Privacy policy

Last updated:

The short version: we collect what you give us so we can reply, we don't sell it, we don't spam you, and you can ask us to delete it any time. The long version is below.

01Who we are

This website, baddesign.io, is run by Bad Design LLP, a design studio registered in India with its office in Mumbai (“Bad Design”, “we”, “us”). We decide how and why your personal data is used on this site, which makes us the data fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the data controller under the EU and UK GDPR where those apply.

Registered address: [Registered office address, Mumbai]. LLP identification number: [LLPIN].

02What we collect

Things you give us

  • Contact form and emails: your name, work email, company, website, role, the services you're interested in, project size, timeline and your message.
  • Free roast requests: the website URL and anything you tell us about it.
  • Launch notifications: your email address, if you sign up to hear when something launches.
  • Client work: if you become a client, the contact and billing details we need to deliver the work and invoice you.

Things collected automatically

  • Server logs: our hosting provider records technical data such as IP address, browser type and pages requested, to keep the site running and secure.
  • Analytics: [We do not currently use analytics cookies. If we add a privacy-friendly analytics tool, we will name it here and update the cookie policy.]

We don't ask for sensitive personal data, and we ask you not to include it in your messages.

03How we use it

  • To reply to your enquiry and send the free roast you asked for.
  • To scope, quote and deliver work if you hire us, and to invoice and keep financial records.
  • To send you a one-off launch notification if you asked for one.
  • To keep the site secure and working properly.
  • To meet our legal obligations, for example tax and accounting rules.

We don't sell your data, we don't use it for advertising, and we don't add you to a newsletter or sales sequence without asking.

04Why we're allowed to

In India, we process your data on the basis of the consent you give when you submit a form or email us, and for legitimate uses permitted by the DPDP Act, such as complying with the law. You can withdraw consent at any time (see “Your rights”). Withdrawing doesn't affect anything we did before.

In the EU and UK, we rely on your consent, on steps you ask us to take before entering a contract, on performing a contract with you, on our legitimate interest in running and securing our business, and on legal obligations.

05Who we share it with

We only share your data with service providers who help us run the studio, and only what they need:

  • Website hosting: Hostinger
  • Email and documents: [e.g. Google Workspace]
  • Form handling: [e.g. Formspree, if enabled]
  • Accounting and invoicing: [tool name], for clients only

These providers act on our instructions. We may also disclose data if the law requires it. Some providers store data outside India. Where that happens we rely on the safeguards the provider offers and on transfers being permitted under applicable law.

06How long we keep it

  • Enquiries that don't become projects: up to [24 months], then deleted.
  • Launch notification emails: until we send the notification or you ask us to delete it.
  • Client records: for as long as the law requires us to keep business and tax records.

07How we protect it

We use reputable providers, encrypted connections (HTTPS), access limited to the people who need it and strong account security. No system is perfectly secure. If a personal data breach affects you, we'll tell you and the relevant authorities as the law requires, including what happened, what it could mean for you and what we're doing about it.

08Your rights

Depending on where you live, you can ask us to:

  • Tell you what personal data we hold about you and how we use it
  • Correct, complete or update it
  • Delete it
  • Withdraw your consent
  • Nominate someone to exercise these rights for you (India)
  • Object to or restrict certain processing, and receive a copy of your data (EU and UK)

Email admin@baddesign.io with the subject “Privacy request”. We may need to confirm your identity. We'll respond as quickly as we can and within the time the law allows.

09Children

This site is for businesses and isn't aimed at anyone under 18. We don't knowingly collect data from children. If you think a child has sent us their details, contact us and we'll delete them.

10Contact and complaints

For any question or complaint about your personal data, contact our Grievance Officer:

Rohit Kadam, Founder, Bad Design LLP
Email: admin@baddesign.io
Address: [Registered office address, Mumbai]

If you're not satisfied with our response, you can complain to the Data Protection Board of India, or, if you're in the EU or UK, to your local data protection authority.

11Changes to this policy

We'll update this page when our practices change, and change the “last updated” date at the top. If a change materially affects how we use data you've already given us, we'll tell you directly.

This page is written in plain language to be easy to read. It is not legal advice, and Bad Design LLP should have it reviewed by a qualified lawyer before relying on it.