Legal
Privacy Policy
How we collect, use and protect your personal data, and how to exercise your rights under the Digital Personal Data Protection Act, 2023.
Version 1.0 · Effective 12 November 2026 · Last updated 12 November 2026
1. Who we are
This Privacy Policy explains how Thinkbiz Professionals LLP (LLPIN AAZ-4696), a limited liability partnership with its office at A-83, 1st Floor, Sector 63, Noida, Uttar Pradesh 201301, India, together with its partners, its associate firms, the sole-proprietorship firms of its partners (such as Agarwal Archit & Associates) and the portals they operate (such as www.beposhcomplied.com) (together, "Thinkbiz", "we", "us"), handle personal data collected through www.thinkbiz.in and those portals (together, the "Website").
For the personal data described in this policy, each member of Thinkbiz that decides why and how that data is processed is a Data Fiduciaryunder the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025 (the "DPDP Rules"). This policy is our notice to you under Section 5 of the DPDP Act.
You can contact us about anything in this policy at team@thinkbiz.in, by phone on +91 93191 92250, or by post at the address above.
2. Scope
This policy covers personal data we collect through the Website — mainly the Contact Us form, the publication access form, WhatsApp messages, and analytics. It does not cover:
- personal data we process while providing professional services to clients, which is governed by the engagement letter and applicable professional and legal obligations;
- personal data that our business customers enter into our software products (such as bePOSHcomplied and StatutoryIQ) while using them, which we process on the customer's behalf under our agreement with that customer;
- third-party websites we link to.
3. Personal data we collect, and why
We collect only the personal data needed for the purposes below.
| When | Personal data | Purpose | Basis |
|---|---|---|---|
| You submit the Contact Us form | Name; email address and/or phone number (at least one); subject; message, and any personal data you choose to include in it | To respond to your enquiry; to understand your requirement, check for conflicts of interest and propose an engagement; to schedule a consultation. | Your consent (Section 6) |
| You request a gated publication | Name; phone number or email address; company or organisation; the publication you accessed | To give you access to the publication; to follow up with you about its subject. | Your consent (Section 6) |
| You message us on WhatsApp | Phone number; WhatsApp profile name; your messages and anything you choose to share in them | To reply to you and handle your enquiry. | Legitimate use — you provided it voluntarily (Section 7(a)) |
| You opt in to updates by email, WhatsApp message or call (optional, on either form) | Name; email address and/or phone number | To send you updates on new publications, insights, regulatory updates and event invitations. | Your separate, optional consent |
| Each time you give consent | Date and time; version of this policy; which consents you gave | To keep a record that consent was given, as we are required to prove it (Section 6(10)). | Legal obligation (Section 7) |
| You browse the Website | Cookie identifiers; pages viewed; approximate location (city level); device, browser and referring site | To understand how the Website is used and improve it (Google Analytics). | Your consent / legitimate use — see section 13 |
| Every request to the Website | IP address; date and time; pages requested; browser information (server logs) | To keep the Website secure, prevent spam and abuse, and investigate incidents. | Legal obligation and security (Section 7 and DPDP Rules) |
Please do not send confidential documents or sensitive information (for example, financial account details or identity numbers) through the Website forms. If we take up your matter, we will agree a secure way to exchange such information.
We do not use your personal data for automated decision-making, and we do not sell your personal data.
4. Your consent
- Consent is given by ticking the box on the form, which is unticked by default. We do not process your form details without it.
- Consent to updates by email, WhatsApp message or call is separate and optional. Not giving it, or withdrawing it, does not affect your enquiry or your access to publications.
- You can withdraw any consent at any time, as easily as you gave it — see section 9. Withdrawal does not affect processing already carried out before you withdrew.
- When you withdraw consent, we will stop processing and erase the related data within a reasonable time, unless we are required by law to keep it.
6. Where your data is processed
Some of our service providers store or process data on servers outside India (for example, in the United States, the European Union or Singapore). Section 16 of the DPDP Act permits such transfers except to countries restricted by the Central Government. We will not transfer personal data to any restricted country, and our providers are bound to protect it.
7. How long we keep personal data
| Data | How long |
|---|---|
| Contact form and WhatsApp enquiries that do not lead to an engagement | 3 years from our last communication, then erased |
| Enquiries that lead to an engagement | Held as part of the client file, for the period required by law and professional standards |
| Publication access details | 3 years from your last interaction, then erased |
| Subscribers to updates by email, WhatsApp message or call | Until you unsubscribe or withdraw consent |
| Consent records | As long as the related data is held, plus 3 years |
| Server and security logs | At least 1 year, as required under the DPDP Rules |
| Google Analytics data | 14 months |
If you withdraw consent earlier, we erase the related data sooner, unless the law requires us to keep it.
8. Your rights
Under the DPDP Act you have the right to:
- Access information (Section 11): a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction, completion, updating and erasure (Section 12): ask us to correct inaccurate or incomplete data, update it, or erase data that is no longer needed.
- Grievance redressal (Section 13): have a complaint about our handling of your data addressed by us.
- Nominate (Section 14): nominate another person to exercise your rights in case of your death or incapacity.
- Withdraw consent at any time (Section 6(4)).
To exercise any right, email team@thinkbiz.inwith the subject "Data request", stating your name, the email address or phone number you used on the Website, and what you would like us to do. We may ask you to confirm your identity before acting. We will acknowledge your request within 7 days and respond within 30 days.
When exercising your rights, please provide accurate information and do not file false or frivolous requests (Section 15 of the DPDP Act).
9. How to withdraw consent
- Email team@thinkbiz.in with the subject "Withdraw consent", stating the email address or phone number you used; or
- for email updates, click Unsubscribe at the bottom of any email we send; for WhatsApp messages or calls, tell us in your reply or on the call.
10. Grievances and complaints
If you have a concern about how we handle your personal data, please write to us first at team@thinkbiz.inwith the subject "Privacy grievance". We will acknowledge it within 7 days and aim to resolve it within 30 days.
If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India in the manner it specifies. Under Section 13(3) of the DPDP Act, you need to use our grievance process first.
11. Children
The Website is meant for businesses and adults. It is not directed at children (persons under 18). We do not knowingly collect personal data of children. If you believe a child has given us personal data, please contact us and we will erase it.
12. Security
We use reasonable security safeguards to protect personal data, including encrypted connections (HTTPS), access controls on our systems and database, restricted access to form submissions, and contractual obligations on our service providers.
If a personal data breach occurs, we will inform the Data Protection Board of India and each affected person, as required by Section 8(6) of the DPDP Act and the DPDP Rules.
14. Language
This policy is available in English. On request, we will provide it in any language listed in the Eighth Schedule to the Constitution of India.
15. Changes to this policy
We may update this policy from time to time. The current version and its effective date are shown at the top. If a change materially affects how we use personal data you have already given us, we will tell you and, where required, ask for your consent again.
16. Contact
Thinkbiz Professionals LLP (LLPIN AAZ-4696) · A-83, 1st Floor, Sector 63, Noida, Uttar Pradesh 201301, India · team@thinkbiz.in · +91 93191 92250