Diagonal — Insights & Strategy← Back to site

Legal

Privacy Policy

Last updated: 7 August 2026

Diagonal Insights & Strategy (“Diagonal”, “we”, “us” or “our”) is a consumer research and strategy consultancy based in India. We spend our working lives understanding people — so we take how we handle your personal data seriously. This policy explains what we collect through www.diagonalinsights.com (the “Website”), why we collect it, and the rights you have over it.

This policy is published in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. For visitors from the European Economic Area (EEA) or the United Kingdom, it also describes the rights available to you under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

/ 1. Who we are

For the purposes of the DPDP Act, Diagonal Insights & Strategy is the “Data Fiduciary” — and for the purposes of the GDPR, the “Data Controller” — of personal data collected through the Website. You can reach us about anything in this policy at vanaja.iyer@diagonalinsights.com.

/ 2. What we collect

Information you give us

When you submit the contact form on the Website, or write to us by email, phone or WhatsApp, we collect what you choose to share:

  • your name and email address;
  • your phone number, if you provide it;
  • your company or organisation, if you provide it;
  • the contents of your message — including any business context you describe to us.

Information collected automatically

Like most websites, our hosting infrastructure records standard server logs — IP address, browser type, pages requested and timestamps — for security and to keep the Website running.

Analytics and cookies

The Website uses Google Tag Manager and Google Analytics to understand how visitors use the site — which pages are viewed, roughly where visitors come from, and how they move through the site. These services set cookies and collect usage data, including your IP address and device and browser information, which is processed by Google. We use this data in aggregate, to improve the Website; we do not use it to identify you personally, and we do not use advertising or remarketing cookies.

You can block or delete cookies through your browser settings, or opt out of Google Analytics with the Google Analytics opt-out browser add-on. The Website remains fully usable without cookies.

The Website also loads fonts from Google Fonts. When your browser requests those fonts, your IP address is transmitted to Google. Google’s handling of data across these services is described in Google’s privacy policy.

/ 3. Why we collect it

We use the personal data described above to:

  • respond to your enquiry and correspond with you about it;
  • scope, propose and deliver research and strategy services you ask us about;
  • maintain the security and integrity of the Website;
  • comply with legal obligations that apply to us in India.

Under the DPDP Act, we process your data on the basis of the consent you give when you submit the form, and for certain legitimate uses recognised by the Act (such as when you voluntarily provide your data to us for a specified purpose). Under the GDPR, our legal bases are your consent, our legitimate interest in responding to business enquiries, and — where we go on to work together — the performance of a contract.

We do not sell your personal data. We do not use it for advertising. We do not add you to a mailing list because you enquired.

/ 4. Who we share it with

We share personal data only with the service providers who make the Website work, and only to the extent needed:

  • Email delivery — contact-form submissions are delivered to us via Resend, a transactional email service, which processes the form contents in order to send the email;
  • Website hosting — our hosting provider processes server logs as described above;
  • Analytics — Google processes usage data collected via Google Tag Manager and Google Analytics, as described in section 2;
  • Professional advisers or authorities — if, and only to the extent, the law requires it.

If you contact us on WhatsApp or LinkedIn, your use of those platforms is governed by their own privacy policies.

/ 5. International transfers

We are based in India. Our service providers (such as email delivery and hosting) may store or process data on servers located outside India, including in the United States or the European Union. Where data of EEA or UK visitors is transferred outside those regions, we rely on our providers’ safeguards, such as standard contractual clauses. By using the Website from outside India, you understand that your data will be processed in India and in the countries where our providers operate.

/ 6. How long we keep it

We keep enquiry correspondence for as long as needed to deal with your enquiry and for a reasonable period afterwards, in case the conversation resumes. If we enter into an engagement, we retain records for the duration of the engagement and as long as required by Indian law (for example, tax and accounting requirements). When personal data is no longer needed for the purpose it was collected, we delete it.

/ 7. Your rights

If you are in India (DPDP Act, 2023)

As a Data Principal, you have the right to:

  • access a summary of the personal data we hold about you;
  • have inaccurate or incomplete data corrected or updated;
  • have your data erased when it is no longer needed for the purpose it was collected;
  • withdraw consent you have previously given, at any time;
  • nominate another individual to exercise these rights on your behalf in the event of death or incapacity;
  • a readily available means of grievance redressal — and, if you are not satisfied with our response, to complain to the Data Protection Board of India.

If you are in the EEA or the United Kingdom (GDPR / UK GDPR)

You have the right to:

  • access the personal data we hold about you;
  • rectify inaccurate data and erase data we no longer need;
  • restrict or object to our processing;
  • receive your data in a portable format where processing is based on consent or contract;
  • withdraw consent at any time, without affecting prior processing;
  • lodge a complaint with your local supervisory authority (or the UK Information Commissioner’s Office).

Visitors from other jurisdictions may have similar rights under their local law; we will honour any such request to the extent the law provides. To exercise any of these rights, email vanaja.iyer@diagonalinsights.com — we respond to rights requests within the timelines the applicable law prescribes.

/ 8. Security

We use reasonable security practices and procedures, as required by the IT Act and its rules, appropriate to the nature of the data we handle — including transport encryption (HTTPS) on the Website, access limited to those who need it, and reputable providers for email and hosting. No transmission over the internet is entirely secure, but we work to protect your data against unauthorised access, alteration and disclosure.

/ 9. Children

The Website is intended for business audiences and not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, contact us and we will delete it.

/ 10. Grievance officer & contact

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, questions, concerns and grievances about this policy or your personal data may be addressed to:

Vanaja Iyer, Founder
Diagonal Insights & Strategy
Email: vanaja.iyer@diagonalinsights.com
Phone: +91 92232 76215

/ 11. Changes to this policy

We may update this policy from time to time — for example, if the law changes or we change how the Website works. The “Last updated” date at the top reflects the current version, and material changes will be posted on this page.