What we hold, and why.

1. Who we are

Syntropy Earth is a climate-health advisory practice registered in India as a sole proprietorship. Abhijith Magal L is the proprietor and the person accountable for every decision described on this page. Under the Digital Personal Data Protection Act 2023 we are the Data Fiduciary for the personal data described here. For visitors in the United Kingdom or the European Economic Area, we act as the controller of that data.

2. What we collect

We do not run a login, a shop or an advertising network. Everything we hold arrives in one of four ways.

How it reaches us	What we receive
You complete the climate-access scorecard	Your name, work email address, organisation, role, and the country or region you operate in. Optionally a free-text note. Alongside it, your scorecard answers, the sector you selected, your resulting score and band, and, where you chose to tell us, your social responsibility spend range and the obligation driving your interest.
You email us or book a call	Your name, email address, whatever you choose to write, and the calendar details of any meeting you book.
You become a client, or we approach you about becoming one	Business contact details, the name and role of people we work with at your organisation, and the commercial and delivery records of the engagement. Where we approach you first, we hold your name, role, organisation and work email address, sourced from your organisation's public material, your public professional profile, or a business contact database.
You visit the website	Standard technical data collected by our host and by analytics: the pages you view, approximate location by country and city, referring source, browser and device type, and a randomly generated visitor identifier. See section 12.

We do not collect financial account details through this website. Client payments run through a regulated payment gateway or a direct bank transfer, and card details never reach us. We do not knowingly collect health data, biometric data, or any of the categories treated as sensitive under UK or EU law.

3. The climate-access scorecard

The scorecard at syntropyearth.com/climate-access is the one place on this site where we ask you for personal data, so it deserves its own section rather than a line in a table.

You can move through the entire assessment and see your questions without giving us anything. The gate sits before your scored result. At that gate we ask for your email address and organisation, which are required, and your name and role, which are not. You tick a box to confirm you have read this policy and agree to what follows. Nothing is sent until you do.

Once you submit, that record is held in a private, access-controlled system. We use it to give you your result, to understand which sectors and obligations the tool is reaching, and to follow up with you about your result and about how Syntropy Earth might help. If you would rather we did not follow up, say so in the note field or write to us afterwards, and we will hold the record without contacting you.

Your scorecard result is a directional self-assessment built on what you tell us. It is not an audit, not assurance, and not a substitute for professional advice. We may report on the anonymised, aggregated patterns across all respondents, in writing, research or client work. Anonymised means the published form carries no name, no email address, no organisation and nothing that could reasonably identify you or your employer.

4. Why we hold it

Under the Digital Personal Data Protection Act 2023 we process your data on the basis of the consent you give at the point of collection, or, in the case of an existing engagement, because it is necessary to perform the contract and to meet Indian tax, accounting and company law obligations. For visitors covered by UK or EU law, the equivalent bases are consent, performance of a contract, legal obligation, and our legitimate interest in contacting named professionals at organisations about advisory work relevant to their stated role.

The purposes, in plain terms:

• To answer you. If you enquire, book a call or complete the scorecard, we reply and we follow up.
• To deliver work we have been engaged to do, and to invoice for it.
• To improve the scorecard and the research behind it, using anonymised, aggregated patterns only.
• To meet statutory obligations, including GST and income tax record-keeping.

We do not sell personal data. We do not rent, trade or share it for anyone else's marketing. We do not use it to train a machine learning model, our own or anybody else's.

5. Consent, and how to withdraw it

Where we rely on your consent, you gave it by ticking the box at the scorecard gate or by writing to us directly. You can withdraw it at any time, for any reason, without giving one. Email legal@syntropyearth.com and we will stop processing and delete the record, unless a specific law requires us to keep it, in which case we will tell you which law and for how long.

Withdrawing consent does not undo processing that had already happened while the consent was live, and it does not affect records we must retain for tax or contractual reasons.

6. Who else sees it

Your enquiry is read by the Syntropy Earth team and by nobody else. Your data does pass through a small number of service providers who process it on our instructions, under written terms that bind them to protect it and forbid them using it for their own purposes. We keep that list deliberately short. By category:

Category of recipient	What it handles
Business productivity and email providers	Correspondence, scorecard submissions, meeting bookings and internal records
Website hosting and analytics providers	Serving the site, server logs and visit measurement
Electronic signature and payment providers	Signing and settling client agreements
Professional advisers	Statutory accounting, tax and legal obligations

If you need the specific providers named before you share anything with us, ask at legal@syntropyearth.com and we will tell you. We keep a current register and will share it on request.

Beyond these, we disclose personal data only where a court, regulator or law requires it, or where you have asked us to introduce you to someone. If we are ever legally compelled to hand over your data, we will tell you unless we are barred from doing so.

The newsletter, Entropy Unplugged, runs entirely on LinkedIn. Subscribing happens on LinkedIn, under LinkedIn's own privacy terms, and no email address changes hands with us.

7. Client engagements and agency partners

Some engagements carry a digital, campaign or creative component that a specialist agency delivers. Where that work would involve any personal data belonging to a client or to the people a client serves, we obtain the client's written consent naming the agency before any data moves, and the agency is bound by written confidentiality and data protection terms. No creative or digital partner touches personal data on our word alone. This is a standing term in our master engagement agreement, not a case-by-case judgement.

8. How long we keep it

• Scorecard submissions and enquiries that do not become engagements: twenty-four months from your last contact with us, then deleted.
• Outreach contact records: twenty-four months from the last touch, or immediately on request.
• Client engagement records, contracts and invoices: for as long as Indian tax and GST law requires us to retain books of account and supporting records, and no longer than that plus any period during which a claim could still be brought.
• Anonymised, aggregated scorecard patterns: indefinitely, because at that point they are no longer personal data.
• Website analytics: no longer than fourteen months.

9. How it is protected

The site is served over HTTPS. Records are held in access-controlled systems protected by multi-factor authentication, on encrypted devices, with access limited to those who need it. We do not publish the detail of those controls, for the same reason nobody publishes their alarm code. We also keep the collection surface deliberately small, because the data we never collect is the data that cannot leak.

No system is perfect. If a breach occurs that is likely to affect you, we will notify the Data Protection Board of India and every affected person in the manner and timeframe the Digital Personal Data Protection Act 2023 requires, and we will tell you what happened rather than what we would prefer you knew.

10. Where it is stored

Syntropy Earth operates from India and serves clients worldwide. Some of our service providers store and process data on servers outside India, including in the United States and the European Union. Where personal data covered by UK or EU law leaves that region, our providers rely on the European Commission's standard contractual clauses or an adequacy decision. If you would rather your data were not stored this way, do not submit it, and email us instead so we can discuss what you need.

11. Your rights

Under the Digital Personal Data Protection Act 2023, you have the right to ask us for a summary of the personal data we hold about you and how we process it, to have inaccurate or incomplete data corrected, to have data erased where we no longer need it or where you withdraw consent, to nominate another person to exercise these rights if you die or become incapacitated, and to a grievance process before you approach the Data Protection Board of India.

If UK or EU law applies to you, you also have rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your national supervisory authority.

Write to legal@syntropyearth.com. We will acknowledge within seven days and resolve within thirty. There is no charge. We may ask you to confirm your identity before we act, which protects you rather than us.

12. Cookies and analytics

This site uses Google Analytics 4, loaded through Google Tag Manager, to count visits and understand which pages are read. It sets first-party cookies that hold a randomly generated identifier, not your name or email address.

We record a small number of events: when someone opens the scorecard, clicks the newsletter link, or completes a scorecard submission. The submission event deliberately carries no personal data. It sends the sector, the score band and the obligation driver, and nothing that identifies you. That design choice was made so the analytics stay useful without holding anything personal.

We run no advertising cookies, no retargeting pixels and no social tracking scripts. You can block cookies in your browser settings, or use Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout. Nothing on this site stops working if you do.

Our hosting provider keeps standard server logs, including IP addresses, for security and diagnostics.

13. Children

This site and everything on it is built for working professionals. We do not knowingly collect personal data from anyone under eighteen, and we do not undertake tracking, behavioural monitoring or advertising directed at children. Where we deliver climate literacy sessions in a school or university, any personal data involved is handled by that institution under its own policy, not collected by us. If you believe a child has given us data, write to legal@syntropyearth.com and we will delete it.

14. Grievance contact

Because Syntropy Earth is a sole proprietorship, the grievance officer is the proprietor.

If we do not resolve your complaint to your satisfaction, you may take it to the Data Protection Board of India, or, where UK or EU law applies to you, to your national supervisory authority.

15. Changes to this policy

When this policy changes, the date at the top of the page changes with it. Where a change materially affects how we handle data you have already given us, we will email you before it takes effect and ask again if consent is needed. We do not make quiet edits and backdate them.