Privacy Policy

1. Introduction

TehriHills (“we,” “our,” or “us”) takes your privacy seriously. This policy explains how we collect, use, share, and protect personal information when you work with us. We’re a consulting firm, and our services cover business strategy, market research, expert recruitment, data analytics, information security, and data-compliance advisory.

We’ve written this policy to meet the data-protection laws that apply to the people we serve. That means the EU General Data Protection Regulation (GDPR) for individuals in the European Economic Area (EEA), the UK GDPR and Data Protection Act 2018 for individuals in the UK, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), for California residents, and the Health Insurance Portability and Accountability Act (HIPAA) where we handle Protected Health Information (PHI) under a Business Associate Agreement. As a company based in India, we also follow India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

2. Commitment to privacy

Privacy is a fundamental right. We protect the personal information of our clients, research participants, and partners, and we don’t collect more than we need.

Our commitment comes down to a few things:

• Strong encryption and access controls to keep out unauthorized access.
• Secure storage, with access limited to staff who need it.
• Clear information about how we use and delete your data.
• Your right to access, correct, or delete the data we hold about you.

We don’t sell personal data. We don’t share it with third parties except as described in this policy, and anything we share with clients or partners is covered by written confidentiality and data-protection terms.

TehriHills has implemented controls aligned to the HIPAA Privacy and Security Rules and supports HIPAA-compliant operations where required by client engagements. We act as a business associate, not a covered entity, and we sign a Business Associate Agreement before handling PHI.

3. Scope of this policy

This policy covers the personal data we process about:

• Clients and prospective clients — the people at the organizations that hire us.
• Research participants — who take part in our surveys, interviews, and focus groups.
• Experts — who give us their credentials for our recruitment and matching work.
• Website visitors — who use our website and digital platforms.

It doesn’t cover the personal data of our own employees and contractors. A separate internal notice handles that.

4. Information we collect

We collect the categories of personal data below, directly from you and, where it’s relevant, from the sources noted in the table.

We don’t set out to collect special-category data such as health, racial or ethnic origin, or religious beliefs. If a research project needs it, we’ll name a valid condition for processing under GDPR Article 9 / UK GDPR and get your explicit consent first. Where we handle PHI on behalf of a HIPAA covered-entity client, we do so only under a Business Associate Agreement.

5. Ethical standards in survey research

Survey research sits at the center of our consulting work, so we run it ethically: participation is voluntary, consent is informed, and responses stay confidential. Here’s what that looks like in practice.

5.1 Informed consent

Before anyone takes part, we tell them what the survey is for, how we’ll use their data, and what rights they have.

5.2 Voluntary participation

Taking part is a choice. Nobody is pushed into it, and participants can drop out at any time with no consequences.

5.3 Confidentiality and anonymity

We anonymize responses where we can, so individuals can’t be identified. Where that’s not possible, we pseudonymize the data and keep it confidential, using it only for the stated research. (Anonymized data sits outside data-protection law. Pseudonymized data is still personal data and stays protected under this policy.)

5.4 Data accuracy and integrity

We collect and analyze data carefully so the findings hold up. We don’t misrepresent or distort research results.

5.5 Compliance with industry standards

Our methods follow the ethical guidelines of recognized research bodies, including ESOMAR and the Insights Association.

6. Protecting research participants

We keep participants’ responses secure, and any identifiable information is stored with industry-standard protection. We review our practices regularly to keep up with new privacy laws and good practice in survey research.

7. Protection of information in a research context

When people join our research studies (surveys, focus groups, and interviews) we take careful steps to collect, process, and store their information securely. The main protections:

7.1 Voluntary participation and informed consent

Participants get the full picture before they share anything. Taking part is voluntary and can be withdrawn at any time.

7.2 Data confidentiality and anonymization

Wherever we can, we anonymize or pseudonymize participant data. Where anonymity isn’t workable, strict access controls keep it confidential.

7.3 Secure storage and restricted access

Research data lives on secure, encrypted systems that only authorized staff can reach, with role-based access to limit exposure.

7.4 Compliance with ethical research standards

Our methods follow industry guidelines such as ESOMAR and the Insights Association, so the process stays fair and honest.

7.5 No unauthorized sharing or sale of data

We don’t sell or share participants’ personal data with third parties unless you’ve agreed to it or the law requires it.

8. Protection of information provided on our website

When you use our website, we may collect contact details, browsing behavior, and other information you give us. We protect it from unauthorized access and misuse in these ways.

8.1 Secure data transmission

We use encryption (such as TLS) to secure the connection between you and our website.

8.2 Cookie and tracking controls

We use cookies and similar tools to run the site, remember your preferences, and measure performance. Strictly necessary cookies are always on. For every non-essential cookie, including analytics and any advertising or tracking cookies, we ask for your consent through our cookie banner before we set them. The banner blocks non-essential cookies until you give consent. You can change or withdraw that choice whenever you like. Section 11 has the detail.

8.3 Controlled access and data minimization

We collect only what we need and restrict access to authorized staff.

8.4 Your rights and clarity

You can access, correct, or delete your personal data, and Section 18 shows you how.

8.5 Regular security audits and updates

We keep monitoring and updating our security to guard against new threats and breaches.

9. How we use information (purposes of processing)

We use personal data for legitimate business and research purposes only. The table sets out each purpose and the legal basis we rely on (Section 10 explains those bases).

Where we rely on legitimate interests, we weigh those interests against your rights and freedoms. You can opt out of marketing at any time.

10. Legal basis for processing data

We process personal data only when we have a valid legal basis for it:

• Consent. We ask for consent before we collect or process personal data for surveys, market research, non-essential cookies, and marketing. You can withdraw it at any time, and withdrawing is as easy as giving it. Withdrawal doesn’t undo processing we already did.
• Contractual necessity. When you engage our services or join expert recruitment, we process your data as needed to deliver what we agreed with you or your organization.
• Legal compliance. We process data to meet legal duties, such as responding to regulators and running audits.
• Legitimate interests. We process data to run the business, for example improving our research methods, building analytics, and preventing fraud, as long as this doesn’t override your rights and freedoms.

Special-category data. If any processing touches special-category data under GDPR/UK GDPR Article 9, we’ll rely on a specific Article 9 condition, usually your explicit consent, and write it down before we start. PHI handled under a HIPAA Business Associate Agreement is governed by that agreement and HIPAA, not by the Article 9 consent route.

11. Cookies and tracking technologies

We use cookies and similar technologies on our website. Strictly necessary cookies keep the site working and don’t need consent. Every other category is set only after you consent through our cookie banner, and you can withdraw consent at any time from the banner or your browser settings. The banner blocks non-essential cookies until you consent.

Cookies currently active on www.tehrihills.com:

* HubSpot cookies are not set at page load. They are set only when you interact with a HubSpot form on our site, for example when you submit a whitepaper download or contact form. Until you submit such a form, they are absent.

No Google Analytics, Facebook Pixel, or third-party advertising cookies are active at page load. Smartlook is the only third-party tracker that loads on entry, and only after you accept analytics cookies through the banner.

12. Children’s privacy

Our services and website are built for businesses and working professionals. We don’t knowingly collect personal data from children. If we learn we’ve collected a child’s data without the right consent, we’ll delete it quickly. This follows the GDPR and UK GDPR rules on children’s consent and the CCPA/CPRA rules on minors under 16. If you think a child has given us personal data, contact us using Section 21.

13. Automated decision-making and profiling

We don’t make decisions about you by automated processing alone where those decisions would have legal or similarly significant effects, and we don’t profile you that way. Our expert-matching and analytics involve human review and judgement. If that changes, we’ll update this policy and give you the information Article 22 of the GDPR/UK GDPR requires.

14. Information sharing and disclosure

We don’t sell or trade personal data. We may share it, under strict privacy and security controls, in these situations:

• With clients. We share anonymized and aggregated research, recruitment, or analytics outputs. We don’t disclose information that identifies you unless you’ve authorized it.
• With service providers. Trusted vendors help us with data storage (Amazon Web Services, Microsoft Azure), website analytics, IT security, and similar functions. Contracts bind them to protect the data and use it only for the agreed purpose.
• For legal and regulatory compliance. We may disclose data when the law, a regulator, or a court requires it, or to prevent fraud and investigate security incidents.
• With business partners. In a merger, acquisition, or partnership, under confidentiality terms and in line with the law.
• With HIPAA covered-entity clients.Disclosures of PHI follow the terms of the applicable Business Associate Agreement and the HIPAA Privacy Rule (45 CFR §§ 164.502–164.514).

14.1 International data transfers and our role as Controller or Processor

TehriHills runs through entities in India (TehriHills Consultancy Pvt Ltd) and the United States (TehriHills Consulting Services LLC). Personal data may move between these entities and outside the EEA and UK depending on the engagement.

Controller or Processor. Our role under GDPR / UK GDPR / DPDP Act depends on the activity:

• Controller. For website operations, marketing activities, newsletter subscriptions, expert network management, and certain direct research activities, TehriHills decides the purposes and means of processing and acts as the Data Controller.
• Processor. For most client engagements, the client is the Data Controller and TehriHills acts as the Data Processor on the client’s instructions, under a written data-processing agreement.

The distinction matters because it determines who is responsible for responding to your requests, providing notices, and reporting breaches. If you’re uncertain which role applies to your data, ask us and we’ll tell you.

Hosting and jurisdictions. Our infrastructure runs on Amazon Web Services and Microsoft Azure. Personal data may be hosted in the United States or in other regions depending on client contractual requirements, applicable regulations, and operational considerations.

Safeguards for cross-border transfers. Where personal data of EEA or UK individuals is transferred outside those regions, we put a recognized safeguard in place:

• For transfers from the EEA or UK to our India entity, we rely on the EU Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum. India does not currently benefit from an EU adequacy decision.
• For transfers from the EEA to our US entity, we rely on the EU-US Data Privacy Framework where our US entity is self-certified. Where it isn’t, we fall back on the EU Standard Contractual Clauses. For UK-origin data, we use the UK-US Data Bridge or the UK Addendum to the SCCs.
• For transfers from India under the DPDP Act, we rely on the transfer mechanisms permitted by the Act and any country-specific restrictions issued by the Indian government from time to time.

We complete a transfer impact assessment for each cross-border flow and apply supplementary technical, contractual, or organizational measures where the destination legal regime requires them. To request a copy of the safeguards for a specific transfer, contact us at th.gdpr@tehrihills.com.

15. Data security

We protect personal data from unauthorized access, alteration, disclosure, or destruction across its whole lifecycle:

• Encryption and secure storage. We encrypt personal data in transit and at rest.
• Access controls. Role-based access means only authorized staff with a genuine need can see the data.
• Regular audits. Periodic security audits and vulnerability checks find and fix risks.
• Incident response and breach notification. We keep an incident-response plan. Where a breach is likely to put people at risk, we tell the relevant supervisory authority without undue delay and, under the GDPR/UK GDPR, within 72 hours of finding out. We tell affected individuals without undue delay where the risk to them is high. We also meet breach-reporting duties under other applicable laws, including India’s DPDP Act and, where PHI is involved, the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D), under which we notify the covered entity within the timelines required by the relevant Business Associate Agreement so the covered entity can meet its own notification obligations.
• Secure third-party relationships. Vendors who handle personal data for us must meet strict security and confidentiality obligations.

16. Data retention

We keep personal data only as long as we need it for the purpose we collected it, and to meet our legal, contractual, and business obligations. After that, we securely delete or anonymize it. Our standard periods:

Note. These periods are operational defaults. Actual retention may be longer or shorter where required by legal, regulatory, or contractual obligations, including GDPR and UK GDPR retention duties, HIPAA recordkeeping requirements where applicable under a Business Associate Agreement, ISO 27001 / Information Security Management System controls, client contractual obligations, litigation holds, regulatory investigations, and other compliance obligations. Where these obligations require us to keep data longer than the default period above, we do so for the period the obligation requires and no longer.

17. Compliance with privacy laws and your rights

We’ve built our data-protection practices around the laws that apply to the people we serve. This section sums up your rights. Section 18 tells you how to use them.

17.1 GDPR: individuals in the European Economic Area (EEA)

If you’re in the EEA, the GDPR gives you these rights:

• Right of access (Art. 15). Ask for confirmation of, and access to, your personal data and how we process it.
• Right to rectification (Art. 16). Correct data that’s wrong or incomplete.
• Right to erasure (Art. 17). Ask us to delete your data when it’s no longer needed, you withdraw consent, or it was processed unlawfully.
• Right to restrict processing (Art. 18). Limit how we process your data in certain cases.
• Right to data portability (Art. 20). Get your data in a common format and move it to another controller.
• Right to object (Art. 21). Object to processing, including direct marketing.
• Right to withdraw consent. Where we rely on consent, take it back at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to lodge a complaint. Raise it with your local supervisory authority.

17.2 UK GDPR: individuals in the United Kingdom

If you’re in the UK, you have the same rights under the UK GDPR and the Data Protection Act 2018. You can also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

17.3 CCPA/CPRA: California residents

If you’re a California resident, the CCPA (as amended by the CPRA) gives you these rights:

• Right to know. The categories and specific pieces of personal information we collect, use, and disclose, plus the sources and purposes.
• Right to delete. Ask us to delete your personal information, subject to legal exceptions.
• Right to correct. Ask us to fix inaccurate personal information.
• Right to opt out of sale or sharing. We don’t sell your personal information or share it for cross-context behavioral advertising. If we ever did, you could opt out.
• Right to limit use of sensitive personal information. Tell us to use any sensitive personal information only for permitted purposes.
• Right to non-discrimination. We won’t treat you worse for using your rights.
• Authorized agent. You can have an authorized agent file requests for you.

17.4 HIPAA: protected health information

Where TehriHills handles your PHI as a business associate to a HIPAA covered entity, your HIPAA Privacy Rule rights (access, amendment, accounting of disclosures, restriction, confidential communications, complaint) are exercised against the covered entity that holds the relationship with you, not against TehriHills. If you contact us directly with a HIPAA rights request, we’ll route it to the covered entity and confirm receipt with you. You can also file a HIPAA complaint with the US Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr.

17.5 India: Digital Personal Data Protection Act, 2023 (DPDP Act)

As a company based in India, we follow the DPDP Act, 2023. Where it applies, Data Principals can get a summary of their personal data and how it’s processed, ask for correction and erasure, raise a grievance, and nominate someone to act on their behalf. We respond to requests and grievances within the timeframes the Act sets. To raise a grievance, contact our Grievance Officer at th.privacy@tehrihills.com.

17.6 Other standards we follow

• ISO 27001 and the NIST Cybersecurity Framework. They guide our security and data-protection work.
• ESOMAR and Insights Association guidelines. They cover ethical market research.
• US Federal Trade Commission (FTC) guidance. On online privacy and consumer protection.

18. How to exercise your rights

To use any of your rights, contact us at the mailbox that fits your matter:

• General privacy queries and data-access requests: th.privacy@tehrihills.com
• GDPR / UK GDPR matters: th.gdpr@tehrihills.com
• HIPAA matters: th.hipaa@tehrihills.com

You can also call +91-9650619444 (India) or +1-419-504-1602 (USA). We’ll verify who you are before we act, and we’ll respond within the time the relevant law allows:

• GDPR and UK GDPR: within 1 month (we can extend by 2 more months for complex requests, and we’ll tell you).
• CCPA/CPRA: within 45 days (we can extend by another 45 days, and we’ll tell you).
• HIPAA: within 30 days, extendable once by 30 days. HIPAA Privacy Rule rights requests are routed to the covered entity that controls your records.
• DPDP Act (India): within the period the Act sets.

19. Data protection officer and representatives

Our privacy team operates the dedicated mailboxes set out in Section 18. For any question about how we handle your personal data, use the address that matches the matter:

• General privacy and DPO matters: th.privacy@tehrihills.com
• GDPR and UK GDPR matters: th.gdpr@tehrihills.com
• HIPAA matters: th.hipaa@tehrihills.com

We have appointed an EU representative under GDPR Article 27 and a UK representative under UK GDPR Article 27. Their contact details are published at tehrihills.com/representatives and updated when designations change.

20. Updates to this privacy policy

We review this policy from time to time and update it as our practices, the law, and technology change. The “Effective / last updated” date in the Document control table shows the last revision. When something material changes, we’ll let you know through:

• Website notices. A note on our homepage or privacy page.
• Email. Where the change really affects how we handle personal data, we’ll email registered users and participants.
• In-product alerts. For people using our online services.

Where a change needs consent under the law, we’ll ask for fresh consent before it takes effect. You can review the new version, change your preferences, or contact us with any concern.

22. Your trust matters

We take your trust seriously and work to keep your experience secure. This policy is here to inform you: it explains how we handle your data and what rights you have. If you have a concern, contact us.