Data Protection Policy

Bizeneed India Private Limited is committed to protecting the privacy and security of your personal data. This Data Protection Policy outlines our practices for collecting, storing, processing, and sharing your information in compliance with applicable data protection laws including the Digital Personal Data Protection Act (DPDP Act), 2023,. Where consent is the basis for processing, we ask for it separately, through a clear affirmative action, and you can withdraw it at any time. Our Privacy Policy at /privacy/ gives the full detail, including who processes your data and where.

• Applies to all personal data collected through our website, mobile applications, and service engagements
• Compliant with the DPDP Act, 2023 and other applicable data protection regulations
• Last updated to reflect current regulatory requirements and organizational practices
• We reserve the right to update this policy periodically with appropriate notice

We collect personal data that you voluntarily provide when using our services, including identity information such as name, date of birth, gender, and photograph; contact information such as email address, phone number, and postal address; financial information such as bank account details, PAN, and GSTIN for billing and compliance purposes; and professional information such as company details, designation, and service requirements. We also collect usage data including IP address, browser type, device information, and interaction patterns to improve our services.

• Identity data: full name, date of birth, gender, government-issued identification numbers
• Contact data: email address, phone number, residential and correspondence addresses
• Financial data: bank account details, payment card information, PAN, GSTIN, and other tax identifiers
• Professional data: company name, registration numbers, director details, and service-specific information
• Technical data: IP address, browser type, device identifiers, operating system, and access timestamps
• Usage data: pages visited, services viewed, search queries, and interaction patterns on our platform

Your personal data is used to provide and improve our services, process transactions, communicate with you about your services, comply with legal and regulatory obligations, and send you relevant updates and promotional communications with your consent. We process data on the basis of your consent or, where the Digital Personal Data Protection Act, 2023 permits it without consent, for the legitimate uses listed in section 7 of that Act (for example, where you have voluntarily provided the data for a specified purpose, or to comply with a law).

• Providing requested professional services including company registration, GST filing, trademark applications, and compliance management
• Processing payments and maintaining accurate billing records for all transactions
• Communicating service updates, compliance deadlines, and important account information
• Complying with statutory obligations including KYC requirements and regulatory reporting
• Improving our platform functionality, user experience, and service delivery based on usage analytics
• Sending promotional communications and service updates only with your prior consent
• Preventing fraud, ensuring platform security, and protecting against unauthorized access

We implement industry-standard security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. The measures in place today are listed below and in the Data Security section of our Privacy Policy. No method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security.

• Encrypted HTTPS (TLS) connections between your browser and our website and portal
• Bank account numbers submitted for partner KYC are encrypted in our database (AES-256-GCM) and shown masked; passwords are stored only in hashed form
• Access to personal data is restricted to authorized personnel on a need-to-know basis, through role-based access controls
• Optional two-step verification (authenticator app) and passkeys or security keys for portal accounts
• Audit logs of significant actions taken in the portal
• Daily backups of the database and uploaded files, kept on our hosting server for a limited period
• Incident response procedures are in place to address potential data breaches promptly

We share your personal data only when necessary to provide our services or comply with legal obligations. Data is shared with regulatory authorities for statutory filings and compliance purposes; trusted third-party service providers who assist in service delivery under strict confidentiality agreements; payment processors for transaction processing; and professional advisors including lawyers and chartered accountants with your consent. We do not sell your personal data to third parties.

• Shared with government regulatory authorities as required for statutory compliance and filings
• Shared with trusted service providers bound by strict data processing agreements
• Payment processors receive only the minimum data necessary for transaction processing
• Professional advisors may receive relevant data with your explicit consent
• No sale, rental, or commercial sharing of personal data with unaffiliated third parties
• Data may be disclosed if required by law, court order, or government regulation
• All third-party recipients are contractually obligated to maintain data confidentiality

Chapter III of the Digital Personal Data Protection Act, 2023 gives you the right to information about your personal data, to correction, completion, updating and erasure, to grievance redressal and to nominate another person, and you may withdraw consent at any time. To make a request, write to grievance@bizeneed.in from your registered email address. Our Privacy Policy at /privacy/ explains these rights in full.

• Right to information: a summary of the personal data we process and the processing activities, and with whom we have shared it (section 11)
• Right to correction, completion and updating of inaccurate, incomplete or out-of-date personal data (section 12)
• Right to erasure: we will erase your personal data on request unless we need to keep it for the specified purpose or to comply with a law (section 12(3))
• In addition to your statutory rights, we will, on request, give you a copy of your data in a commonly used, machine-readable format
• You can ask us to stop direct marketing to you at any time
• Right to withdraw consent at any time, as easily as you gave it (section 6(4))
• Right to nominate: nominate another individual to exercise your rights in the event of death or incapacity, under section 14 of the Digital Personal Data Protection Act, 2023 once that section comes into force (eighteen months after 13 November 2025, under MeitY notification G.S.R. 843(E) dated 13 November 2025)
• Right to approach the Data Protection Board of India: once sections 13 and 27 of the Digital Personal Data Protection Act, 2023 come into force (eighteen months after 13 November 2025, under MeitY notification G.S.R. 843(E) dated 13 November 2025), you may approach the Board if your grievance is not resolved through our grievance redressal mechanism, which section 13(3) requires you to use first

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Statutory records including financial documents and compliance filings are retained for the period mandated by applicable law. Once the retention period expires, data is securely deleted or anonymized.

• Service-related data is retained for the duration of the service relationship plus statutory retention periods
• Financial and tax records are retained for a minimum of 8 years as required by Indian law
• Corporate records including MCA filings data are retained in accordance with Companies Act requirements
• Marketing communications data is retained until consent is withdrawn or the relationship ends
• Inactive account data may be archived after 3 years of inactivity and deleted after 7 years
• Deleted account data is removed from production systems within 30 days and from backups within 90 days

In the event of a personal data breach, we will intimate the Data Protection Board of India and each affected Data Principal. Section 8(6) of the Digital Personal Data Protection Act, 2023 makes this intimation mandatory once it comes into force (eighteen months after 13 November 2025, under MeitY notification G.S.R. 843(E) dated 13 November 2025), in the form, manner and timelines prescribed under that Act and the Digital Personal Data Protection Rules, 2025. Cyber security incidents are also reported to CERT-In where applicable directions require it. Our incident response team will investigate, contain, and remediate any breach promptly.

• Board intimation: to the Data Protection Board of India in the form, manner and timelines prescribed under the DPDP Act, 2023 and its rules
• Individual intimation: to each affected Data Principal, as section 8(6) of the DPDP Act, 2023 will require once it comes into force
• Internal investigation and containment procedures activated immediately upon detection
• Root cause analysis and remediation measures implemented to prevent recurrence
• Documentation of all breaches and response actions maintained for regulatory review
• Cooperation with relevant authorities throughout the investigation and remediation process

If you have any questions, concerns, or requests regarding this Data Protection Policy or our data processing practices, please contact us. We are committed to addressing your concerns promptly and transparently.

• Privacy questions: privacy@bizeneed.in
• Grievances and requests to exercise your rights: grievance@bizeneed.in
• General inquiries: support@bizeneed.in
• Registered Office: Bizeneed India Private Limited, New Delhi, Delhi, India
• We aim to respond to all data protection inquiries within 5 business days

This Data Protection Policy may be updated periodically to reflect changes in our practices, technology, legal requirements, or regulatory guidance. When we make material changes, we will notify you through email or a prominent notice on our website. The date of the most recent revision will be indicated at the top of this policy.

• Policy reviewed at least annually or as required by regulatory changes
• Material changes communicated via email notification and website announcement
• Version history maintained for audit and reference purposes
• Previous versions available upon request to privacy@bizeneed.in