Last updated: 2 November 2026
This website, onestoconsultancy.com, is operated by Onesto Management Consultancy (referred to in this policy as “Onesto,” “we,” “us” or “our”), a boutique consultancy headquartered in Bilbao, Spain, with a corporate office in New Delhi, India, and working presence in Mumbai, Bangalore and Hyderabad. Onesto helps companies move between the Indian and European markets: market entry, trade and sourcing, legal and regulatory work through Onesto Legal, and related services through Onesto Agri, Social Dexters and our other ventures.
PLACEHOLDER Our full registered legal entity name, company registration number and registered office address should be added here, since this is normally a legal requirement for a privacy policy in both the EU and India.
This policy explains what personal data we collect when you visit this website, get in touch with us (by form, email or WhatsApp), download one of our guides, apply for a role with us, or otherwise interact with Onesto, why we collect it, who we share it with, and what rights you have over it. It applies to onestoconsultancy.com and its pages, including the pages for our sub-brands (India Desk, Europe Desk, Onesto Legal, Onesto Agri, Social Dexters).
It does not cover third-party websites we link to, including partner and association websites, or third-party platforms such as LinkedIn, Instagram or WhatsApp, which have their own privacy policies.
We collect personal data directly from you when you use this website. We do not buy personal data from third parties or scrape it from other sources.
| When | What we collect |
|---|---|
| Contact form | Full name, company name, work email address, country, the type of enquiry, your preferred timeline (optional), and anything you write in the message field (optional) |
| Newsletter sign-up | Email address |
| Guide downloads | Name and email address, so we can send you the guide and, where you've agreed, occasional related updates |
| Job applications | Name, contact details, CV/resume and any other information you choose to include in your application |
| Your phone number and the content of any messages you send us, handled through WhatsApp's own platform (operated by Meta) | |
| General browsing | Standard technical data such as IP address, browser type, device type, pages visited and referring page, typically collected via cookies or server logs |
We do not knowingly collect any special category data (such as health, religion or ethnicity), and we ask that you don't include this kind of information in free-text fields like the enquiry brief or your CV unless it's clearly relevant and necessary, for example, an accessibility requirement for a job application.
We use personal data to:
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.
Where the GDPR applies (broadly, whenever we're processing personal data of people in the EU/EEA, or processing carried out from our Spain office), we rely on one or more of the following legal bases:
Where the Indian DPDP Act 2023 applies, we process personal data on the basis of your consent, or for other purposes the Act permits without consent, such as taking steps in response to a request you've made to us.
This website uses a small number of cookies and similar technologies to function properly and to remember your preferences, such as your choice of language (English or Spanish).
Some pages on this site load fonts directly from Google Fonts' servers. Loading a font this way means your browser makes a request to Google, which can involve your IP address being visible to Google as part of that request. We don't control what Google does with that data beyond serving the font.
PLACEHOLDER If we add analytics tools (such as Google Analytics), advertising pixels, or other third-party tracking scripts to the site, they need to be listed here individually, along with a cookie consent banner if required under Spanish/EU law (the ePrivacy rules generally require consent before non-essential cookies are set).
We don't sell your personal data. We share it only where it's needed to run the business or deliver what you've asked for:
PLACEHOLDER Name any specific third-party processors here once confirmed (for example, your email service provider, hosting company, or CRM), since GDPR generally expects these to be identified or at least categorised clearly.
Because Onesto operates across both Spain and India, personal data you share with us may be transferred between the EU and India, for example when a European enquiry is handled by our Delhi team, or vice versa. India does not currently have a European Commission adequacy decision, so transfers from the EU to India are managed using appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
PLACEHOLDER This section should be reviewed with a lawyer to confirm exactly which transfer mechanism is actually in place internally, rather than the general description above.
We keep personal data only for as long as it's needed for the purpose it was collected for, plus any period required by law, for example, Spanish and Indian tax and accounting rules.
PLACEHOLDER Specific retention periods should be confirmed and listed here, for example how long enquiry data, newsletter subscriptions, and job applications are each kept before being deleted or anonymised. A reasonable starting point many firms use is no longer than 24 to 36 months of inactivity, but this should be a deliberate decision rather than a default.
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including restricting who inside Onesto can access enquiry and application data. No method of transmission or storage is completely secure, and we can't guarantee absolute security, but we treat any suspected data breach seriously and will act, and notify affected individuals and regulators, where required by law.
If you're in the EU/EEA, the UK, or another jurisdiction with similar protections, you generally have the right to:
If you're in India, the Digital Personal Data Protection Act 2023 gives you broadly similar rights: to access information about how your data is processed, to correction and erasure, to nominate someone to exercise your rights if you're unable to, and to grievance redressal, including with the Data Protection Board of India once it is operational.
To exercise any of these rights, contact us using the details in section 14. We'll respond within the timeframe required by applicable law.
This website and our services are directed at businesses and professionals, not children. We don't knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we'll delete it.
We may update this policy from time to time, for example as our services, tools or legal obligations change. We'll update the “last updated” date at the top of this page when we do. For significant changes, we may also highlight them more prominently on the site.
If you have questions about this policy, or want to exercise any of your rights, contact us at connect@onestoconsultancy.com.
PLACEHOLDER If a formal Data Protection Officer or EU representative has been appointed, their name and contact details should be added here. If not, it's worth confirming whether one is legally required given the scale of data Onesto processes.