Privacy Policy

1.1. This Privacy Policy (“Policy”) is enacted in strict compliance with the statutory provisions of:

• The Digital Personal Data Protection Act, 2023 (“DPDP Act”) and rules framed thereunder;
• Section 43A and Section 72A of the Information Technology Act, 2000 (“IT Act”);
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”); and
• Applicable directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B of the IT Act.

1.2. This Policy governs the collection, receipt, possession, storage, dealing, handling, processing, and transfer of personal data and commercial information provided by clients, prospective business partners, and website visitors.

2.1. Data Fiduciary Identity: For the purposes of the DPDP Act, 2023, the Data Fiduciary is Tewari Digital, operating from its registered office at:

2.2. This Policy covers digital platforms operated by Tewari Digital (including https://tewaridigital.com), communication channels (official email, WhatsApp support desk, telephone lines), and offline document submissions delivered to our office.

3.1. Depending on whether a Client engages our Legal & Business Registration Division or our IT & Digital Solutions Division, the data collected is classified into the following breakdowns:

4.1. Under Section 6 and Section 7 of the DPDP Act, 2023, Tewari Digital processes personal data solely on the following legitimate grounds:

• Explicit Informed Consent: The Client gives unequivocal consent by submitting details through website inquiry forms, executing engagement agreements, or providing statutory documents via email/WhatsApp.
• Contractual Performance: Processing is essential to execute agreed deliverables (e.g. drafting articles of association, configuring billing databases, uploading GST returns).
• Compliance with Legal Obligations: Retention of financial invoices, GST filings, and transaction logs as mandated under the Central Goods and Services Tax Act, 2017 and the Income Tax Act, 1961.

5.1. Authorized Government Transmission: The Client explicitly acknowledges and authorizes Tewari Digital to transmit Category B and Category C documents to official statutory portals operated by the Union Government of India or State Governments, including:

• Ministry of Corporate Affairs (MCA V3 Portal — mca.gov.in);
• Goods and Services Tax Network (GST Portal — gst.gov.in);
• Food Safety and Standards Authority of India (FoSCoS — foscos.fssai.gov.in);
• Ministry of Micro, Small & Medium Enterprises (Udyam — udyamregistration.gov.in).

5.2. Once transmitted, data housed on government servers is subject to sovereign public record laws and the statutory privacy charters of the respective government ministries.

6.1. Zero Commercial Monetization: Tewari Digital strictly adheres to an absolute non-sale policy. We do NOT sell, rent, lease, barter, or distribute client contact numbers, email addresses, financial profiles, or KYC documents to data brokers, telemarketers, credit card issuers, or third-party marketing agencies.

6.2. Need-to-Know Access Controls: Access to sensitive client data is restricted exclusively to authorized legal associates and software engineers directly assigned to execute the specific service module.

7.1. In accordance with Rule 8 of the Information Technology (SPDI) Rules, 2011, Tewari Digital implements reasonable physical, electronic, managerial, and operational security controls:

• Transport Layer Security (TLS): All web sessions, form transmissions, and browser interactions are encrypted using TLS 1.3 protocol with SHA-256 cipher suites.
• Server-Side CSRF Defense: Form interfaces incorporate cryptographic Cross-Site Request Forgery (CSRF) token checks and honeypot spam prevention.
• Zero Credential Exposure: SMTP authentication passwords, database roots, and server API keys are strictly insulated in backend PHP configurations and never exposed to client-side scripts.

8.1. Personal data and statutory documents are retained only for as long as necessary to fulfill the specific operational purpose for which they were collected, or as required by Indian statutory statutes:

• Statutory Registration Documents: Retained for a period of one (1) year post successful certificate delivery to support future annual filings, after which raw KYC files are securely purged upon client request.
• Commercial Invoices & Accounting Books: Retained for eight (8) financial years as legally mandated by Section 128 of the Companies Act, 2013 and Section 44AA of the Income Tax Act, 1961.
• Server Logs: Retained for 180 calendar days in compliance with the CERT-In Cyber Security Directions of April 2022.

9.1. Clients and users located in India possess enforceable statutory rights under Chapter III of the Digital Personal Data Protection Act, 2023:

• Right to Access Summary: You may request a concise summary of personal data held and processed by Tewari Digital.
• Right to Correction & Erasure: You possess the right to seek correction of misleading data, completion of incomplete records, or erasure of personal data that is no longer required for statutory compliance.
• Right to Grievance Redressal: You have the right to register complaints regarding data handling and receive prompt grievance resolution.
• Right to Nominate: You have the right to nominate any individual to exercise your data principal rights in the event of death or incapacity.

To exercise any of the aforementioned rights, transmit a formal request with proof of identity to [email protected].

10.1. Pursuant to Rule 5(9) of the Information Technology (SPDI) Rules, 2011 and Section 12 of the DPDP Act, 2023, the details of the designated Grievance Officer are provided below: