Privacy Policy
Last updated: 31 August 2026
1. Who we are
Bombay Breed Consulting ("Bombay Breed", "we", "our", "us") is a strategic communications and climate advisory practice, and is a proprietorship of Theresa Ronnie, registered in India. This policy explains what personal data we collect through bombaybreed.com, why we collect it, who processes it on our behalf, how long we keep it, and the rights you have over it.
Because Bombay Breed is a proprietorship, the person legally responsible for your data is Theresa Ronnie. She is the Data Fiduciary for the purposes of the Digital Personal Data Protection Act, 2023 (India) and the Data Controller for the purposes of the UK and EU General Data Protection Regulation. Our place of business is:
202 Raheja Mansion, High Street, Cooke Town, Bangalore 560005, Karnataka, India
2. Data protection contact
Theresa Ronnie, Founder, acts as our Data Protection Officer and is the person responsible for answering questions about how we handle personal data.
- Email: theresa.ronnie@bombaybreed.com
- Acknowledgement: within 3 business days
- Substantive response: within 30 calendar days
Use this address for any request to access, correct, delete or export your data, to withdraw consent, or to complain about how we have handled it. Payment and subscription complaints follow a separate route set out on our Grievance Redressal page.
3. What we collect and why
We only collect personal data that you choose to give us, plus a limited amount of technical data that is created automatically when any browser loads any website.
| What we collect | When | Why, and on what legal basis |
|---|---|---|
| Name, email address, phone number, organisation, designation | Appointment booking and enquiry forms | To respond to you and to arrange and deliver advisory work. Steps taken at your request prior to a contract, and our legitimate interest in responding to business enquiries. |
| Name, email address, organisation | Report and download forms | To send you the document you asked for. Performance of your request. |
| Email address | Newsletter signup | To send The Climate Desk. Consent, which you can withdraw at any time. |
| The content of anything you write in a message field | Any form | To understand and answer your enquiry. Please do not include confidential or sensitive information in a web form. |
| IP address, browser and device type, pages viewed, referring site | Automatically, on every visit | Security, abuse prevention and server operation, on our legitimate interest. Where this data feeds analytics or advertising, it is used only with your consent. |
| Analytics and advertising identifiers | Only after you accept cookies | To measure which content works and to measure advertising response. Consent. |
We do not knowingly collect special category data, financial account details, or government identifiers through this website, and we ask that you do not send them to us through it.
4. Who processes your data
We are a small practice and we rely on established service providers rather than our own infrastructure. Each of the following receives some of your data in order to provide a specific service to us. None of them is permitted to use it for their own purposes except as described in their own policies.
| Provider | What it does for us | Data it receives | Where |
|---|---|---|---|
| Formspree | Receives and forwards every form submission on this site | Everything you enter in a form, plus your IP address | United States, on Amazon Web Services |
| Vercel | Hosts and serves the website | IP address and request logs | United States, global edge network |
| Google Analytics 4 | Measures site usage. Runs only with your consent | Truncated IP, device and page data, analytics identifier | United States |
| Google Ads | Measures advertising response and supports remarketing. Runs only with your consent | Advertising identifier, conversion events | United States |
| Substack | Hosts and sends The Climate Desk newsletter | Email address, open and click activity | United States |
| YouTube (Google) | Serves embedded video on some pages | IP address and cookies set by the embed when you play a video | United States |
| Unsplash, Substack CDN, Cloudflare CDN | Deliver images and static assets | IP address, as a necessary part of any file request | Global |
We do not sell personal data, and we do not share it with third parties for their own marketing.
5. International transfers
Most of the providers listed above are based in the United States, so your data is transferred outside India and outside the UK and EEA.
Where a transfer originates in the UK or EEA, we rely on the safeguards published in each provider's own data processing terms. Formspree states that it relies on the European Commission's Standard Contractual Clauses as a processor. Substack incorporates the EU and UK Standard Contractual Clauses into its data processing addendum and participates in the EU-US Data Privacy Framework. Google and Vercel each publish a data processing agreement incorporating the Standard Contractual Clauses, and Google is certified under the EU-US Data Privacy Framework. Where the UK International Data Transfer Addendum is required, it applies alongside those clauses.
Where a transfer originates in India, it is made to jurisdictions not restricted under the Digital Personal Data Protection Act, 2023.
We are established in India and not in the UK or EEA. Our processing of UK and EEA personal data is occasional, low risk and limited to business enquiries and a newsletter, so we have not appointed a representative under Article 27 of the UK or EU GDPR. If that changes, we will appoint one and name them here. You may request a summary of the safeguards in place by writing to theresa.ronnie@bombaybreed.com.
6. How long we keep it
| Record | Retention period |
|---|---|
| Enquiry, appointment and booking records | 24 months from our last contact with you |
| Report and download requests | 24 months from the request |
| Newsletter subscription | Until you unsubscribe. Your email is then held on a suppression list for 12 months so that we do not contact you again in error |
| Client engagement records | 8 years after the engagement ends, to meet Indian tax and contractual record-keeping obligations |
| Server and security logs | Up to 30 days |
| Analytics data | 14 months, per our Google Analytics configuration |
At the end of each period the record is deleted or irreversibly anonymised. You can ask us to delete your data sooner and we will do so unless a legal obligation requires us to keep it.
7. Cookies and tracking
Analytics and advertising cookies are switched off by default. Nothing beyond what is strictly necessary runs until you accept them in the banner shown on your first visit. You can change your decision at any time using the Cookie settings link in the footer of every page, which reopens the banner. Withdrawing is exactly as easy as consenting.
| Category | Set by | Purpose | Consent needed |
|---|---|---|---|
| Strictly necessary | Bombay Breed | Records your cookie choice and keeps the site working | No |
| Analytics | Google Analytics 4 | Counts visits and shows which pages are read | Yes |
| Advertising | Google Ads | Measures advertising response and supports remarketing | Yes |
| Embedded video | YouTube | Set only if you play an embedded video | Yes |
8. Our use of artificial intelligence
We use AI tools in the research and drafting of the analysis we publish. Every published claim is checked against a primary source by a person before it goes out, and editorial judgement remains human.
Personal data you submit through this website is not used to train AI models, is not entered into public AI tools, and is not subject to any automated decision-making that produces legal or similarly significant effects for you.
9. Your rights
Wherever you are, you can ask us to give you a copy of your data, correct it, complete it, delete it, or stop using it for marketing. Depending on where you are, you may also have the following rights.
If you are in India, under the DPDP Act, 2023
- Access a summary of the personal data we hold about you and who we have shared it with
- Correct, complete, update or erase your data
- Nominate another person to exercise your rights if you die or become incapacitated
- Complain to us first, and then to the Data Protection Board of India if you are not satisfied
If you are in the UK or EEA, under the GDPR
- Access, rectification, erasure, restriction, portability and objection
- Withdraw consent at any time, without affecting processing already carried out
- Lodge a complaint with your national supervisory authority, or with the Information Commissioner's Office in the UK
To exercise any of these, write to theresa.ronnie@bombaybreed.com. We will acknowledge within 3 business days and respond substantively within 30 days. We do not charge for this. We may ask you to confirm your identity before we act, and we will only ask for what is necessary to do so.
10. Marketing
We send The Climate Desk and occasional updates only to people who asked for them. Every email carries an unsubscribe link that works immediately, and you can also unsubscribe by writing to us. Asking us to stop sending marketing does not affect our ability to answer an enquiry you have made.
11. Security
The site is served over HTTPS and we rely on the security controls of the providers named in section 4, each of which is an established service with its own certifications. Access to enquiry records is limited to people who need it. No system is completely secure, and we cannot guarantee absolute security, but if a breach affects your data and is likely to cause you harm we will notify you and the relevant regulator within the timeframes the law requires.
12. Children
This site is intended for business audiences and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to theresa.ronnie@bombaybreed.com and we will delete it.
13. Changes to this policy
When we change this policy we update the date at the top of this page. Where a change materially affects how we use data you have already given us, we will tell you directly before it takes effect. Previous versions are available on request.
14. Language of this notice
This notice is published in English. As provided for by section 5 of the Digital Personal Data Protection Act, 2023, you may request it in Hindi or any other language listed in the Eighth Schedule to the Constitution of India by writing to theresa.ronnie@bombaybreed.com.
15. Governing law
This policy is governed by the laws of India. Nothing in it removes any right you have under the data protection law of the country you live in, or your ability to bring a complaint to your own supervisory authority.