Your Privacy, Our Commitment

1. Introduction & Scope

1.1 Our Commitment

We are committed to protecting your privacy and being transparent about our data practices. This policy complies with:

• India's Digital Personal Data Protection Act, 2023 (DPDPA) and rules framed thereunder
• Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules)
• Reserve Bank of India (RBI) guidelines on digital payments and data storage
• Unique Identification Authority of India (UIDAI) regulations regarding Aadhaar data handling
• Income Tax Department guidelines for PAN data processing
• Consumer Protection Act, 2019 and E-Commerce Rules, 2020
• General Data Protection Regulation (GDPR) principles for international users
• Industry best practices for digital service providers and facilitators

1.2 Key Definitions

1.3 Scope of Services

This Privacy Policy applies to all services offered by ASLI FORM, including but not limited to:

• Government registration assistance (Udyam, GST, FSSAI, PAN, TAN, IEC, etc.)
• PAN card application, correction, and reissue services
• Documentation and drafting services (resumes, legal documents, agreements)
• Education services (admission forms, scholarships, certificates)
• Government job application assistance (SSC, UPSC, Railway, Banking, etc.)
• Business support services (vendor registration, tender filing, profiles)
• Digital services (website development, domain registration, SEO)
• Reminder and compliance management services
• 150+ free online tools (unit converters, calculators, PDF tools, code editors)

2. Information We Collect

2.1 Personal Information You Provide

2.2 Information Collected Automatically

2.3 Information from Third Parties

We may receive information about you from:

• Payment Processors: Razorpay, PayU, Cashfree, PayPal - transaction status, payment confirmation
• Government Portals: NSDL, UTIITSL, Income Tax Department, GST Portal - application status, verification results
• Logistics Partners: Delivery status, proof of delivery (for physical document delivery)
• Cloud Service Providers: AWS, Google Cloud - infrastructure data
• Analytics Providers: Google Analytics, Search Console - aggregated usage data
• Business Partners: Shudh Desi Taste (parent entity) for operational coordination

3. How We Use Your Information

3.1 Specific Use Cases for Digital Services

4. Legal Basis for Processing

4.1 Consent (Explicit & Informed)

We obtain your explicit, informed, and freely given consent for:

• Processing sensitive personal data (PAN, Aadhaar, bank details)
• Marketing communications via email, SMS, or WhatsApp
• Non-essential cookies and tracking technologies
• Sharing data with third parties for specific services
• Processing special category data

4.2 Contractual Necessity

Processing necessary for fulfilling our contract with you:

• Processing your service requests and delivering services
• Filling government forms on your behalf
• Creating documents as per your specifications
• Processing payments and issuing invoices
• Providing customer support and handling complaints

4.3 Legal Obligation

Processing necessary to comply with legal requirements:

• Maintaining tax records and financial accounts (7 years minimum under Income Tax Act)
• GST compliance and record keeping
• Responding to legal requests, court orders, or government inquiries
• Preventing money laundering and terrorist financing
• Complying with RBI guidelines for payment data
• Following UIDAI regulations for Aadhaar data

4.4 Legitimate Interests

Processing necessary for our legitimate business interests:

• Improving our website, services, and user experience
• Preventing fraud, security breaches, and unauthorized activities
• Conducting business analysis and service development
• Maintaining business records and internal administration
• Ensuring network and information security

5. Government ID Data Handling

5.1 PAN (Permanent Account Number) Data

For PAN-related services, we:

• Collect PAN numbers only when necessary for specific services (new PAN application, correction, linking)
• Process PAN data in compliance with Income Tax Department guidelines
• Transmit PAN data securely to authorized agencies (NSDL, UTIITSL, Income Tax Department)
• Do not store complete PAN details longer than necessary for service completion
• Maintain audit logs of all PAN data processing activities

5.2 Aadhaar Data Handling

In compliance with UIDAI regulations and the Aadhaar Act, 2016:

• We collect Aadhaar numbers only with your explicit written consent
• Aadhaar data is used solely for the specific service you've requested
• We do not store Aadhaar numbers in plain text - encryption is mandatory
• Aadhaar data is deleted immediately after successful service completion unless retention is legally required
• We do not use Aadhaar data for any purpose other than what you've explicitly authorized
• We comply with UIDAI's prohibition on storing biometric data
• We do not publish or share Aadhaar details with unauthorized parties

5.3 Other Government Identifiers

For other government IDs (passport, voter ID, driving license, etc.):

• Collected only when specifically required for the service
• Used solely for the purpose you've authorized
• Stored with appropriate encryption and access controls
• Deleted after service completion unless retention is legally mandated
• Never shared with unauthorized third parties

5.4 Your Responsibilities

When providing government ID information, you must:

• Ensure all information provided is accurate and truthful
• Provide only your own IDs or IDs you're legally authorized to use
• Not provide false or forged documents
• Understand that misuse of government IDs is a criminal offence
• Authorize us explicitly before we process your IDs

6. Data Sharing & Disclosure

6.1 Legal Disclosures

We may disclose your information when required by law:

• To comply with court orders, subpoenas, or legal processes
• To government authorities for tax, regulatory, or investigation purposes
• To law enforcement agencies as required by law
• To enforce our Terms & Conditions and other agreements
• To protect the rights, property, or safety of ASLI FORM, our users, or the public
• In connection with a business transfer (merger, acquisition, or sale of assets)

6.2 International Data Transfers

Your data may be transferred to and processed in countries outside India for cloud storage, analytics, and other services. Such transfers comply with:

• DPDPA 2023 requirements for cross-border data transfers
• Adequacy decisions or appropriate safeguards
• Standard contractual clauses where required
• Your explicit consent for specific transfers

7. Cookies & Tracking Technologies

7.1 Types of Cookies We Use

7.2 Your Cookie Choices

8. Data Retention

8.1 Data Deletion Process

Upon expiry of retention periods, we:

1. Anonymize data where possible for statistical and analytical purposes
2. Securely delete electronic records using industry-standard secure deletion methods
3. Physically destroy paper records through cross-cut shredding
4. Notify third-party processors to delete their copies where applicable
5. Maintain deletion logs for audit and compliance purposes

9. Data Security

9.1 Technical Security Measures

9.2 Organizational Security Measures

• Employee Training: Regular privacy and security awareness training for all staff
• Data Protection Officer: Designated DPO overseeing compliance with privacy laws
• Incident Response: Documented procedures for data breach response and notification
• Vendor Management: Due diligence and regular audits of third-party processors
• Business Continuity: Regular backups, Disaster recovery planning, Redundancy
• Physical Security: Secure premises, Access controls for physical records
• Clean Desk Policy: No sensitive data visible on workstations

9.3 Data Breach Notification Protocol

In the event of a data breach affecting your personal information, we will:

1. Contain the breach immediately upon detection
2. Notify the Data Protection Board of India within 72 hours (as per DPDPA)
3. Notify affected users within 72 hours of becoming aware
4. Provide details of the breach, including nature and extent
5. Outline steps we're taking to address the breach and mitigate harm
6. Suggest protective measures you can take
7. Notify UIDAI if Aadhaar data is compromised
8. Maintain transparent communication throughout the resolution process

10. Your Privacy Rights

10.1 How to Exercise Your Rights

To exercise any of these rights:

1. Submit a written request to our Data Protection Officer via email (privacy@asliform.in) or postal mail
2. Include sufficient information to verify your identity (we may ask for additional verification)
3. Specify the right(s) you wish to exercise and any relevant details
4. We will acknowledge receipt within 7 days and respond substantively within 15 days
5. No fee unless requests are manifestly unfounded, excessive, or repetitive

10.2 Limitations & Exceptions

Your rights may be limited in certain circumstances:

• When necessary to comply with legal obligations (e.g., tax records must be kept for 7 years)
• For prevention, detection, investigation, or prosecution of offences
• For enforcement of legal rights or claims
• When processing is necessary for public interest
• For research, statistical, or archival purposes (with appropriate safeguards)
• When data has been anonymized for statistical purposes

11. Children's Privacy

11.1 Our Policy Regarding Minors

• Most of our services (PAN, GST, business registration) are intended for adults
• Education services for students under 18 require parental consent and supervision
• Accounts can only be created by individuals 18 years or older
• We do not market directly to children
• Parental consent is required for any service involving minors

11.2 Parental Responsibilities

If you are a parent or guardian and believe your child has provided us with personal information:

1. Contact us immediately using the contact details in Section 14
2. Provide proof of your relationship to the child
3. We will promptly investigate and delete such information if verified
4. We may require additional verification to protect the child's privacy

12. Third-Party Tools & Services

12.1 Free Online Tools

Our website offers 150+ free online tools including:

• Unit Converters: Length, weight, volume, temperature, currency, etc.
• Financial Calculators: Loan, SIP, FD, PPF, NPS calculators
• PDF Tools: Conversion, editing, compression
• Code Editors: HTML, CSS, JavaScript, Python, Java editors
• Age & Time Calculators: Age, time duration, retirement calculators

12.2 Third-Party Integrations

Our platform integrates with various third-party services:

• Payment Gateways: Razorpay, PayU, Cashfree - PCI-DSS compliant
• Government Portals: NSDL, UTIITSL, GST Portal - Official authorized channels
• Communication: WhatsApp Business API, Email services
• Analytics: Google Analytics, Search Console
• Cloud Services: AWS, Google Cloud - ISO 27001 certified

We are not responsible for the privacy practices of third-party services. We encourage you to review their privacy policies.

13. Policy Updates & Changes

13.1 Update Notification Process

13.2 Your Acceptance of Changes

By continuing to use our services after policy updates, you accept the revised policy. If you disagree with material changes:

• You may discontinue using our services
• You may request deletion of your data as per your rights
• You may contact us with concerns before the effective date
• You may opt out of specific new processing activities where possible

14. Contact Information

14.1 Business Hours & Response Times

15. Grievance Redressal Mechanism

15.1 Grievance Officer

In compliance with the Information Technology Act, 2000 and DPDPA 2023, we have appointed a Grievance Officer:

15.2 Complaint Submission Process

15.3 Escalation to Authorities

If unsatisfied with our resolution, you may escalate to:

16. Disclaimer & Limitations

16.1 Nature of Services

• We provide assistance in filling government forms and completing registrations
• We are NOT government officials or authorized government representatives
• Government fees and charges are separate from our service charges
• Final approval of applications rests solely with respective government authorities
• We do not guarantee approval of any application
• Processing times are subject to government authority timelines

16.2 Data Accuracy

• You are responsible for providing accurate and truthful information
• We process data as provided by you - we do not verify authenticity unless specifically engaged
• False or misleading information may result in rejection of applications
• You are solely responsible for the consequences of providing incorrect information

16.3 Limitation of Liability

To the maximum extent permitted by law:

• Our liability is limited to the service fees paid by you
• We are not liable for indirect, incidental, special, or consequential damages
• We are not liable for delays caused by government authorities
• We are not liable for technical issues beyond our reasonable control
• We are not liable for actions of third-party service providers

16.4 Force Majeure

We shall not be liable for any delay or failure in performance due to events beyond our reasonable control, including but not limited to:

• Government portal downtime or technical issues
• Natural disasters, pandemics, or acts of God
• Cyber attacks, hacking, or security breaches despite our best efforts
• Changes in laws, regulations, or government policies
• Internet or telecommunications failures
• Strikes, labor disputes, or civil unrest

17. Related Policies & Documents