Privacy Policy & Data Notice

1. Introduction & Data Fiduciary Identity

This Privacy Notice is issued by CraftEgon LLP, operating as CraftEgon Corporate Services (CCS) ("we", "us", or "our"), having its registered corporate desk in Kozhikode, Kerala, India (PIN 673001). We act as a Data Fiduciary in respect of digital personal data collected through this website (https://ccs.craftegon.com) and our corporate consultation desks.

We are committed to processing your personal data lawfully, fairly, and transparently, adhering strictly to the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and applicable Indian data privacy regulations.

2. Principle of Minimal Data Intake

We do not collect sensitive identity documents (such as unmasked Aadhaar numbers, director passport scans, bank account statements, or biometric data) through unauthenticated public web forms. Our public web intake is restricted strictly to:

• Contact Coordinates: Full Name, Business Email Address, and WhatsApp/Mobile Phone Number.
• Corporate Service Parameters: Proposed entity type, selected practice vertical, and general commercial objectives.
• Optional Statutory Identifiers: Entity PAN, Director DIN, or GSTIN provided voluntarily for preliminary public-register status verification.

3. Lawful Basis and Purpose of Processing

Under Sections 4, 5, and 6 of the DPDP Act 2023, personal data is processed solely for specified, lawful business purposes:

• To review, evaluate, and scope your corporate service requirements.
• To conduct statutory conflict checks with empaneled Practising Company Secretaries, Chartered Accountants, and Trademark Agents.
• To transmit itemized fee schedules, timeline estimates, and formal engagement proposals.
• To comply with statutory identity verification obligations mandated by the Ministry of Corporate Affairs (MCA) and Registrar of Companies (RoC).

4. Transfer and Sharing of Data

CraftEgon strictly does not sell, rent, or trade client information to third-party telemarketers or advertisers. Client data is disclosed only to:

• Empaneled Certifying Professionals: Practising Company Secretaries (ICSI) and Chartered Accountants (ICAI) assigned to certify and attest your statutory e-forms under Digital Signature Certificates.
• Government Portals: Direct submission to official regulatory portals (MCA V3, GSTN, IP India, Ministry of MSME) pursuant to your authorized corporate filing instructions.
• Independent Legal Advocates: In cases of contentious litigation referral, only upon your explicit request.
• Law Enforcement Authorities: When compelled by valid summons, statutory warrant, or court order under Indian law.

5. Data Retention & Security Architecture

We maintain appropriate administrative, technical, and physical security measures:

• Static Infrastructure: The public website operates on a static, serverless edge architecture without an exposed public database, eliminating SQL injection and database breach vectors.
• Transit Encryption: All communications enforce TLS 1.3 encryption and HSTS (HTTP Strict Transport Security).
• Retention Limits: Scoping inquiries that do not materialize into a formal engagement are securely deleted after 90 days. Data relating to completed statutory filings is archived in accordance with the mandatory 8-year statutory record retention rules of the Companies Act 2013.

6. Rights of the Data Principal

Under Section 11, 12, and 13 of the DPDP Act 2023, you enjoy statutory rights regarding your personal data:

• Right to Access: You may request a summary of your personal data processed by us and the identities of professionals with whom it has been shared.
• Right to Correction & Erasure: You may request correction of inaccurate data or deletion of data no longer necessary for the purpose for which it was collected (subject to statutory MCA compliance retention requirements).
• Right to Grievance Redressal: You have the right to register a grievance with our designated Grievance Officer.

7. Designated Grievance Officer

8. Updates to this Policy

We may revise this Privacy Notice periodically to reflect changes in regulatory standards or operational procedures. Material updates will be published on this page with an updated effective date.