the DPDP Act applies, Processing relies either on consent or on legitimate uses recognized under Section 7 of the DPDP Act, as indicated.
| Purpose | Categories | GDPR Legal Basis | DPDP Basis |
|---|---|---|---|
| Operating the Website and providing requested information | A | Legitimate interests (Article 6(1)(f)) | Legitimate use |
| Responding to inquiries and form submissions | B | Performance of pre-contractual measures (Article 6(1)(b)); Legitimate interests (Article 6(1)(f)) | Consent / Legitimate use |
| Marketing communications, newsletters, and event invitations | B | Legitimate interests (Article 6(1)(f)) for business-to-business direct marketing, with an opt-out in every message; Consent (Article 6(1)(a)) where required by local law | Consent |
| Contract administration, invoicing, and support correspondence with customer personnel | B | Contract (Article 6(1)(b)); Legal obligation (Article 6(1)(c)) for tax and company records | Legitimate use |
| Analytics, fraud prevention, and security of the Website | A | Legitimate interests (Article 6(1)(f)) | Legitimate use |
| Compliance with legal and regulatory obligations | All | Legal obligation (Article 6(1)(c)) | Legitimate use |
| Recruitment and hiring | C | Pre-contractual measures (Article 6(1)(b)); Legitimate interests (Article 6(1)(f)) | Consent / Legitimate use |
Where we rely on consent (for example, for marketing communications), you may withdraw consent at any time without affecting the lawfulness of Processing prior to withdrawal.
We do not make decisions producing legal or similarly significant effects about individuals solely by automated means.
7. International Data Transfers
Base14 is established in India. Personal Data collected through the Website is processed in India and by the service providers listed in Section 6 in the locations shown there.
If you are in the EEA, the United Kingdom, or Switzerland, your Personal Data is processed in India, which has no adequacy decision. Onward transfers to the service providers in Section 6 are covered by the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum, read to include the FADP for Switzerland. Copies are available on request to legal@base14.io.
Transfers from India comply with the DPDP Act, 2023 and any cross-border restrictions notified by the Central Government.
8. Data Retention
Retention periods are set out in Section 4. When they expire, we delete or irreversibly anonymize the Personal Data, unless law requires longer retention (for example, tax records or legal hold), in which case it is access-restricted and deleted when the requirement ends.
9. Security
We implement and maintain appropriate technical and organizational security measures designed to protect Personal Data against unauthorized access, use, alteration, disclosure, loss, or destruction. These measures include encryption of Personal Data in transit and at rest, role-based access controls with multi-factor authentication, logged access to systems holding Personal Data, independent penetration testing at least annually, and documented incident response.
Base14 maintains SOC 2 Type II and ISO 27001:2022 certifications. Our security overview is published at base14.io/security.
10. Breach Notification
If a Personal Data Breach affects Personal Data we hold as Controller, we notify the competent authorities and, where required, affected individuals within the timelines of Applicable Data Protection Laws: seventy-two (72) hours to the lead Supervisory Authority under GDPR Article 33; the Data Protection Board of India and affected Data Principals under Rule 7 of the DPDP Rules, 2025; and CERT-In within six (6) hours where the CERT-In Directions apply.
Report security concerns to legal@base14.io.
12. Your Rights
Subject to the applicable law in your jurisdiction, you may have the following rights with respect to Personal Data we process about you:
| Right | GDPR / UK GDPR / FADP | DPDP Act | Other laws |
|---|---|---|---|
| Access | Article 15 | Section 11 | Yes |
| Correction | Article 16 | Section 12 | Yes |
| Erasure | Article 17 | Section 12 | Yes |
| Restriction of Processing | Article 18 | - | Limited |
| Portability | Article 20 | - | Yes |
| Object to Processing | Article 21 | - | Yes |
| Withdraw consent | Article 7(3) | Section 6(4) | Yes |
| Complain to a regulator | Article 77 | Section 13 (grievance to Base14), then the Data Protection Board | Yes |
To exercise these rights, contact legal@base14.io. We may verify your identity first. We respond within thirty (30) days, extendable for complex requests where the law allows, with notice of the reason.
If your Personal Data was submitted to Base14 by one of our customers through their use of the Services, please direct your request to that customer; we will assist the customer in responding as required by our agreement with them.
You may act through an authorized agent, subject to verification.
13. Children's Data
The Website is intended for use in business and professional contexts. We do not knowingly collect Personal Data from children under sixteen (16) years of age (or under the age specified by Applicable Data Protection Laws in your jurisdiction, including under eighteen (18) where required by the DPDP Act). If you believe we have inadvertently collected Personal Data from a child, please contact legal@base14.io and we will delete the Personal Data promptly.
14. Changes to This Policy
We may update this Policy from time to time. Material changes will take effect at least thirty (30) days after posting on this page with a revised “Last Updated” date and, where reasonable, by other means of notice. Non-material changes (such as corrections of typographical errors or updates to contact details) take effect on posting.
15. Contact and Grievance Officer
Base14 has not appointed a Data Protection Officer. The Founder and Director of Base14 is the Privacy Contact and the Grievance Officer under the DPDP Act.
All privacy requests, grievances, security reports, and legal notices go to:
- Email: legal@base14.io
- Postal: WeWork Vaishnavi Signature, No. 78/9, Outer Ring Road, Bellandur Village, Varthur Hobli, Bengaluru - 560103, Karnataka, India.
If you are not satisfied with our response, you may complain to the data protection authority in your jurisdiction (for example, the Data Protection Board of India or the UK Information Commissioner’s Office).
This Policy supersedes the Privacy Policy previously published at base14.io/privacy.