1. Data Fiduciary and Contact Details
3 Arrows Consulting ("DataShield", "we", "us", or "our") operates as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 for personal data collected through this website. If you have questions regarding this notice or wish to exercise your statutory rights, contact our designated Grievance Officer at privacy@3arrowsconsulting.com or by post at our Gurgaon office.
2. Personal Data We Collect
We believe in strict data minimization. We only collect personal data that you voluntarily provide when submitting an assessment enquiry or contact request:
- Identity & Contact Data: Full name, professional work email address, company legal name, and telephone number.
- Enquiry Details: Information describing your project scope, compliance drivers, target timelines, and company website domain.
- Technical Telemetry: Standard server access logs (IP address, browser user-agent, timestamp) maintained solely for network security and denial-of-service mitigation in compliance with CERT-In directions.
3. Purpose and Lawful Basis for Processing
We process your personal data solely for the following specified purposes:
- To respond to your commercial assessment request and schedule a discovery discussion (lawful basis: voluntary provision under Section 4(1) and explicit consent).
- To execute mutual Non-Disclosure Agreements and scope client proposals.
- To satisfy mandatory cybersecurity logging obligations under CERT-In statutory directives.
We never sell, rent, or trade your personal data with third-party data brokers or marketing networks.
4. Data Principal Rights under DPDP
Under Section 12 and 13 of the DPDP Act, you possess statutory rights as a Data Principal:
- Right to Access: You may request a summary of the personal data we hold about you and the processing activities undertaken.
- Right to Correction & Completion: You may request the correction of inaccurate or misleading records, or the completion of incomplete data.
- Right to Erasure: You may request that we erase personal data that is no longer necessary for the purpose for which it was collected.
- Right of Grievance Redressal: You may register a complaint with our Grievance Officer, who will acknowledge your complaint within 24 hours and resolve it within statutory timeframes.
5. Data Retention Schedules
Under Section 8(7), enquiry records that do not lead to a commercial engagement are securely purged within 12 months. Client engagement records under active contracts are retained for the duration of the contract plus statutory limitation periods required under Indian commercial and taxation laws.