GDPR and Data Protection
Last updated: 30 October 2026
This page explains exactly what we do with your information: what we collect, why, who sees it, and how long we keep it. It is written in plain language on purpose.
Which law applies. We operate from Mumbai, Maharashtra. For everybody, India’s Digital Personal Data Protection Act 2023 applies. If you are in the EU or the UK, GDPR applies to you as well, and we have written this to meet it. We are not certified or audited by anybody, and we do not claim to be.
1. What personal information do we collect?
Two kinds: what you give us yourself, and what the website records automatically. Nothing else.
| What we collect | Why | How long we keep it |
|---|---|---|
| Your name Enquiry form | So we know how to address you when we reply | One month, then deleted |
| Your phone number Enquiry form | To reply. For most enquiries this is the only way we answer | One month, then deleted |
| Your email address Enquiry form | A second route to reach you if the phone number does not connect | One month, then deleted |
| Your message Enquiry form | So we understand what you are asking about | One month, then deleted |
| WhatsApp number and display name If you message us | To reply to you on WhatsApp | Stays in WhatsApp until deleted from the device |
| IP address, browser, device Server logs | Security, and spotting misuse of the website | Held by our host, Hostinger, under their log retention |
| Pages visited, time on page, referrer Google Analytics 4 | To see which pages are useful and improve them | Held by Google under our Analytics retention setting |
| Clicks on outbound links Google Tag Manager | To count how often contact buttons are used | Held by Google, as above |
We do not collect your date of birth, your address, your ID documents, or any payment details. There is no payment facility on this website, so there is nothing of that kind to collect.
2. How do we use each one?
Only for the purpose listed in the table above. We do not use your details for marketing, we do not sell them, and we do not add you to any mailing list. We have never done so and have no plans to.
3. What is our legal basis for processing?
- Enquiry details — your consent, given when you send the form or message us. You may withdraw it at any time.
- Server logs — our legitimate interest in keeping the website secure and working.
- Analytics — your consent where that applies, and otherwise our legitimate interest in understanding which pages are used.
- Anything we are legally required to retain — compliance with a legal obligation.
4. How is it stored and protected?
We will be straight with you rather than make promises we cannot keep.
The website uses an SSL certificate, so what you type into the form is encrypted on its way to us. Enquiries go to a single mailbox that only we access. We delete enquiry details after one month, which means there is less sitting around to go wrong.
No website anywhere is completely secure, and anybody telling you otherwise is overselling. We hold the minimum we need, for the shortest time we can. Please do not send us identity documents or financial details — we do not need them and we do not ask for them.
5. Who do we share it with?
Your enquiry details — name, phone, email, message — are seen by us and nobody else. We do not sell them and we do not pass them to other parties.
Three companies are involved in running the website, and it would be misleading not to name them:
| Who | What they receive | Why |
|---|---|---|
| Hostinger | Everything stored on the website, including server logs | They host the website |
| Google Analytics and Tag Manager | IP address, pages visited, outbound clicks. Not your enquiry details | Website analytics |
| Meta | Only what you send over WhatsApp, if you choose to use it | Messaging |
We will also hand over information if a court, the police or another lawful authority formally requires it. There is no other circumstance in which your details leave us.
6. How long do we keep it?
Enquiry details: one month from the day you contact us, then deleted. The retention column in the table above covers everything else.
7. Cookies and tracking
The website runs Google Tag Manager (container GTM-PJM9K2C8), which loads Google Analytics 4 (measurement ID G-W1WKF4G3YY). These set cookies and tell us visitor numbers and which pages were opened. Our setup also records clicks on links leaving the website, including the WhatsApp buttons — that tells us a button was pressed, not what you went on to say.
WordPress sets a small number of cookies needed for the website to function.
We do not currently show a cookie consent banner. We are telling you that plainly rather than letting you discover it.
How do you turn cookies off?
- Chrome — Settings, then Privacy and security, then Third-party cookies
- Safari — Settings, then Safari, then Block All Cookies
- Firefox — Settings, then Privacy and Security, then Enhanced Tracking Protection
- Or browse in a private window, which clears cookies when you close it
Blocking cookies will not stop you using this website.
8. What are your rights?
Under the DPDP Act 2023, and under GDPR if you are in the EU or UK, you can ask us for any of the following. There is no charge and you do not need a reason.
| Your right | What it means | How to use it |
|---|---|---|
| Access | See what we hold about you | Email us and ask |
| Correction | Fix anything wrong or out of date | Email us with the correction |
| Erasure | Have it deleted, unless a law requires us to keep it | Email us and ask |
| Restriction | Ask us to stop using it while something is sorted out | Email us and say why |
| Portability | Get a copy in a format you can take elsewhere | Email us and ask |
| Objection | Object to us using it at all | Email us and say why |
| Withdraw consent | Take back permission you gave earlier | Email us. It takes effect immediately |
| Nominate DPDP Act | Appoint somebody to act for you if you die or cannot act | Email us with their details |
Write to report@citydesires.co.in. We reply within one week.
9. Does any of it leave India?
Yes, in two places, and both are worth knowing about. Google processes analytics data on servers outside India. Meta processes WhatsApp messages outside India. Both operate under their own international transfer arrangements.
Your enquiry details do not leave our mailbox and are not transferred anywhere.
10. Children
This website is strictly for adults aged 18 and above. We do not knowingly collect information from anybody under 18. If you believe a person under 18 has contacted us or appears anywhere on this website, write to report@citydesires.co.in immediately and we will treat it as a priority. See our safeguarding page for more.
11. What happens in a data breach?
If information we hold is exposed, lost or accessed by somebody who should not have it, we will tell the people affected and the Data Protection Board of India as the DPDP Act requires. We will say what happened, what was involved, and what we are doing about it. We will not minimise it or delay telling you.
12. How does this page change?
If we change how we handle your information, we update this page and change the date at the top. If a change is significant we will say so on the page rather than editing it quietly. This page was last updated on 30 October 2026.
13. Who do you contact?
For any data request, question or complaint
Grievance Officer: Kailash Sindhe
Phone: +91 77108 97032
Address: Andheri, Mumbai, Maharashtra 400053
We reply within one week. If you are not satisfied with our answer, you may approach the Data Protection Board of India. If you are in the EU or UK, you may complain to your local supervisory authority.
See also our Privacy Policy and Terms and Conditions.