PRIVACY POLICY
Effective date: 26 September 2026
1. Who we are?
Olee.space is a brand of Citoto Digital Personality Private Limited ("Citoto", "we", "us", "our"), a company incorporated under the Companies Act, 2013.
Registered office: Office Nos. 1705 to 1709, 17th Floor, Maruti Millennium Tower, S. No. 36/2, Baner, Pune, Maharashtra 411045, India
Corporate Identity Number: U26700PN2020PTC194767
GSTIN: 27AAJCC0257H1ZQ
Email: legal@olee.space
For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Citoto Digital Personality Private Limited is the Data Fiduciary in respect of all personal data collected through this website. You are the Data Principal.
All activities presented on this website are carried out by Citoto Digital Personality Private Limited and its subsidiaries. olee.space is a brand name, not a separate legal person, and any reference on this website to "olee" or "olee.space" is a reference to Citoto Digital Personality Private Limited.
Where a subsidiary carries out an activity described here, Citoto Digital Personality Private Limited remains the Data Fiduciary for personal data collected through this website, and remains accountable to you for it.
2. What this policy covers
This policy applies to personal data we collect when you:
visit any page of this website;
submit our contact form;
write to any email address published on this website;
write to us about a role at admin@olee.space.
It does not apply to third-party websites we link to, to our conduct under separate contracts with customers or suppliers, or to any procurement, tender or government process which is governed by its own terms.
What we collect
Read this section before you contact us.
3.1 Information you give us through the contact form
When you complete the contact form we collect:
name
work email address
phone number
country or region
company
your stated intent, selected from a list
the application area you select: Connect, Power or Protect
the use case type you select, from a list
the subject of your enquiry
the content of your message
The fields listed above are the ones the form currently requests. Fields marked as required must be completed for the form to be submitted, and anything else is optional. Where we add or remove a field, we collect only what that field asks for, and we use it for the purposes set out in section 4.
Please do not submit through this website:any technical data, drawings, specifications or performance parameters relating to defence, dual-use or export-controlled equipment, whether ours or a third party's;
any information that is classified, restricted or otherwise protected under the Official Secrets Act, 1923 or any equivalent law of your country;
any personal data relating to another individual, unless you are authorised to provide it;
any financial account details, government identification numbers, health information, biometric data, or information about your caste, religion, political beliefs or sexual life.
We do not ask for any of the above and we do not need it to respond to you. If you send it anyway, we may delete it without acting on it, and we may be required to report it.
3.2 Information collected automatically
When you visit the site, our hosting provider may record:
your IP address, in whole or truncated;
browser type, operating system and device type;
the pages you viewed, the time of your visit and the referring page;
approximate location inferred from your IP address, at city or country level.
We use this to keep the site running, to detect misuse, and to understand which sections are read. We do not use it to build a profile of you or to target advertising.
3.3 If you write to us about a job
If you write to our careers address, admin@olee.space, anything you send is personal data: your name, contact details, the contents of your message, and your CV and any attachments if you send them.
We use it only to consider you for a role, to contact you about it, and to keep a record of the process. We keep unsuccessful applications for 12 months in case a suitable role opens, then delete them. Ask us at any time to delete yours sooner and we will.
Do not send us information about your caste, religion, health or disability unless a role genuinely requires it, and do not send identity documents until we ask.
3.4 Information we do not collect
We do not operate a login, an account area or a payment system on this website. We do not sell personal data. We do not use this website for behavioural advertising, and we do not permit third parties to track you across other websites from here.
4. Why we use it, and on what basis
Under the DPDP Act we may process personal data with your consent, or for certain legitimate uses set out in section 7 of that Act.
We will not use your contact form submission to send you marketing communications unless you separately opt in. If you do opt in, every message will carry an unsubscribe link.
5. Export control, defence regulation and screening
This is not standard website boilerplate, and it applies because of what we make.
Some of our products and technologies are subject to India's export control framework, including the SCOMET list under the Foreign Trade Policy, and may be subject to the equivalent controls of other countries. Enquiries relating to those products are handled under that framework.
Accordingly:
we may screen enquiries, including the name, organisation and country you provide, against sanctions lists, denied-party lists and internal compliance criteria before responding;
we may decline to respond, or respond only in general terms, where doing otherwise would or might breach export control, defence procurement or national security obligations, and we are not required to tell you which of these applies;
we may retain and disclose enquiry records to Indian government authorities where we are required to do so, or where we reasonably consider it necessary for national security purposes;
submitting an enquiry does not entitle you to receive technical information, specifications, performance data, pricing or documentation of any kind.
Government, defence and law enforcement organisations should contact us at admin@olee.space rather than through the website form, and should not send operational, procurement or technical detail through any channel until a suitable agreement is in place.
Intellectual property
We do not sell, rent or trade personal data. We share it only as set out here.
6.1 Within our company and our subsidiaries
All personal data collected through this website is held by Citoto Digital Personality Private Limited. We route your enquiry internally, or to the subsidiary best placed to answer it, and access is limited to employees and authorised contractors who need it to respond to you or to meet a legal obligation.
Our subsidiaries are bound by the same standards set out in this policy, under internal agreements that require it. Citoto Digital Personality Private Limited remains accountable to you for how they handle your data. We do not transfer enquiry data to any company outside our own group.
6.2 Service providers
We do not currently use a customer relationship management system, an analytics provider or a separate form processor. If we add one, we will update this table before we start using it.
Each of these is engaged under a contract that limits them to processing data on our instructions. We remain responsible to you for what they do with it.
6.3 Legal and regulatory disclosure
We may disclose personal data where required by Indian law, by a court or tribunal, or by a government authority acting within its powers, including under the DPDP Act, the Information Technology Act, 2000, and export control and national security legislation.
7. Where your data goes
Some of our service providers store or process data outside India. Where that happens, transfers are made in accordance with section 16 of the DPDP Act, and we will stop transferring data to any country that the Central Government restricts by notification.
Current known locations of processing are listed in the table at 6.2. We will update that table when it changes.
8. How long we keep it
When a retention period ends we delete the data, or irreversibly anonymise it.
9. How we protect it
We apply reasonable security safeguards appropriate to the nature of the data, including access controls limiting enquiry data to staff who need it, encryption of data in transit, multi-factor authentication on the systems that hold enquiry records, and contractual security obligations on our service providers.
No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal in the manner and within the timelines required by the DPDP Act and rules made under it.
10. Your rights
Under the DPDP Act you have the right to:
Know what we hold. Ask for a summary of the personal data we process about you, what we do with it, and the identities of anyone we have shared it with.
Correct it. Ask us to correct data that is inaccurate or misleading, complete data that is incomplete, and update data that is out of date.
Have it erased. Ask us to delete your personal data, unless we are required to keep it for a legal purpose. That includes the export-control and regulatory records described in section 5.
Withdraw consent. Withdraw consent at any time, as easily as you gave it. Withdrawal does not affect anything we did before you withdrew.
Nominate someone. Nominate another individual to exercise these rights on your behalf if you die or become incapable of exercising them.
Complain. Raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied.
Rights we extend to everyone, wherever you are
The rights above come from Indian law. We extend the following to every visitor, in every country, as a matter of policy rather than obligation. You do not need to tell us where you live to use them:
Object. Ask us to stop processing your personal data for a particular purpose. We will stop unless we have a compelling reason not to, and we will tell you what it is.
Receive a copy. Ask for the personal data you gave us in a common, machine-readable format.
Restrict. Ask us to hold your data without further processing while a dispute about its accuracy or our use of it is resolved.
Human review. Ask for a person to review any decision about your enquiry that was reached by automated means, including the screening described in section 5.
Nothing here reduces your own country's protections
This policy is written to Indian law. It is not intended to, and does not, take away any right you have under the law of the country where you live.
If the law of your country gives you a right this policy does not mention, a shorter deadline than we state, or a remedy we do not offer, that law applies to you and we will honour it. Write to our Grievance Officer at section 13 and say which law you are relying on. Nothing in this policy limits your right to complain to a supervisory or data protection authority in your own country.
To exercise any of these, write to our Grievance Officer at section 12. We will respond within 30 days. We may ask you for enough information to confirm who you are before we act, and we will not use that information for anything else.
A note on duties. The DPDP Act also places duties on Data Principals. You must not impersonate another person when providing personal data, suppress material information, or file a false or frivolous grievance. Penalties apply under the Act.
11. Children
This website is intended for business and institutional audiences. It is not directed at children.
Under the DPDP Act, a child is anyone under 18 years of age. We do not knowingly collect personal data from children. We do not carry out tracking, behavioural monitoring or targeted advertising directed at children. If we learn that we hold personal data of a child without verifiable consent of a parent or lawful guardian, we will delete it.
If you believe a child has submitted personal data to us, write to the Grievance Officer at section 12 and we will remove it.
12. Limitation of liability
We currently run no analytics and no advertising or tracking technology on this website. The only cookies set are strictly necessary ones placed by our hosting provider to deliver pages and keep the site secure. These cannot be switched off, and no consent is required for them under Indian law or under most other regimes.
Our fonts are served from our own site, not from a third party, so visiting a page does not send your details anywhere else.
If we add analytics or any other non-essential technology in future, we will update this section before switching it on, and we will set those cookies only after you consent. Consent will be optional, refusing will take a single click, and we will not treat continued browsing as consent.
You can block or delete cookies in your browser at any time. Strictly necessary cookies cannot be blocked without affecting how the site works.
13. Grievance Officer
In accordance with the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our Grievance Officer is:
If you are not satisfied with our response, you may complain to the Data Protection Board of India in accordance with the DPDP Act.
14. Visitors outside India
This website is operated from India by an Indian company, and our data protection obligations arise under Indian law. We have not appointed a representative in any other jurisdiction, and we do not hold ourselves out as certified under any foreign data protection regime.
That said:
the rights in section 10 are available to you wherever you live, including the rights we extend as a matter of policy;
we will honour any additional right your own law gives you, as set out in section 10;
we apply the same handling standards to every visitor's data. We do not operate a lower standard for visitors from countries with weaker protections;
we set non-essential cookies only with consent, everywhere, not only where consent is legally required;
you may complain to a data protection authority in your own country, and we will co-operate with a properly made request from one.