Merstra — Legal
Privacy Policy
Last updated: September 1, 2026
This policy explains what personal data Merstra Foundation collects through merstra.com and our programs, why we collect it, and the choices you have. It applies to visitors, applicants, founders, ecosystem partners and newsletter subscribers.
1 Who we are
Merstra Foundation is a not-for-profit company registered under Section 8 of the Companies Act, 2013 (India), CIN U88900KL2023NPL083098, with its registered office at Aluva, Kerala – 683579, India. For the purposes of applicable data protection law, Merstra Foundation is the data controller for personal data collected through merstra.com.
2 Data we collect
Category
Examples
When collected
Contact details
Name, email, phone, organisation, role
Contact forms, program applications, newsletter signup, Calendly bookings
Program & application data
Startup/venture details, pitch materials, funding stage, market focus
FundReady, FundConnect, Discover, Unlock and other program applications
Communications
Messages sent via forms, email or WhatsApp
Whenever you contact us
Usage data
Pages visited, referral source, device/browser type, approximate location
Automatically, via analytics and cookies
Downloads & resources
Which guides, checklists or templates you request
Lead-magnet downloads (e.g. Fundraise Checklist, Incubation Playbook)
We do not knowingly collect sensitive personal data (health, religion, biometric data, etc.) through the website.
3 How we use your data
• To respond to enquiries and process program or cohort applications
• To deliver programs, consulting engagements and partnership work
• To send the newsletter and program updates you opted into
• To improve the website and understand which content and programs are useful
• To meet legal, regulatory and reporting obligations as a Section 8 non-profit
• To maintain relationships with partners, funders and institutional stakeholders
4 Legal basis for processing
Where the EU/UK GDPR applies (for example, to visitors and partners based in Sweden or elsewhere in Europe), we rely on: your consent (newsletter, marketing cookies), performance of a contract (processing a program application), and our legitimate interests (running and improving merstra.com, maintaining partner relationships). Where India\’s Digital Personal Data Protection Act, 2023 applies, we process data on the basis of your consent or for the specified, legitimate purposes described above.
5 Who we share data with
We do not sell personal data. We share data only with service providers who help us run Merstra, under appropriate confidentiality and data-processing terms, including:
• Email and CRM/nurture tooling
• Productivity and storage infrastructure
• Scheduling and meeting tools
• Website hosting and analytics providers
• Ecosystem partners you explicitly ask us to introduce you to (e.g. incubators, investors) — only with your knowledge
We may also disclose data where required by law, or to protect the rights, safety and property of Merstra, our partners or the public.
6 International data transfers
Because Merstra operates between India and Sweden, personal data may be transferred to and processed in countries outside your own, including India and countries within the European Economic Area. Where required, we rely on appropriate safeguards (such as standard contractual clauses or provider-level protections) to protect data transferred internationally.
7 How long we keep data
We keep personal data only as long as needed for the purpose it was collected — typically for the duration of an active engagement plus a reasonable period afterwards for record-keeping, or until you unsubscribe or ask us to delete it, whichever is applicable and subject to our legal and reporting obligations.
8 Your rights
Depending on where you\’re located, you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; object to or restrict certain processing; withdraw consent at any time (e.g. unsubscribe from the newsletter); and request a copy of your data in a portable format. To exercise any of these rights, contact us at hello@merstra.com. EU-based individuals also have the right to lodge a complaint with their local data protection authority.
9 Cookies
merstra.com uses cookies for essential site functions, analytics and (where consented to) marketing. Full details of what we use and how to manage them are set out in our Cookie Policy.
10 Children\’s privacy
Our website and programs are directed at founders, ecosystem professionals and institutional partners, not children. We do not knowingly collect personal data from anyone under 16.
11 Security
We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss or misuse. No system is completely secure, so we cannot guarantee absolute security of data transmitted to us.
12 Changes to this policy
We may update this policy as our website, programs or legal obligations evolve. Material changes will be reflected by updating the “Last updated” date above. We encourage you to review this page periodically.
13. Contact
Merstra Foundation
Email: hello@merstra.com · Phone: +91 8608871834
