Privacy Policy
| Detail | Particulars |
|---|---|
| Entity | ComplyPlanet Private Limited |
| CIN | U70200KA2025PTC208955 |
| Registered office | Bengaluru, Karnataka, India |
| Role under the DPDPA | Data Fiduciary in respect of website visitors, enquirers and our own personnel; Data Processor in respect of a client's data principals where we process such data in the course of service engagement, under a Data Processing Agreement with that client. |
| Data Protection Officer | Preksha H R │ dpo@complyplanet.com │ +91 960-684-0714 |
| Grievance Officer | Preksha H R │ enquiries@complyplanet.com │ +91 960-684-0714 |
Terms used in this Policy have the meanings assigned to them under the DPDPA and the Rules. In summary:
- "Personal Data" means any data about an individual who is identifiable by or in relation to such data.
- "Data Principal" means the individual to whom the Personal Data relates — for example, you, as a visitor to our website or a contact at a client organisation.
- "Data Fiduciary" means the entity that determines the purpose and means of processing Personal Data — ComplyPlanet, for the purposes described in this Policy.
- "Data Processor" means an entity that processes Personal Data on behalf of a Data Fiduciary.
- "Consent Manager" means a person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review and withdraw consent through an interoperable platform, per Rule 4.
- "Processing" means any operation on Personal Data, including collection, storage, use, sharing, disclosure or erasure.
The table below itemises the categories of Personal Data we collect, the specific purpose each supports, and the lawful basis relied upon under Section 4 and Section 7 of the DPDPA. (Rule 3(b) itemisation)
| Category | Examples | Specific purpose | Lawful basis |
|---|---|---|---|
| Identity & contact | Full name, work email, phone number, organisation | To respond to your enquiry, identify you correctly, and route you to the right specialist | Consent |
| Enquiry content | Service of interest, message/description of compliance requirement | To understand and respond to your specific compliance challenge | Consent |
| Marketing preference | Newsletter opt-in status, event-invite preference | To send newsletters, regulatory updates and event invitations — only where separately consented | Consent (separate and optional) |
| Client engagement data | Personal data of a client's employees, customers or other data principals encountered during a service engagement | To deliver the contracted advisory, audit or assessment service | Processed as Data Processor under a Data Processing Agreement with the client; the client remains the Data Fiduciary for this data |
| Technical & usage | IP address, browser/device information, cookies and similar technologies | To operate, secure and improve our website, and measure basic usage | Consent (non-essential cookies) and Certain Legitimate Use (essential/technical cookies) |
| Recruitment (where applicable) | Resume/CV, work history, references | To assess applications for roles at ComplyPlanet | Consent |
We collect Identity & contact, Enquiry content and Marketing preference data directly from you through our website's contact form. We collect Client engagement data in the course of delivering a contracted service, typically from the client organisation itself or, with the client's authorisation, directly from its personnel. We do not purchase Personal Data from data brokers or other third parties.
Where we rely on consent, we ask for it specifically, separately for each distinct purpose, and only after telling you what it covers — in line with Section 6 of the Act and Rule 3(c) of the Rules. In practice, this means:
- Our contact form uses two separate consent actions: one, required, to process your data to respond to your enquiry; and a second, optional and unticked by default, to send you marketing communications.
- You may withdraw either consent at any time, with the same ease as giving it, by emailing enquiries@complyplanet.com with the subject "Consent Withdrawal Request", or by using the unsubscribe link in any marketing email.
- Withdrawing consent does not affect the lawfulness of processing already carried out before withdrawal, and does not affect our ability to retain data where required for legal, accounting or dispute-resolution purposes.
- Where we process Personal Data in reliance on "Certain Legitimate Uses" under Section 7 of the Act (for example, technical cookies necessary for the website to function, or processing necessary to respond to a request you have voluntarily made), we do not seek consent, but we disclose the basis relied upon in Section 3 above.
complyplanet.com uses cookies and similar technologies to operate the site, remember basic preferences, and measure aggregate usage. We do not use cookies for cross-site advertising profiling. You can control non-essential cookies through the cookie banner shown on your first visit, and at any time via our Cookie Policy and cookie settings. Full details of each cookie's name, purpose and duration are set out in our separate Cookie Policy.
| Recipient | Purpose | Safeguard |
|---|---|---|
| Email/marketing platform (third-party processor) | To deliver newsletters and marketing communications you have separately consented to receive | Engaged under a Data Processing Agreement; may not use your data for any other purpose |
| Hosting / IT infrastructure providers | To host complyplanet.com and store enquiry data securely | Contractual confidentiality and security obligations |
| Client-nominated sub-processors (engagement-specific) | Where a specific advisory engagement requires it (e.g., a client's own tooling) | Governed by the applicable client contract and Data Processing Agreement |
| Regulators, courts, law enforcement | Where disclosure is required to comply with a legal obligation or a judicial/regulatory order | Disclosed only to the extent legally required |
| International ComplyPlanet partners and personnel (USA, UK, Germany, Kenya) | Where an engagement is delivered jointly with, or referred to, our international partners | Covered by internal confidentiality undertakings and, where applicable, client-approved sub-processor arrangements — see Section 7 on cross-border transfer |
We do not sell or rent Personal Data. We do not share Personal Data with third parties for their own independent marketing purposes.
ComplyPlanet operates across India, the United Kingdom, Germany, the United States and Africa (Kenya). As a result, Personal Data — most commonly Client engagement data described in Section 3 — may be transferred outside India where necessary to deliver a cross-border engagement.
Any such transfer is made subject to the requirements the Central Government specifies under Rule 15 of the Rules from time to time, and is governed by confidentiality and data-protection obligations in the underlying client contract or partner agreement. We maintain a record of which engagements involve cross-border transfer, the recipient, the country, and the safeguard relied upon, and will make this available to a Data Principal or a client on reasonable request.
The following table maps our controls to the limbs of Rule 6(1) of the DPDPA Rules 2025.
| Rule 6(1) limb | ComplyPlanet's control |
|---|---|
| (a) Data security measures | Encryption of data in transit and at rest; access to enquiry and client data restricted to personnel who need it for the relevant engagement. |
| (b) Access control | Role-based access, multi-factor authentication on internal systems and client-data repositories. |
| (c) Visibility / monitoring | Logging and periodic review of access to systems holding Personal Data, to detect and investigate unauthorised access. |
| (d) Continuity safeguards | Regular, encrypted backups and a documented incident/continuity response process. |
| (e) Log & data retention floor | Processing logs retained for a minimum of one year, per Rule 8(3), unless a longer period is legally required. |
| (f) Processor contract flow-down | Data Processing Agreements with our email/marketing platform, hosting provider and any engagement-specific sub-processor, requiring equivalent safeguards. |
| (g) Organisational measures | Internal privacy and confidentiality training for all personnel; a named Data Protection Officer overseeing this framework; privacy considerations embedded in our own DMAIC delivery methodology. |
If we become aware of a Personal Data breach, we will, without delay, intimate each affected Data Principal in clear, plain language through their registered contact details, covering: the nature, extent and timing of the breach; likely consequences for them; mitigation measures taken or planned; safety measures they may take; and the contact details of a person able to respond to their queries — in line with Rule 7(1).
We will also notify the Data Protection Board of India without delay with an initial description of the breach, and, within 72 hours (or such extended period as the Board may allow), provide updated details covering the circumstances, root cause, mitigation measures, findings on the party responsible, remedial steps taken, and a report of the intimations given to affected Data Principals — in line with Rule 7(2).
To report a suspected breach involving your data, contact us immediately at enquiries@complyplanet.com.
| Category | Retention period | Trigger for erasure |
|---|---|---|
| Enquiry / contact-form data (no engagement follows) | 24 months from last contact, unless you request earlier deletion | Inactivity, or your erasure request |
| Marketing consent & preference records | Until consent is withdrawn, or 24 months' inactivity, whichever is earlier | Withdrawal of consent, or inactivity |
| Client engagement data | Duration of the engagement plus the period required under the applicable client contract, professional-liability, or statutory limitation rules (typically up to 7 years for audit-related records) | Expiry of the applicable retention period under the client contract or law |
| Processing logs / security logs | Minimum of 1 year (Rule 8(3)), extendable where legally required | Expiry of the statutory minimum, subject to any legal hold |
Where a defined retention period under this Policy is about to expire and further engagement from you could extend it, we will notify you at least 48 hours before erasure — in line with Rule 8(2) — so that you may re-engage with us or exercise your rights if you wish the data to be retained for a stated purpose.
Our services are directed at business professionals and organisations, and our website is not intended for use by children (individuals under 18 years of age). We do not knowingly collect Personal Data from children. If we become aware that we have inadvertently collected a child's Personal Data, we will delete it promptly.
Where an individual identifying as the lawful guardian of a person with disability seeks to exercise rights or provide consent on that person's behalf, we will verify the guardian's appointment by a court, designated authority, or local-level committee under the applicable guardianship law, before relying on that consent — in line with Rule 11 of the Rules.
Under the DPDPA and the Rules, you have the following rights in respect of your Personal Data. We will respond to a verified request within a reasonable period, and in any event within 30 days.
| Right | What it means | How to exercise it |
|---|---|---|
| Right to information | Know what Personal Data we hold about you and how it is processed | Email enquiries@complyplanet.com |
| Right to correction | Request correction or updating of inaccurate or incomplete data | Email enquiries@complyplanet.com |
| Right to erasure | Request deletion of your Personal Data where it is no longer necessary for the purpose collected | Email enquiries@complyplanet.com |
| Right to withdraw consent | Revoke consent to processing at any time, without penalty for the withdrawal itself | Email enquiries@complyplanet.com or use the unsubscribe link |
| Right to nominate | Nominate another individual to exercise your rights in the event of your death or incapacity | Email enquiries@complyplanet.com with the nominee's details |
| Right to grievance redressal | Raise a grievance about how we have handled your Personal Data | See Section 13 below |
We may take reasonable steps to verify your identity, and that of any nominee, before acting on a request, to prevent unauthorised access to your Personal Data.
If you believe your Personal Data rights under the DPDPA have been violated, or you have a complaint about how ComplyPlanet has handled your data, you may file a formal grievance with our Grievance Officer:
| Detail | Particulars |
|---|---|
| Grievance Officer | Preksha H R |
| enquiries@complyplanet.com | |
| Phone | +91 960-684-0714 |
| Acknowledgement | Within 48 hours of receipt |
| Target resolution | Within 90 days of receipt |
If your grievance remains unresolved after exhausting this process, you may escalate it to the Data Protection Board of India at meity.gov.in ↗.
We may update this Privacy Policy from time to time to reflect changes in our services, the law, or our data-handling practices. The updated Policy will be posted on this page with a revised effective date. We encourage you to review this Policy periodically.