Privacy Policy

1. Who this policy applies to

This policy applies to personal data of individuals who visit the Website, send us enquiries, book consultations, attend our webinars or workshops, subscribe to our communications, apply for jobs with us, or who are clients, prospective clients, vendors or representatives of those organisations.

This policy does not apply to anonymised data, or to personal data that a client shares with us to process on the client's behalf as part of an engagement. In that case the client is the Data Fiduciary, and we process that data as a Data Processor under the terms of our contract with the client.

2. Personal data we collect

We collect only the personal data we need for the purposes described in Section 3.

Payment details. We do not accept payments through the Website. Invoices are settled directly by bank transfer or other methods agreed with you, and we retain only the payment records we need for accounting and tax purposes.

Sensitive personal data. Under the SPDI Rules, passwords, financial information such as bank account or card details, physical, physiological and mental health conditions, sexual orientation, medical records and biometric information are "sensitive personal data or information". We do not seek such information through the Website. If we need any of it (for example, bank details to process a refund), we will collect it only with your consent and use it only for that stated purpose. Please do not share such information with us unless we specifically request it.

3. Why we use your personal data

We will not use your personal data for a purpose that is materially different from those listed above without informing you and, where required, obtaining your consent. We do not sell or rent your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects for you.

4. Consent and withdrawal of consent

Where processing is based on consent, your consent will be free, specific, informed, unconditional and unambiguous, and limited to the personal data necessary for the stated purpose.

You may withdraw your consent at any time, as easily as you gave it, by:

• clicking the "unsubscribe" link in any marketing email we send you; or
• writing to apjadvisory@gmail.com.

Once you withdraw consent, we will stop processing the relevant personal data, and cause our Data Processors to stop, within a reasonable time, unless its continued retention is required or permitted by law. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If you withdraw consent for processing that is needed to provide a service, we may be unable to continue providing that service.

5. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. We currently use only:

• Strictly necessary cookies, which enable core functions such as page navigation, security and remembering your choices. The Website cannot function properly without them.

We do not currently use analytics or marketing cookies. If this changes, we will update this Privacy Policy accordingly and, where required, seek your consent before any such cookies are set. You can block or delete cookies at any time through your browser settings, although some parts of the Website may then not work as intended.

6. Who we share personal data with

We share personal data only where necessary for the purposes described in this policy, and only with:

• Service providers acting as our Data Processors, such as website hosting, email, customer relationship management, cloud storage, video conferencing and accounting providers. They process personal data on our instructions under written contracts that require them to protect it.
• Associate consultants and subcontractors engaged on your project, who are bound by confidentiality obligations.
• Professional advisers, including lawyers, chartered accountants and auditors, where necessary.
• Government authorities, regulators, law enforcement agencies and courts, where we are required to do so by law or by a lawful order.
• A prospective buyer, investor or successor in connection with a merger, acquisition, restructuring or sale of our business, subject to confidentiality obligations and this policy.
• Any other party, with your consent.

7. Transfers outside India

Some of our service providers may store or process personal data on servers located outside India. We transfer personal data outside India only in accordance with Section 16 of the DPDP Act, and not to any country or territory restricted by the Central Government. Where we make such transfers, we require our service providers to protect your personal data to the standards described in this policy.

8. How long we keep personal data

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or for longer where required by law. In general:

• enquiries that do not lead to an engagement are kept for 24 months from our last interaction;
• client and engagement records are kept for the duration of the engagement and thereafter for the periods required under applicable accounting, tax and company laws, which may extend up to eight years;
• marketing data is kept until you unsubscribe or withdraw consent.

Where the DPDP Rules require it, we retain personal data, associated traffic data and processing logs for a minimum of one year from the date of processing. When personal data is no longer required, we securely erase or anonymise it.

9. How we protect personal data

We implement reasonable security safeguards to protect personal data against unauthorised access, use, disclosure, alteration and loss, as required by the DPDP Act and DPDP Rules. These include:

• encryption of data in transit (HTTPS) and, where appropriate, at rest;
• access controls, including role-based access and multi-factor authentication for our systems;
• logging and monitoring of access to personal data to detect and address unauthorised access;
• regular backups to ensure continuity;
• contractual security obligations for our Data Processors; and
• confidentiality commitments and data protection awareness for our team.

While we take these measures seriously, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Personal data breaches

If a personal data breach affects your personal data, we will inform you without delay, in clear and plain language, describing the nature and extent of the breach, its likely consequences, the measures we have taken or are taking, the steps you can take to protect yourself, and how to contact us. We will also report the breach to the Data Protection Board of India in the manner and within the timelines required by the DPDP Rules.

11. Your rights

Subject to applicable law, you have the right to:

• Access information: obtain a summary of the personal data we process about you and the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom we have shared it, along with a description of the personal data shared.
• Correction, completion and updating: ask us to correct inaccurate or misleading personal data, complete incomplete data, or update it.
• Erasure: ask us to erase personal data that is no longer necessary for the purpose for which it was processed, unless retention is required for compliance with law.
• Withdraw consent at any time, as described in Section 4.
• Grievance redressal: have your grievances about our processing of your personal data addressed, as described in Section 12.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

How to exercise your rights. Write to apjadvisory@gmail.com with the subject line "Data Principal Request", stating your name, contact details and the right you wish to exercise. We may ask for information to verify your identity before acting on your request. We will respond within 30 days of receiving a verified request.

Your duties. Under Section 15 of the DPDP Act, you must provide authentic information, must not impersonate another person, and must not register false or frivolous grievances or complaints.

12. Grievance Officer and complaints

In accordance with the DPDP Act, the DPDP Rules and the SPDI Rules, we have appointed a Grievance Officer who can also answer questions about our processing of your personal data:

We will acknowledge your grievance within 48 hours and resolve it within 30 days of receipt. If you are not satisfied with our response, you may, after exhausting this grievance redressal mechanism, file a complaint with the Data Protection Board of India.

13. Children's personal data

Our Website and services are intended for businesses and adults and are not directed at individuals under 18 years of age. We do not knowingly process the personal data of a child without the verifiable consent of their parent or lawful guardian, as required by Section 9 of the DPDP Act. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Third-party websites and platforms

The Website may link to third-party websites and platforms, including social media pages such as LinkedIn, Instagram, Facebook and YouTube. Their handling of your personal data is governed by their own privacy policies, and we are not responsible for their practices.

15. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or in applicable law. The updated version will be posted on this page with a revised "Last updated" date. If the changes are material, we will notify you by email or through a prominent notice on the Website and, where required, seek your consent again.

16. Contact us

For any questions about this Privacy Policy or our data practices, please contact: