Privacy Policy
This policy explains what information Velko collects, why we collect it, how we store and share it, and the rights you have over it. It applies to velko.agency and to any engagement where Velko provides services to you as a client.
01 Who we are
Velko is a community operations and growth marketing studio, operated by Mwikhwm Basumatary as a sole proprietorship based in Assam, India. In this policy, "Velko", "we", "us", and "our" refer to that entity. The website you are reading this on is velko.agency.
For privacy questions, data access requests, or anything else covered in this document, write to hello@velko.agency.
02 What we collect
Information you give us directly
- Contact form: when you fill out the contact form on velko.agency, we receive your name, email address, the service you selected, and the message you wrote.
- Newsletter signup: when you subscribe to the newsletter, we receive your email address.
- Booking a call: when you book a call through the Calendly widget, we receive your name, email, the time you selected, and any details you wrote in the booking notes.
- Client engagement: if you become a client, we may collect additional information needed to deliver the work: brand assets, community goals, audit logs, billing details, and any operational data you share with us.
Information collected automatically
- Server and CDN logs: when you visit velko.agency, your browser sends standard information including IP address, user agent, the page you requested, and referring URL. This is logged by our hosting provider and by content delivery networks (Cloudflare) that serve assets like fonts and scripts.
- Cookies and similar technologies: certain embedded tools (Calendly, Kit) set cookies in your browser. See our Cookie Policy for the full list and what each one does.
What we do not collect
Velko does not run any analytics platform (no Google Analytics, no Meta Pixel, no PostHog, no Mixpanel, no session recorders). We do not build behavioural profiles of visitors and we do not sell or rent personal information to anyone.
03 Why we collect it
- To respond to you when you contact us, request a quote, or book a call.
- To deliver services to clients under a signed agreement.
- To send you the newsletter if you subscribed, and to honour your unsubscribe whenever you make it.
- To keep the site secure and working by reviewing server logs for abuse, errors, and outages.
- To meet our legal obligations including tax records and any lawful request from authorities with jurisdiction.
04 Legal basis for processing
Where the laws of India apply, we process personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), primarily on the basis of your consent and to perform contracts you have entered with us.
Where the European Union's General Data Protection Regulation ("GDPR") applies because you are in the EU or UK, we rely on one of the following lawful bases depending on the activity: your consent (newsletter, optional cookies), contract (delivering services you engaged us for), legitimate interest (responding to inquiries you initiated, keeping the site secure), or legal obligation (tax, accounting).
05 Who else processes your data
We use a small number of third-party services to run the site and operate the business. Each one is named below with what they do and a link to their own privacy documentation.
| Service | What it does | Their policy |
|---|---|---|
| Formspree | Processes contact-form submissions and forwards them to our inbox. | formspree.io |
| Kit (formerly ConvertKit) | Stores newsletter subscriber lists and delivers email campaigns. | kit.com |
| Calendly | Embedded scheduling widget; stores booking details and sends invitations. | calendly.com |
| Cloudflare | Content delivery network for fonts, icons, and animation libraries; provides DDoS protection. | cloudflare.com |
| Google Fonts | Serves the web fonts used on the site. May log your IP address as part of font delivery. | google.com |
| PayPal / stablecoin networks | Used for client billing only. We only see what the payment processor shows us (sender name, transaction reference, amount). | paypal.com |
We only share information with these processors as needed for them to perform their function, and we do not authorise them to use your data for their own marketing.
06 International transfers
Velko is based in India. Several of the processors named above are based in the United States or have global infrastructure. When your data is transferred outside your country of residence, it is protected by the processor's own contractual safeguards (Standard Contractual Clauses, where applicable) and by their published privacy programme. By using the site or engaging us, you understand that your information may be processed in jurisdictions other than your own.
07 How long we keep it
- Contact form messages: kept for up to 24 months from the date of the last reply, then deleted unless you became a client.
- Newsletter subscribers: kept until you unsubscribe. You can unsubscribe from any email we send.
- Booking records: kept inside Calendly per their retention; deleted on request.
- Client records: kept for the duration of the engagement plus 7 years afterwards, primarily for Indian tax and accounting requirements.
- Server and CDN logs: rotated and discarded on the timescales set by the relevant provider, usually 30 to 90 days.
08 Your rights
You have rights over your personal data, and we honour them regardless of where you live. Specifically you can:
- Access the personal data we hold about you.
- Correct anything inaccurate or out of date.
- Delete your data, subject to records we are legally required to keep.
- Withdraw consent at any time for any processing that depends on consent (for example, the newsletter).
- Object to processing based on legitimate interest and ask us to explain or stop it.
- Port your data, where technically reasonable, to another service.
- Complain to a supervisory authority if you believe we have mishandled your data. In India that is the Data Protection Board under the DPDP Act. In the EU or UK, that is your national data protection authority.
To exercise any of these rights, email hello@velko.agency from the address associated with the data. We respond within 30 days.
09 Children
Velko's services are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us information, write to us and we will remove it.
10 Security
We take reasonable technical and organisational measures to protect personal data, including encrypted connections (HTTPS), restricted access to client systems, and storage of credentials in a password manager rather than in plain text. No system is ever fully secure; if we ever discover a breach that affects your personal data, we will notify you and the relevant authorities as required by applicable law.
11 Changes to this policy
We may update this policy as the site evolves, as we add or remove tools, or as the law changes. Material changes will be notified by updating the "Last updated" date at the top of this page and, where appropriate, by emailing affected users.