Privacy Policy & Data Protection Framework
Effective Date: October 2026 • Governing Law: Digital Personal Data Protection Act, 2023 & Information Technology Act, 2000
CraftEgon CCS provides corporate secretarial, regulatory compliance, and statutory documentation infrastructure under Indian corporate law. In compliance with the Advocates Act, 1961 and Bar Council of India regulations, CraftEgon CCS does not provide courtroom appearances, tribunal advocacy, or contentious litigation representation before the NCLT, ITAT, or High Courts. Formal legal representation and tribunal pleadings must be conducted by independent practicing advocates engaged directly on a separate vakalatnama.
1. Role as Data Fiduciary under Section 5 & 8
CraftEgon CCS ("Company", "we", "us") operates strictly as a Data Fiduciary under the Digital Personal Data Protection (DPDP) Act, 2023. When you access our corporate intelligence tools, entity search directories, statutory fee calculators, or client onboarding workflows, we process digital personal data solely for specified lawful corporate secretarial, tax advisory, regulatory filing, and identity verification purposes.
2. Categories of Personal & Corporate Data Collected
In providing compliance automation and documentation infrastructure, we collect only necessary data categories:
- Identity & KYC Records: Director Identification Numbers (DIN), Permanent Account Numbers (PAN), Aadhaar XML/hash (strictly for statutory verification via DigiLocker / authorized UIDAI gateways), and passport credentials;
- Corporate Master Data: Corporate Identity Numbers (CIN), Limited Liability Partnership Identification Numbers (LLPIN), shareholding registers, cap tables, and board resolutions;
- Financial & Tax Information: GSTIN registrations, bank account IFSC details for corporate account setup, and annual financial statements;
- Digital Credentials: Class-3 Digital Signature Certificate (DSC) cryptographic tokens used strictly upon explicit client authorization for MCA V3 and Income Tax portal e-filings.
3. Rights of the Data Principal under Chapter III
Under the DPDP Act 2023, you, as a Data Principal, possess non-derogable statutory rights:
- Right to Access Information (Section 11): Right to obtain a summary of your personal data being processed and identities of Data Processors;
- Right to Correction & Erasure (Section 12): Right to rectify inaccurate personal data or mandate complete erasure upon completion of statutory retention obligations;
- Right of Grievance Redressal (Section 13): Right to readily available grievance redressal mechanisms with prompt procedural handling;
- Right to Nominate (Section 14): Right to nominate an individual to exercise data principal rights in the event of death or incapacity.
4. Technical Security Safeguards & Data Retention
On our public website, enquiry form submissions are formatted directly for dispatch through external communication channels (WhatsApp or your email client) and are not retained in a web database. For formally engaged clients under an active corporate secretarial retainer, confidential entity documents, filing XMLs, and statutory records are maintained under role-based access controls and TLS transport encryption. In accordance with Section 128 of the Companies Act, 2013 and Section 149 of the Income Tax Act, 1961, books of account, board minutes, and statutory registers are retained for a minimum of 8 financial years.
5. Data Protection Officer (DPO) & Grievance Redressal
In compliance with the DPDP Act, 2023, CraftEgon CCS has designated a specialized Data Protection Officer:
Attn: Grievance Officer, Digital Compliance Division
CraftEgon CCS Headquarters, India
Official Communication: [email protected]