Privacy Policy

GRCNow practises what it preaches. We collect only what is strictly necessary, maintain all data within Indian geographical boundaries, and never share or monetize your information without explicit, informed consent. This Privacy Policy explains how GRCNow Solutions Private Limited ("GRCNow", "we", "us", "our") processes and protects personal data when you visit grcnow.inor interact with our services, in strict compliance with the Digital Personal Data Protection Act, 2023 ("DPDPA").

1. Data We Collect

1.1 Information you provide directly

• Contact & Identification Data: Full name, professional email address, phone number, and organization name when you join our early-bird waitlist, schedule an exploratory consultation, or contact us.
• Calculator Inputs: Multiple-choice options selected in the free Risk Calculator (industry sector, employee tier, and category of data processed). These inputs are processed client-side in your browser to compute illustrative indicators and are not stored on our servers unless you voluntarily submit your email to request the generated report.
• Billing & Tax Identifiers: Name of entity, registered corporate address, and GSTIN when subscribing to a paid compliance plan or purchasing custom compliance deliverables. All payment processing is handled through certified PCI-DSS compliant gateways; GRCNow never views or stores unencrypted credit card or debit card credentials.
• CA / Law Firm Referral Codes: If you are introduced to GRCNow through an accredited Chartered Accountant or Legal Partner, referral attribution metadata is captured to ensure appropriate partner coordination.

1.2 Technical data collected automatically

• Server & Security Logs: Internet Protocol (IP) address, browser client architecture, requesting timestamp, and resource paths accessed, recorded strictly for edge threat mitigation, firewall enforcement, and distributed denial-of-service (DDoS) deterrence.
• Cookieless Analytics: We use privacy-preserving, cookieless metrics (Cloudflare Web Analytics) to evaluate aggregate site usage. We do not load third-party ad pixels, cross-site trackers, or commercial profiling cookies.

2. Lawful Grounds & Purposes of Processing

We process personal data only under recognized lawful grounds under the DPDPA, specifically for:

• Fulfilling our contractual commitments and delivering requested digital reports and dashboard access;
• Sending transactional notifications, compliance roadmap deliverables, and service updates;
• Attributing professional engagements to our empanelled CA and legal network partners;
• Complying with statutory corporate, tax, and regulatory reporting mandates under Indian law;
• Investigating, preventing, and mitigating security breaches, technical fraud, or platform abuse.

3. Strict Sovereign Data Residency

4. Data Retention

We retain personal data only for as long as necessary to achieve the specific purposes for which it was gathered, or as required to satisfy statutory accounting, tax, and regulatory compliance obligations (typically up to 8 years for financial transaction records under the Companies Act and GST laws). Technical firewall logs are automatically purged on a rolling schedule.

5. Disclosures to Third Parties

We do not sell, rent, trade, or commercially monetize personal data. Disclosures are restricted to:

• Empanelled Professional Partners: Practising Chartered Accountants and partner legal counsels, solely with your express authorization when you request formal legal documentation, statutory audit reviews, or tailored compliance opinions.
• Infrastructure Service Providers: Trusted Indian cloud hosting, cloudflare edge network, and RBI-authorized payment gateways acting as Data Processors bound by rigorous data protection agreements.
• Statutory Authorities: Law enforcement agencies, courts of competent jurisdiction, or the Data Protection Board of India when mandated under a valid, legally enforceable subpoena or statutory directive.

6. Rights of Data Principals under DPDPA

Under the provisions of the Digital Personal Data Protection Act, 2023, you are entitled to:

• Right of Access: Request a summary of the personal data undergoing processing and the identities of any Data Processors with whom it has been shared.
• Right to Correction & Completion: Request the correction of misleading or inaccurate personal data, and the completion of incomplete records.
• Right to Erasure: Request the deletion of personal data that is no longer required for the purpose for which it was processed, subject to statutory retention mandates.
• Right of Grievance Redressal: Direct questions, concerns, or complaints directly to our designated Grievance Officer.
• Right to Nominate: Nominate an individual who, in the event of death or physical incapacity, shall exercise your Data Principal rights.

To exercise any of these statutory rights, please send an email to contact@grcnow.inwith the subject line "Data Principal Statutory Request". We will acknowledge and resolve your request within 30 days.

7. Breach Notification Protocol

In the unforeseen event of a personal data security compromise, GRCNow will issue prompt statutory notifications to the Data Protection Board of India and each affected Data Principal without undue delay, in comprehensive compliance with Section 8(6) of the DPDPA and applicable regulatory rules.

8. Children's Data

Our platform and services are tailored exclusively for adult professionals and registered business enterprises. We do not knowingly process personal data belonging to minors under 18 years of age. If you believe information pertaining to a minor has inadvertently reached our systems, notify us immediately for immediate investigation and deletion.

9. Designated Grievance Officer

In accordance with the requirements of the DPDPA and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, privacy inquiries and statutory grievances may be directed to our designatedGrievance Officer at contact@grcnow.in, or via our registered corporate address and contact channels detailed in the website footer below.

10. Updates to This Policy

We reserve the right to revise this Privacy Policy to mirror modifications in our technical systems, business processes, or regulatory amendments under the DPDPA. Any changes will be published here with an updated "Last updated" date. Registered subscribers will receive prior email notification at least 14 days before any material revisions take effect.