Privacy Policy
Your information, handled with care and transparency.
Effective Date: [Insert Date] | Last Updated: [Insert Date]
PRIVACY POLICY
We (hereinafter ‘the Company’) recognize the protection of personal data as an important responsibility and handle personal data appropriately in accordance with the Digital Personal Data Protection Act, 2023 (‘DPDP Act’) and other applicable laws.
This Privacy Policy explains what personal data the Company collects, how it is used, and how it is protected when you use our website (‘the Website’).
1. Data Fiduciary
Data Fiduciary
The Data Fiduciary under this Policy is as follows:
Company Name: [Insert Company Name]
Address: [Insert Address]
Email: [Insert Email Address]
Phone: [Insert Phone Number]
Note: If the Website is operated on behalf of a client under a service agreement, the client (principal) shall be the Data Fiduciary. In that case, insert the client’s information here and document the Company’s role as Data Processor in a written agreement.
2. Personal Data We Collect
(a) Data provided directly by you
• Full name
• Email address
• Phone number
• Company name
• Enquiry content / messages
(b) Data collected automatically
• IP address
• Browser type and version
• Access date/time and pages visited
• Data collected through cookies and similar technologies
3. Purpose of Use and Legal Basis
The Company uses collected personal data for the following purposes. The legal basis for each processing activity is indicated below.
Responding to enquiries → Basis: Consent
Operating and improving the Website → Basis: Legitimate Uses
Compliance with legal obligations → Basis: Legitimate Uses
Ensuring security and preventing misuse → Basis: Legitimate Uses
The Company will not use personal data beyond the stated purposes. Where a change of purpose occurs, prior consent will be obtained. The Company shall not sell/share any personal information, volunteered on the website to any third party (public/private). Any information provided on the website will be protected from loss, misuse, unauthorised access, alteration or destruction.
4. How We Obtain Consent
In accordance with the DPDP Act, the Company will obtain consent from users before collecting personal data. Consent will meet all of the following requirements:
• Consent must be free, specific, informed, unconditional, and unambiguous
• A standalone notice — separate from the Privacy Policy — clearly stating the data collected, purpose, and retention period must be displayed before form submission
• Checkboxes must not be pre-ticked (consent requires active, affirmative action)
• The notice must clearly state that consent is voluntary
• A mechanism to withdraw consent must be provided within the notice and near the submission area
• Records of when, by whom, and for what consent was given must be maintained server-side
Withdrawal of consent is effective prospectively only and does not affect the lawfulness of processing carried out prior to withdrawal. To withdraw consent, please contact us using the details in Section 13.
5. Disclosure to Third Parties
The Company will not disclose personal data to third parties except in the following circumstances:
• Where the user has given prior consent
• Where disclosure is required by applicable law (e.g., requests from government authorities or courts)
• Where disclosure to a Data Processor is necessary for service delivery, subject to a written agreement
Data Processors will process personal data solely within the scope of the Company’s instructions and in compliance with the DPDP Act.
6. Cross-Border Data Transfers
The Company may use servers or service providers located outside India in the operation of the Website, which may result in personal data being transferred outside India.
The Company will transfer data only to countries or regions permitted under applicable Indian law or where adequate protection measures are in place, ensuring a level of protection equivalent to the DPDP Act.
Note: The Government of India’s negative list of restricted countries for cross-border transfers is pending publication. This clause should be reviewed once the list is notified.
7. Data Retention
The Company retains personal data for the period necessary to fulfill the stated purpose or as required by law.
• Enquiry data: up to 1 year after the enquiry is resolved
• Consent records: up to 7 years from the date of consent (per DPDP Rules 2025)
• Access logs: up to 1 year from the date of collection
Upon expiry of the retention period, personal data will be securely deleted or anonymized. Where applicable, users will be notified at least 48 hours before deletion.
8. Your Rights
Under the DPDP Act, you have the following rights. The Company will respond within 30 days (and no later than 90 days) of receiving a request.
(a) Right of Access
The right to obtain confirmation of whether your personal data is being processed, and to access that data.
(b) Right to Correction and Completion
The right to request correction of inaccurate or incomplete personal data.
(c) Right to Erasure
The right to request erasure of personal data where the purpose of processing is fulfilled or consent is withdrawn, unless retention is required by law.
(d) Right to Withdraw Consent
Where processing is based on consent, the right to withdraw that consent at any time.
(e) Right to Lodge a Complaint
The right to lodge a complaint with the Data Protection Board of India (DPBI) if you are dissatisfied with the Company’s data processing practices.
(f) Right to Know How data is used:
Right to know on what personal data has been collected, why it has been collected and how it is being used.
(g) Right to update personal data
Right to update any personal data, in case of any change.
(h) Right to nominate Another Person
Right to appoint someone, to exercise their data on their behalf.
(i) Protection during Personal Data Breach
In case of breach, you will be informed at the earliest, as to what happened, possible impact and steps taken to address the same.
9. Personal Data of Minors or Persons with Disability
The Website is not directed at persons under the age of 18 or persons with disability who are unable to make legal decisions. The Company does not knowingly collect personal data from such persons. Where it comes to the Company’s attention that personal data of such persons has been collected, such data will be deleted promptly.Consent of such persons shall be given by verifiable guardians only.
10. Security
The Company implements the following technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or loss:
• SSL (Secure Socket Layer) encryption for data transmission
• Access controls and authentication management
• Regular security audits
• Prompt notification of personal data breaches to affected users and the DPBI
11. Cookies
The Website uses cookies and similar technologies. Please refer to our Cookie Policy for details on the types of cookies used, their purposes, and how to manage them.
12. Updates to This Policy
The Company may update this Privacy Policy from time to time to reflect changes in law or operations. Material changes will be notified via the Website. The updated Policy takes effect upon publication.
13. Contact Us
For questions about this Privacy Policy, to withdraw consent, or to submit a data-related request, please contact:
Contact: Personal Data Protection Contact
Email: [Insert Email Address]
Address: [Insert Address]
This Policy has been prepared in accordance with the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. The substantive obligations come into full force on 14 May 2027. This Policy should be reviewed periodically in line with regulatory developments. Legal review by a qualified professional is recommended.