Effective date: [DATE] Last updated: [DATE]
1. Who we are
Who's Legacy is a digital publication documenting founders, entrepreneurs and builders. It is published by [FAZINFLO LEGAL ENTITY NAME], a [private limited company / LLP / sole proprietorship] registered in [COUNTRY] under registration number [NUMBER], with its registered office at [FULL REGISTERED ADDRESS].
In this policy, "we", "us" and "our" mean that entity. "You" means anyone whose personal information we handle — readers, applicants, subscribers, interviewees, and the people we write about.
We are the data controller (under UK and EU data protection law) and the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) for the personal information described here.
How to reach us about privacy
| Privacy enquiries | [privacy@whoslegacy.com] |
| Postal address | [FULL ADDRESS] |
| Grievance Officer (India) | [NAME], [grievance@whoslegacy.com] |
| EU / UK representative | [NAME AND ADDRESS, or "Not applicable"] |
| Data Protection Officer | [NAME, or "We are not required to appoint a DPO"] |
2. A note on how a publication handles data
Most privacy policies describe one relationship: a company and its customers. A publication has two, and they work differently.
If you interact with us — you apply for a profile, subscribe to updates, or simply read the site — we handle your information the way any business does, and you have the full set of rights described in Section 13.
If we write about you — as the subject of a profile, or because you are mentioned in someone else's story — we are processing your information for journalistic purposes. Data protection law in most countries deliberately limits some individual rights in that context, so that publications can report and maintain archives. Section 14 explains exactly where those limits fall and what we still do for you regardless.
We have tried to be straight about this rather than bury it.
3. What we collect
3.1 Information you give us directly
When you apply for early access or a profile, our form asks for:
- Your name
- Your business name
- Your industry
- Your work email address
- Your business website
- A social media link
- Your answer to "What are you building right now?"
When you subscribe to updates, we collect your email address.
If you are selected and take part in a profile, we collect considerably more:
- Audio and video recordings of your interview, which typically runs at least one hour
- Transcripts generated from those recordings
- Photographs of you, taken by us or supplied by you
- Biographical and company information — founding dates, locations, team size, milestones, figures you choose to share
- Documents, images, logos and other materials you send us
- Your answers to the Legacy Questions
- Your feedback and correspondence during the review process
If you pay for a profile, our payment provider collects your payment details. We receive confirmation of payment, the amount, the date, and limited billing information. We never see or store your full card number.
If you contact us — by email, through a form, or on social media — we keep that correspondence and any information in it.
3.2 Information about other people that you give us
If you nominate someone, name a co-founder, mention an employee, or send us photographs containing other people, you are giving us their personal information as well as your own.
By doing so you confirm that you are entitled to share it with us. Where the law requires it, we will contact the person concerned to tell them we hold information about them and why. If you would rather we did not name someone, tell us before the interview.
3.3 Information we collect automatically
When you visit whoslegacy.com we automatically receive:
- Your IP address and approximate location derived from it
- Browser type and version, operating system, device type and screen size
- The pages you visited, how long you stayed, and what you clicked
- The page or search that referred you
- Date and time stamps
- Error and diagnostic data
We also use cookies and similar technologies — see Section 8.
If you receive our emails, we may record whether you opened them and which links you clicked, so we know what is worth sending.
3.4 Information from other sources
For editorial work we research subjects using publicly available sources, including company registries and filings, published interviews and news coverage, public social media profiles, company websites, press releases, and public funding databases.
We may also receive information about you from someone who nominates you, or from a mutual contact who introduces us.
3.5 What we do not collect
We do not knowingly collect special category data — information about health, race or ethnicity, religion, sexual orientation, political opinions, trade union membership, genetic or biometric data — unless you volunteer it in an interview because it is part of your story. If you do, we treat it as told to us for publication, and we will confirm with you before printing anything in that category.
We do not collect financial account details beyond what our payment processor needs, and we do not buy personal data from data brokers.
4. Why we use your information, and our legal basis
Where UK or EU law applies, we must have a lawful basis for every use. Here they are, purpose by purpose.
| What we do | Information used | Our lawful basis |
|---|---|---|
| Review your application and decide whether to approach you | Application form data | Legitimate interests — assessing candidates for the publication. Also steps prior to a contract where you have asked to be considered for a paid or free profile. |
| Contact you about your application | Name, email | Legitimate interests; pre-contractual steps |
| Research, write, fact-check and edit profiles | Everything in 3.1, 3.4 | Legitimate interests in journalism and freedom of expression, supported by the journalism exemption (Section 14) |
| Record and transcribe interviews | Audio, video, transcripts | Consent, which you give before recording begins and can withdraw (Section 5) |
| Publish and archive profiles | Published content | Legitimate interests in journalism; journalistic purposes exemption |
| Produce photography and design | Photographs, materials | Consent for the session; legitimate interests for editorial use |
| Deliver and support a paid profile | Contact and order data | Performance of a contract |
| Take payment and keep accounts | Billing data | Contract; legal obligation (tax and accounting) |
| Send the newsletter | Email address | Consent, withdrawable at any time |
| Operate, secure and improve the website | Log and analytics data | Legitimate interests in security and understanding what readers use; consent for non-essential cookies |
| Respond to your enquiries | Correspondence | Legitimate interests |
| Meet legal obligations and defend legal claims | As needed | Legal obligation; legitimate interests in establishing or defending claims |
Where we rely on legitimate interests, we have weighed our interest against your rights. You can object — see Section 13 — and we will stop unless we have compelling grounds to continue, which in practice usually means the material has already been published.
Under India's DPDP Act we process personal data on the basis of consent, or for certain legitimate uses permitted by the Act, and we give a separate consent notice in English and in [LANGUAGE(S)] at the point of collection.
5. Interviews and recordings
This deserves its own section, because a recorded interview is the most personal thing we hold about anyone.
We tell you before we record. You will know that the session is being recorded, in what format, and roughly how it will be used, before recording starts.
What we do with a recording. We transcribe it, quote from it in your profile, use it to check facts, and keep it as proof of what was said. We may use short clips in promotional material for the publication only if you have separately agreed to that.
What we do not do. We do not publish full raw recordings, sell them, or share them with anyone outside our editorial team and the contractors who transcribe them, who are bound by confidentiality.
You can ask for a copy of your own recording and transcript at any time.
You can withdraw consent to recording, and we will stop. If you withdraw after the interview, we will stop using the recording for new purposes, but we may keep it — see the next paragraph.
Why we keep recordings after publication. If a published statement is ever disputed, the recording is our evidence that you said it. We therefore retain interview recordings for [RETENTION PERIOD, e.g. six years] after publication for the purpose of establishing or defending legal claims, even if you ask us to delete other information. This is a recognised and lawful reason to keep material, and we keep it locked down and unused in the meantime.
Off the record. If you want something excluded, say so during the interview and we will honour it. We cannot retroactively unhear something you said on the record, but in practice we will always discuss it with you.
6. Published profiles
Once your profile is published, it becomes a public editorial work. Three consequences follow, and you should understand them before you take part.
It is public. Anyone can read it. Search engines will index it. Others may quote, link to, screenshot or archive it, and we cannot control that.
It is permanent. Who's Legacy exists to be a lasting record. We keep published profiles in our archive indefinitely, as newspapers and magazines do. Removal is an exception, not a right — Section 14 explains when we will consider it.
It is ours to edit and reuse. Within the terms you agreed, we may excerpt your profile, translate it, collect it into an issue, quote it in promotion, and produce it in print.
What we will always do: correct anything factually wrong, promptly and visibly. What we will not do: remove a profile simply because you have changed your mind about having been in it, or because it has become commercially inconvenient.
7. Children and young people
Who's Legacy documents young founders, and some of them are very young. We take this seriously.
Using the site. The website and the application form are intended for people aged 18 and over. If you are under 18, do not submit an application without a parent or guardian doing it with you.
Being profiled under 18. If a subject is under 18 — or under the age of majority where they live — we will not interview, photograph, record or publish them without verifiable consent from a parent or legal guardian, given in writing before anything begins. The parent or guardian may withdraw that consent, and may ask us to remove a published profile of their child, which we will do.
Tracking. We do not carry out behavioural tracking or targeted advertising directed at children, and we do not use children's personal data for advertising purposes. Where India's DPDP Act applies, this is a legal prohibition and we comply with it.
If we get it wrong. If you believe we hold information about a child without proper consent, contact [privacy@whoslegacy.com] and we will delete it promptly.
8. Cookies and similar technologies
| Type | What it does | Do we need your consent? |
|---|---|---|
| Strictly necessary | Keeps the site working — security, load balancing, remembering your cookie choices, processing form submissions | No |
| Analytics | Tells us which pages are read, how people arrive, where they leave | Yes |
| Preference | Remembers choices such as magazine or article reading view | Yes, where not strictly necessary |
| Marketing | [We do not currently use marketing or advertising cookies. / We use the following: LIST] | Yes |
Our providers: [LIST — e.g. Vercel Analytics, Plausible, Google Analytics 4, Meta Pixel].
You can accept or reject non-essential cookies through our cookie banner, and change your mind at any time via [link to cookie settings]. You can also block cookies in your browser, though parts of the site may stop working properly.
We [do / do not] respond to Global Privacy Control and "Do Not Track" browser signals. Where the law requires us to treat GPC as an opt-out of sale or sharing, we do.
9. Who we share information with
We do not sell your personal information. We do not share it for cross-context behavioural advertising. We share it only as follows.
Service providers who process data on our instructions under written contracts:
| Purpose | Provider | Where |
|---|---|---|
| Website hosting and delivery | [e.g. Vercel] | [US/EU] |
| Email delivery and newsletter | [e.g. Resend] | [US] |
| Form handling | [PROVIDER] | [REGION] |
| Analytics | [PROVIDER] | [REGION] |
| Payments | [e.g. Stripe / Razorpay] | [REGION] |
| File storage and backup | [PROVIDER] | [REGION] |
| Interview transcription | [PROVIDER] | [REGION] |
| Scheduling and video calls | [PROVIDER] | [REGION] |
| Customer email and support | [PROVIDER] | [REGION] |
Editorial contractors — writers, photographers, editors, designers and fact-checkers — who are bound by confidentiality obligations and may only use what we give them for your profile.
Professional advisers — lawyers, accountants, insurers and auditors, where they need it.
Authorities and legal process — where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims. We will tell you unless we are prohibited from doing so.
A buyer or successor — if the publication is sold, merged or restructured, information transfers with it, subject to this policy.
The public — everything in your published profile.
10. Sending information across borders
We operate from [COUNTRY] and several of our providers are in the United States and the European Economic Area, so your information will cross borders.
Where we transfer personal data out of the UK or EEA, we rely on:
- Adequacy decisions, where the destination country has one; or
- Standard Contractual Clauses approved by the European Commission, together with the UK Addendum or International Data Transfer Agreement; and
- A transfer risk assessment plus additional safeguards such as encryption in transit and at rest.
Where India's DPDP Act applies, we transfer personal data only to countries not restricted by the Central Government.
You may request a copy of the safeguards we use by emailing [privacy@whoslegacy.com].
11. How long we keep things
| What | How long |
|---|---|
| Unsuccessful applications | [12 months] from the decision, then deleted |
| Successful applications | Duration of the relationship plus [6 years] |
| Newsletter subscribers | Until you unsubscribe, then a suppression record kept indefinitely so we do not email you again by mistake |
| Interview recordings and transcripts | [6 years] after publication (see Section 5) |
| Photographs — unused frames | [24 months] after the shoot |
| Photographs — published | Indefinitely, as part of the archive |
| Published profiles | Indefinitely — this is an archive |
| Payment and accounting records | [8 years], or as required by tax law in [COUNTRY] |
| Correspondence | [3 years] from the last message |
| Server and security logs | [90 days] |
| Analytics data | [14 months] |
| Cookie consent records | [12 months] |
Where a specific period is not listed, we keep information only as long as we need it for the purpose we collected it for, plus any period required by law.
12. How we protect information
We use encryption in transit (TLS) and at rest for stored files; access controls so that only people who need information can reach it; multi-factor authentication on our systems; written confidentiality terms with every contractor; regular backups; and a documented process for handling breaches.
If a breach happens, we will notify the relevant regulator within the time the law requires — 72 hours under UK and EU law, and as prescribed under the DPDP Rules in India — and we will tell you directly if the breach is likely to result in a high risk to your rights.
No system is perfectly secure, and we cannot guarantee the security of information you send us over the internet.
13. Your rights
Subject to the journalism limits in Section 14, you can ask us to:
- Give you a copy of the personal information we hold about you
- Correct anything inaccurate or incomplete
- Delete information where we no longer have a good reason to hold it
- Restrict what we do with it while a dispute is resolved
- Transfer it to you or another provider in a portable format
- Stop processing based on legitimate interests, including any direct marketing — we will always stop marketing, no questions asked
- Withdraw consent you previously gave, without affecting what we did before you withdrew
- Not be subject to purely automated decisions with legal or similarly significant effects — we do not make any
How to exercise them. Email [privacy@whoslegacy.com]. We may ask for proof of identity. We will respond within 30 days (India), one month (UK/EU, extendable by two months for complex requests), or 45 days (California, extendable once). It is free unless a request is manifestly unfounded or excessive.
If you are in the EEA or UK, you may complain to your national data protection authority; in the UK that is the Information Commissioner's Office (ico.org.uk). You do not have to come to us first, though we would like the chance to fix it.
If you are in India, please contact our Grievance Officer at [grievance@whoslegacy.com] first. If you are not satisfied, you may complain to the Data Protection Board of India. You also have a duty under the DPDP Act not to file false or frivolous complaints.
If you are in California, you have the rights to know, delete, correct, and opt out of sale or sharing, and not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. You may use an authorised agent.
If you are elsewhere, tell us where you are and we will apply whatever local rights are stronger.
14. Where journalism limits these rights
This is the section most publications leave vague. We would rather be clear.
Data protection law in the UK, the EU and India contains exemptions for processing carried out for journalistic purposes, so that reporting and archives are possible at all. We rely on those exemptions — the "special purposes" exemption in UK and EU law, and the corresponding provisions of India's DPDP Act — but only where relying on them is genuinely necessary for publication.
In practice this means:
| You ask us to | What happens |
|---|---|
| Correct a factual error | We always act. Tell us and we will check it and correct it, usually within days, with a visible correction note where the change is material. |
| Delete a published profile | We will consider it seriously, but the archive is the point of this publication and we will usually decline. We will always delete where publication is unlawful, where consent for a subject who was a child has been withdrawn by their parent, or where leaving it up would put someone at genuine risk of harm. |
| Access material before publication | We may decline to disclose pre-publication research, unpublished drafts, and our sources, where disclosing them would compromise the work. |
| Object to being written about | Tell us. We will weigh your objection against the public interest in the story. We will always tell you our decision and our reasoning. |
| Stop us contacting you | We stop immediately. |
What we never do: use the journalism exemption to avoid fixing something we got wrong, or to avoid answering you at all.
If you want a profile reconsidered, write to [editor@whoslegacy.com] with the specifics. A person, not a form, will read it.
15. Third-party links
Our site links to company websites, social profiles and other publications. We are not responsible for their privacy practices. Read their policies before giving them your information.
16. Changes to this policy
We will update this policy as the publication grows. When we make a material change, we will update the date at the top, and we will tell subscribers and anyone with an active profile by email before it takes effect. Previous versions are available on request.
17. Contact
| Privacy | [privacy@whoslegacy.com] |
| Editorial and corrections | [editor@whoslegacy.com] |
| Grievance Officer (India) | [NAME] — [grievance@whoslegacy.com] |
| Post | [FULL REGISTERED ADDRESS] |
Who's Legacy is a Fazinflo publication.