Privacy Policy

Lotus & Dorje ("we", "us", "our") is a data consulting firm. We can be contacted at contact@lotusanddorje.org.

We act as the data controller for personal information collected through this website.

We collect only what is necessary for the purpose stated at the point of collection:

We process your personal data on the following legal bases:

• Legitimate interest — responding to inquiries you initiate via our contact or booking forms.
• Consent — newsletter subscription; you may withdraw consent at any time by emailing us or clicking "unsubscribe".
• Contract performance — processing consultation and service delivery data.

• Responding to contact and consultation requests
• Scheduling and delivering discovery calls and consulting engagements
• Sending the newsletter you subscribed to
• Maintaining the client portal and sharing relevant reports
• Internal CRM and lead management (admin-only, never sold or shared)

• Contact inquiries: retained for 12 months from last interaction, then deleted.
• Consultation records: retained for the duration of the engagement and 3 years thereafter for business records.
• Newsletter subscribers: retained until you unsubscribe; deleted within 30 days of request.
• Session/login data: purged after session expiry.

We use the following sub-processors to operate this platform:

• Base44 — application hosting and database (US-based cloud infrastructure)
• Microsoft Outlook / Azure — email delivery for consultation confirmations and newsletters
• PayPal — payment processing for newsletter subscriptions (we do not receive or store card details)
• ElevenLabs — text-to-speech for the Kamal AI assistant (no personal data is sent; only pre-scripted text)

We do not sell, rent, or share your personal data with any third party for marketing purposes.

This website uses essential session cookies required for authentication and security. We do not currently deploy third-party analytics cookies (e.g. Google Analytics). If this changes, this policy will be updated and your consent will be sought.

Under applicable privacy law (GDPR, PIPEDA, and similar frameworks) you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate data
• Erasure ("right to be forgotten") of your data
• Restriction of processing in certain circumstances
• Data portability in a machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time for consent-based processing (e.g. newsletter)

To exercise any of these rights, email contact@lotusanddorje.org. We will respond within 30 days.

We apply information security controls consistent with ISO 27001 principles, including access control, encryption in transit (TLS), and role-based data access. Only authorised admin users can access personal data collected through this site.

We may update this policy periodically. Material changes will be notified via the newsletter or a banner on this website. The date at the top of this page reflects the most recent revision.