Privacy Notice

Effective date: 29 June 2026 · Version 1.0

TruPath Compliance is a brand of TruPath Consulting LLP (LLPIN ACZ-2776), having its registered office at Jaipur, Rajasthan – 302012 ("TruPath", "we", "us", or "our"). This Privacy Notice explains how we collect, use, share, retain, and protect personal data when you visit trupathcompliance.com (the "Website"), subscribe to our updates, contact us, or engage our services.

We have written this Notice to meet the requirements of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules framed under it, read with the Information Technology Act, 2000 and the rules made thereunder to the extent in force. Defined terms such as Data Principal, Data Fiduciary, Data Processor, and personal data carry the meanings given to them in the DPDP Act.

Under the DPDP Act, when we determine the purpose and means of processing your personal data in connection with the Website and our direct relationship with you, we act as a Data Fiduciary. When we process personal data on behalf of a client — for example, data handled within our platform or during a service engagement, on that client's instructions — we act as a Data Processor, and the client's own privacy notice governs that processing.

1. The personal data we collect

We practise data minimisation: we collect only what we need for a stated purpose. Depending on how you interact with us, this may include:

Identity and contact data — your name, work email address, company name, and any details you choose to include in a message to us.
Engagement data — the nature of your enquiry, the entity stage you select, the service you are interested in, and correspondence between us.
Subscription data — your email address and, optionally, company and industry, if you subscribe to our newsletter or legal updates.
Technical data — limited information generated when you visit the Website, such as IP address, browser type, device type, and pages viewed, where collected by our hosting or analytics providers.

We do not seek to collect special categories of sensitive data through the Website, and we ask that you do not send us such data in free-text fields.

2. How we collect it

Directly from you — when you complete the contact form, subscribe to updates, email us, or engage our services.
Automatically — through limited technical logging by our hosting provider and, if deployed, a privacy-respecting analytics tool. See Section 9 (Cookies).
From a client or third party — where you are an authorised representative of a client and your details are provided to us to deliver a service. In such cases we typically act as a Data Processor.

3. Purposes and lawful basis for processing

Consistent with the DPDP Act, we process personal data only on the basis of your consent or for certain legitimate uses permitted by the Act. We process your personal data to:

respond to your enquiry and provide the information or service you request;
send you our newsletter and legal updates, where you have subscribed;
administer, secure, and improve the Website;
maintain records of our communications and engagements; and
comply with applicable legal and regulatory obligations.

Where we rely on consent, that consent is free, specific, informed, unconditional, and unambiguous, given by a clear affirmative action, and limited to the purpose for which it is sought. You may withdraw your consent at any time (see Section 6). The consequence of withdrawal will not affect the lawfulness of processing carried out before the withdrawal, and you bear the consequences of such withdrawal as contemplated by the DPDP Act.

We will not use your personal data for a purpose that is incompatible with the purpose for which it was collected without first informing you and, where required, obtaining fresh consent.

4. How we share personal data

We do not sell your personal data. We share it only as set out below.

We engage the following categories of Data Processors / sub-processors, who process personal data on our behalf, on our instructions, and under contractual obligations consistent with this Notice:

Website hosting — Vercel Inc., which hosts and serves the Website.
Transactional email — Resend, which delivers email generated by the Website (such as contact-form and subscription messages). Such email may be processed on infrastructure located outside India.
Email and productivity — Google LLC (Google Workspace), through which we receive and manage correspondence.

We may also share personal data with:

Professional advisers — such as our lawyers, auditors, or company secretaries, where reasonably necessary.
Legal and regulatory disclosure — where we are required to disclose personal data to comply with applicable law, a binding order of a court or authority, or to establish, exercise, or defend legal claims.
Business transfer — if our business or assets are reorganised, merged, or transferred, in which case the recipient will be bound by obligations consistent with this Notice.

5. Cross-border processing

We primarily store and process personal data on infrastructure located in or serving India. Where a sub-processor processes personal data outside India, we do so in accordance with Section 16 of the DPDP Act, and we will not transfer personal data to any country or territory that the Central Government restricts by notification.

6. Your rights as a Data Principal

The DPDP Act gives you, as a Data Principal, the following rights in respect of personal data processed on the basis of your consent:

Right to access information — to obtain a summary of the personal data we process about you and the processing activities we undertake.
Right to correction and erasure — to have inaccurate or misleading data corrected, incomplete data completed, data updated, and your personal data erased where it is no longer necessary for the purpose for which it was processed, unless retention is required by law.
Right of grievance redressal — to a readily available means of registering a grievance with us (see Section 11).
Right to nominate — to nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, or to withdraw consent, contact our Grievance Officer (Section 11). We will respond within the period prescribed by the DPDP Act and the rules framed under it. We may need to verify your identity before acting on a request. You are responsible for the accuracy and completeness of the information you provide, and you agree not to make any false or frivolous request, suppress material information, or impersonate another person, as contemplated by the DPDP Act.

7. Retention

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required to comply with a legal obligation, or to establish, exercise, or defend legal claims. When personal data is no longer required for its purpose and we are not required by law to retain it, we will erase it or anonymise it. Subscription data is retained until you unsubscribe and for a short period thereafter to give effect to your request.

8. Security

We implement reasonable security safeguards to protect personal data against unauthorised access, disclosure, alteration, and loss, including access controls, encryption in transit, and limiting access on a need-to-know basis. No method of transmission or storage is completely secure; while we work to protect your personal data, we cannot guarantee absolute security. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in the manner required by the DPDP Act.

9. Cookies and analytics

The Website uses only the cookies and similar technologies necessary for it to function and, where deployed, a privacy-respecting analytics tool used to understand aggregate usage. Where the law requires consent for any non-essential cookie, we will obtain it before such a cookie is set, and we will update this Section to describe the analytics tool in use. You can control or delete cookies through your browser settings.

10. Children's data

The Website and our services are directed at businesses and professionals, not at children. We do not knowingly collect the personal data of children (individuals below the age of eighteen years) and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. Where we become aware that we have inadvertently collected a child's personal data without the verifiable consent of a parent or lawful guardian as required by Section 9 of the DPDP Act, we will erase it.

11. Grievance Officer and contact

If you have any question, request, or grievance about this Notice or how we handle your personal data, contact:

Grievance Officer, TruPath Consulting LLP
Registered office: Jaipur, Rajasthan – 302012
Email: info@trupathcompliance.com

We will acknowledge and respond to your grievance within the period prescribed under the DPDP Act and the rules framed under it. If you are not satisfied with our response, you have the right to register a complaint with the Data Protection Board of India in accordance with the DPDP Act.

12. Changes to this Notice

We may update this Notice from time to time to reflect changes in law, our practices, or our services. We will post the revised Notice on this page with a new version number and "last reviewed" date. Where a change is material and the law requires it, we will take additional steps to notify you. Your continued use of the Website after a change takes effect constitutes acknowledgement of the updated Notice.

13. Governing law and jurisdiction

This Notice is governed by and construed in accordance with the laws of India. Subject to any provision of the DPDP Act conferring jurisdiction on the Data Protection Board of India or an appellate authority, the courts at Jaipur, Rajasthan shall have exclusive jurisdiction over any dispute arising out of or in connection with this Notice.