Privacy Policy of www.setindiabiz.com (website) and Setindiabiz Private Limited (Company)

Setindiabiz Private Limited (“Setindiabiz”, “we”, “us”, “our”) is committed to protecting your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian data protection laws. As a Data Fiduciary under the DPDP Act, we process personal data responsibly and transparently. If you are in the European Union, the European Economic Area or the United Kingdom, section 18 also applies to you.

This Privacy Policy explains how we collect, use, share, and protect your personal data when you access our website (www.setindiabiz.com) or use our services. By using our platform or services, you consent to the data practices described in this policy. If you disagree with these practices, please refrain from using our platform or services.

1. Scope & Who We Are

This Privacy Policy applies to all visitors to our website (www.setindiabiz.com and related domains), users who create accounts or register on our platform, clients who engage our services, individuals whose personal data we process in connection with our services, and partners, vendors, and independent professionals who collaborate with us. Under the DPDP Act, Setindiabiz acts as a Data Fiduciary for personal data collected directly from you. When we engage independent licensed professionals for regulated services, they may act as independent Data Fiduciaries for the specific data they process in their professional capacity.

2. What We Collect

1. We collect personal data that you provide directly, as well as information generated through your use of our services. This includes identity and contact information such as your full name, title, designation, email address, phone numbers, residential and business addresses, organisation name and details, and professional credentials and qualifications.
2. For KYC and compliance purposes, we collect documentation, including government-issued identification such as PAN, Aadhaar, Passport, or Driving Licence; corporate documents such as CIN, GSTIN, and incorporation certificates; Director or Partner identification numbers (DIN/DPIN); board resolutions and authorisations; and photographs and signatures, where legally required.
3. Our transactional data collection encompasses service orders and purchase histories, invoices and payment records, GST details and tax information, banking details for payments and refunds, as well as transaction IDs and payment gateway information. When you engage our services, we also collect service content, including documents and files you upload for service delivery, instructions and requirements you provide, correspondence related to service execution, and forms and applications prepared on your behalf.
4. Through your interaction with our platform, we collect usage data and technical information, including IP addresses and device identifiers, browser type and version, operating system and platform, pages visited, interaction patterns, access times, and referring URLs, as well as location data at the country or state level. Additionally, we maintain records of support and communication, including support tickets and queries, call recordings with prior notice, chat transcripts, email correspondence, feedback and satisfaction surveys, as well as records of complaints and grievances.

3. Why We Process

1. We process your personal data for various lawful purposes essential to our service delivery and business operations. For service delivery, we use your data for client onboarding, including verifying identity, completing KYC requirements, and creating accounts. We process data for service execution to provide incorporation, compliance, tax, accounting, and IPR services, coordinate with independent licensed professionals where required, and prepare and file statutory forms and applications on your behalf.
2. Legal and regulatory compliance requires us to process data in accordance with the Companies Act, 2013, GST laws, the Income Tax Act, and other relevant acts and regulations. We maintain statutory records and registers, respond to enquiries from government authorities and regulatory bodies, and implement measures to prevent money laundering and financial crimes.
3. For our business operations, we process data for billing and payments, including transactions, invoice issuance, and refund management. We use your information to communicate service updates, reminders, and important notices. Quality assurance involves monitoring service delivery and professional performance, while platform improvement requires analysing usage patterns to enhance user experience.
4. Security and fraud prevention necessitate processing to detect and prevent unauthorised access, investigate security incidents and breaches, protect against fraud and financial crimes, and enforce our Terms of Use and policies. With your consent, we also process data for marketing and business development, including sending promotional communications about our services, conducting market research and surveys, personalising content and recommendations, and managing referral and partner programmes.

4. Legal Bases for Data Processing

1. We process personal data based on several legal grounds under the Digital Personal Data Protection Act, 2023 (DPDP Act). People in the EU, EEA and UK should also read section 18. For activities such as marketing communications, non-essential cookies, and optional services, we obtain your free, specific, informed, unconditional, and unambiguous consent through an explicit affirmative action.
2. We also process data for specific legitimate uses as permitted under the DPDP Act. These include contractual necessity, where processing is necessary to fulfil our service agreement with you; legal obligations for compliance with laws, court orders, and regulatory requirements; employment purposes for managing relationships with employees and contractors; and public interest activities as specified by the government. Additionally, for specified purposes in which you voluntarily provide information with a reasonable expectation of processing, such as submitting queries or requesting services, we process the data you provide.

5. Sharing & Recipients

1. We share personal data only when necessary and with appropriate safeguards in place. When regulated services require licensed professionals, we share relevant data with Chartered Accountants for audits, certifications, and attestations; Company Secretaries for compliance certifications; Cost and Management Accountants for cost audits; and Advocates or Law Firms for legal advice and representation. These professionals receive only the data necessary for their specific engagement and are bound by professional confidentiality obligations.
2. We engage trusted third-party vendors under strict Data Processing Agreements for various operational needs. These include technology infrastructure providers for cloud hosting, data storage, and backup services; communication service providers for email, SMS, and WhatsApp Business API; payment processing partners, including payment gateways and banking institutions; analytics and monitoring tools for website analytics and performance monitoring; and courier and logistics services for document delivery.
3. When legally required, we disclose data to government and regulatory authorities, including the Ministry of Corporate Affairs, Goods and Services Tax authorities, the Income Tax Department, the Registrar of Companies, the Securities and Exchange Board of India, and other statutory authorities and courts. In the event of a merger, acquisition, or asset sale, personal data may be transferred to the successor entity, provided that appropriate notice and safeguards are in place.
4. Other lawful disclosures may occur to professional advisers, such as auditors and legal counsel, who are bound by confidentiality, with your explicit consent for specific purposes, to protect our rights, safety, or property, and in response to valid legal processes. We do not sell, rent, or trade your personal data to any third parties for their marketing purposes.

6. Cross-Border Data Transfers

1. Some of our service providers may process data outside India. We ensure that such transfers comply with the DPDP Act requirements for cross-border transfers, government notifications regarding restricted countries, and include appropriate contractual safeguards and data protection clauses.
2. We will not transfer personal data to countries or territories that the Central Government has notified as restricted, except as permitted under the DPDP Act. You may request information about countries where your data is processed and the safeguards applied.

7. Data Retention

1. We retain personal data only for as long as necessary. During active services, we maintain data throughout the service engagement period. Legal requirements mandate retention for a period specified by applicable laws, such as 8 years for financial records under the Companies Act. Tax records are retained for 7 years from the end of the relevant assessment year. Data related to disputes is retained until any disputes or claims are resolved, and consent-based processing data is retained until consent is withdrawn.
2. After the retention period, we either permanently delete personal data from our systems, irreversibly anonymise it for statistical or research purposes, or archive it securely if required by law. We periodically review retained data to ensure continued necessity and lawful basis for retention.

8. Data Security

1. We implement appropriate technical and organisational security measures as required under the DPDP Act. Our access controls include role-based access and multi-factor authentication. We use TLS/SSL encryption for data in transit and encryption for sensitive data at rest. Network security measures include firewalls, intrusion detection, and regular security patches, while physical security involves restricted access to servers and data centres. We continuously monitor systems for unauthorised access.
2. All employees handling personal data receive regular data protection training, sign confidentiality agreements and NDAs, and follow clear data handling procedures and guidelines. In the event of a personal data breach, we maintain an incident response plan, notify affected individuals as required under the DPDP Act, inform the Data Protection Board within the prescribed timelines, and take immediate steps to contain and remediate the breach.
3. We require all data processors to implement appropriate security measures, notify us immediately of any breaches, allow security audits and assessments, and maintain confidentiality obligations.

9. Your Rights Under the DPDP Act

1. As a Data Principal under the DPDP Act, you have the following rights. You have the right to access your data, including requesting confirmation of whether we process your personal data, obtaining a summary of the personal data we process, and knowing the identity of the Data Processors with whom your data is shared. You can request correction of inaccurate or incomplete personal data, and we will update the information and notify relevant third parties where feasible.
2. You may request deletion of your personal data when it is no longer necessary for the original purpose, you withdraw consent where consent is the legal basis, or processing is unlawful. However, we may retain data where required by law or for legitimate purposes. You have the right to raise grievances with our Grievance Officer and escalate unresolved complaints to the Data Protection Board of India. You can nominate another individual to exercise your rights in case of death or incapacity.
3. Where processing is based on consent, you can withdraw it at any time. This will not affect the lawfulness of processing before withdrawal, processing based on other legal grounds, or your ability to use services not dependent on that consent. To exercise your rights, submit requests to our Grievance Officer at help@setindiabiz.com with your full name and contact details, specification of the rights you wish to exercise, identity verification documents, and any relevant supporting information. We will respond within seven working days of receiving a complete request or as prescribed under the DPDP Act.

10. Consent Management

1. By availing yourself of our services, you explicitly and affirmatively give your consent to the terms outlined in this policy. This consent is deemed given upon your first use or registration for our services. This consent shall remain in full force and effect until specifically revoked by you in accordance with the provisions below.
2. You can manage your consent preferences and revoke your consent at any time through your account settings on our platform, by using unsubscribe links in emails, adjusting your browser cookie settings, or by submitting a formal request to our Grievance Officer. We ensure that the process for revoking consent is user-friendly and accessible. Upon revocation, we will cease processing your data related to this matter, subject to any legal or contractual obligations to retain certain information.

11. Children’s Data

1. Our services are intended for individuals aged 18 years and above, as well as businesses and corporate entities, and adults acting on behalf of minors for specific services. If we become aware that we are processing data of individuals under 18 without proper consent, we will obtain verifiable parental or guardian consent, delete the data if consent cannot be obtained, or restrict processing to what is necessary with consent.
2. We do not knowingly market directly to children, create profiles of children for targeted advertising, or process children’s data for behavioural tracking.

12. Cookies & Tracking Technologies

1. We use various types of cookies, including essential cookies required for website functionality, analytics cookies to understand usage patterns, preference cookies to remember your choices, and marketing cookies to deliver relevant advertisements with your consent.
2. You can control cookies through our cookie consent banner, browser settings, and third-party opt-out tools.

13. Automated Decision-Making

We currently do not use fully automated decision-making that produces legal or similarly significant effects. If we implement such systems in the future, we will update this policy, which is available on our website, to reflect these changes and provide necessary details, including obtaining consent, offering human review options, and explaining the logic underlying the automated decision-making process.

14. Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for their privacy practices, and we recommend that you review their privacy policies before providing any personal data. The inclusion of any link does not imply our endorsement of the linked website or its privacy practices.

15. Updates to This Policy

We may update this Privacy Policy to reflect changes in legal requirements, new processing activities, improved privacy practices, or feedback from users and regulators. Material changes will be notified to registered users via email, website banners, in-app notifications, and an updated “Last Updated” date. Where required, we will seek fresh consent for any material changes that affect your rights.

16. Data Protection Officer & Grievance Redressal

1. For privacy or data protection concerns, or to exercise your rights, please contact our Data Protection Grievance Officer, Sudip Manna. He can be reached at A-34, Sector-2, Noida 201301 during business hours (Monday to Saturday, 9:30 AM to 6:30 PM IST) or via email at help@setindiabiz.com.
2. We will acknowledge your grievance within 24 hours and provide an initial response within seven working days. We aim to resolve all matters within 30 days; however, complex issues may require additional time, which will be communicated to you. If your grievance is not resolved to your satisfaction, you may escalate it to the Data Protection Board of India or other appropriate judicial forums as per applicable laws.

17. Legal Compliance & Jurisdiction

1. This Privacy Policy is governed by the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and its rules, as well as other applicable Indian data protection laws.
2. We regularly review our practices to ensure compliance with evolving data protection regulations, industry best practices, and, where appropriate, international standards. Any disputes arising from this Privacy Policy shall be subject to the exclusive jurisdiction of the courts in New Delhi, India.

18. Notice for People in the EU, EEA and UK

This section applies if you are in the European Union, the European Economic Area or the United Kingdom when you visit our website, fill in one of our forms (including a lead form on Facebook or Instagram) or contact us. It gives the information required by Article 13 of the General Data Protection Regulation (EU) 2016/679 (GDPR) and by Article 13 of the UK GDPR. Where this section differs from the rest of this policy, this section applies to you.

18.1 Who We Are

Setindiabiz Private Limited is the controller of your personal data. Our registered office is at Innov8 CP2, 44, Bakery Portion, 2nd Floor, Regal Building, Connaught Place, New Delhi 110001, India. Write to help@setindiabiz.com, or to our Grievance Officer, Sudip Manna, at A-34, Sector 2, Noida 201301, India. We have no office in the EU, EEA or UK. The GDPR and the UK GDPR apply to us because we offer our services to people there (Article 3(2)(a)).

18.2 What We Use and Why

Purpose	Personal data	Legal basis
Replying to your enquiry and sending a quote	Name, email address, phone number, company, job title, country, your answers to our form questions, and notes of our calls and chats with you	Steps you asked us to take before a contract, Article 6(1)(b)
Delivering services you buy from us	The data described in sections 2 and 3	Contract, Article 6(1)(b)
Keeping the records Indian law requires of us, for example under the Companies Act, 2013 and the GST laws	Invoices, payment records, KYC documents and service records	Legitimate interests, Article 6(1)(f). The GDPR’s “legal obligation” basis covers only EU, member-state and UK law (Article 6(3)), so it does not cover Indian law.
Telling you about services you have not asked about	Name, email address, phone number	Consent, Article 6(1)(a)
Measuring our Facebook and Instagram ads	When our team marks your enquiry as valid, or it reaches a proposal or a sale, our CRM sends Meta the stage reached, Meta’s reference for your lead form, and your email address and phone number in hashed form (converted by SHA-256 into a fixed code that Meta matches against the data it already holds). For a sale, it also sends the amount.	Legitimate interests, Article 6(1)(f)
Keeping our systems secure, preventing fraud and dealing with legal claims	Technical and usage data, and records of our dealings with you	Legitimate interests, Article 6(1)(f)

18.3 Our Legitimate Interests

Where we rely on legitimate interests, these are our interests: replying to business enquiries and keeping a record of them; finding out which of our ads bring genuine enquiries, so we stop paying for the ones that do not; protecting our systems and clients from fraud; and keeping the records Indian law requires of an Indian company. You can ask us how we balanced these interests against your rights.

18.4 Do You Have to Give Us This Data?

We need your name, your email address or phone number, and your form answers to reply to your enquiry. Without them we cannot contact you. No law or contract requires you to give them when you make an enquiry.

18.5 Who Receives Your Data

Our team in India. Zoho, which provides our CRM, email and website chat and handles data on our instructions; our CRM is hosted in Zoho’s United States data centre. Meta Platforms, which runs the lead forms on Facebook and Instagram and WhatsApp, and receives the measurement data described in 18.2; Meta also uses data under its own privacy policy (www.facebook.com/privacy/policy). If you become our client, the professionals, payment providers and authorities listed in section 5.

18.6 Transfers Outside the EU, EEA and UK

We are based in India, so we handle your data in India. Our providers handle it in the United States and other countries where they operate. India does not have an adequacy decision under Article 45 of the GDPR or under the UK GDPR. For transfers to our providers, our contracts with them include the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, together with the UK International Data Transfer Addendum for UK data. You can ask for a copy of these safeguards at help@setindiabiz.com.

18.7 How Long We Keep It

We keep your enquiry for as long as we need it to reply to you and follow up, to keep a record of our dealings with you, and to deal with any claim. We review stored enquiries from time to time and delete or anonymise those we no longer need. If you become our client, section 7 applies. You can ask us to erase your enquiry at any time (18.8).

18.8 Your Rights

Articles 15 to 21 give you these rights. You can ask us for a copy of your data. You can ask us to correct it or erase it. You can ask us to restrict how we use it. Where we rely on contract or consent, you can ask us to send the data you gave us, in a machine-readable format, to you or to another organisation.

You can object at any time to any use we base on legitimate interests. That includes the ad measurement in 18.2, and we will stop it for you. You can also object to direct marketing; we will then stop it.

You can withdraw consent at any time. Withdrawing does not affect what we did before.

Write to help@setindiabiz.com. We reply within one month. Article 12(3) lets us extend this by two months for complex or numerous requests, and we will tell you if we do.

18.9 Complaints

You can complain to us at help@setindiabiz.com, and we acknowledge every complaint within 30 days.

You can also complain to a data protection authority:

• in the EU or EEA, the authority in the country where you live, where you work or where the issue arose (Article 77), for example the Autoriteit Persoonsgegevens in the Netherlands or the data protection authority of your federal state in Germany;
• in the UK, the Information Commissioner’s Office (ico.org.uk).

You can also go to court where you live (Article 79). Section 17 does not limit this.

18.10 Automated Decisions and Profiling

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (Article 22). A member of our team reviews every enquiry. Meta decides who sees our ads, using its own data and the settings we choose, such as country, minimum age and interests. The measurement data in 18.2 helps Meta show our ads to people similar to our clients. Meta’s privacy policy explains how it does this.

18.11 Consent

For people in the EU, EEA and UK, consent means a clear action you take for a stated purpose, such as ticking a box. Using our website or services is not consent. The consent statements in the opening paragraphs, in section 10 and in section 20 are not a legal basis for using your data.

19. Contact Us

For any questions about this Privacy Policy or our data practices, please reach Setindiabiz Private Limited at our registered office: Innov8 CP2, 44, Bakery Portion, 2nd Floor, Regal Building, Connaught Place, New Delhi 110001, or our corporate office: A-34, Sector 2, Noida, Uttar Pradesh 201301. Visit our website at www.setindiabiz.com, send an email to help@setindiabiz.com or access our support portal at https://support.setindiabiz.com/portal/en/home.

20. Acceptance

By using our website or services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our platform and services. Your continued use of our services after any modifications to this Privacy Policy constitutes your acceptance of the updated terms.