Data Protection Policy

MaquishTech Venture Pvt Ltd ("MaquishTech", "we", "us", or "our") is committed to protecting the privacy and personal data of our clients, employees, contractors, website visitors, and any other individuals whose information we process. Headquartered at GIDA Sector 7, Badgahan, Gorakhpur, Uttar Pradesh – 273212, India, we operate as a responsible data controller and processor in the course of delivering technology, staffing, consulting, and venture services. This Data Protection Policy describes, in plain language, how we collect, use, store, share, and safeguard personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the General Data Protection Regulation (GDPR) where applicable, and other relevant data protection laws. This policy applies to all personal data processed by MaquishTech regardless of the medium (online forms, email, telephone, paper records, or third-party platforms) and to all systems, employees, and vendors acting on our behalf.

1. Data Protection Principles

We adhere to the following principles, which form the foundation of our data protection programme:

• Lawfulness, Fairness, and Transparency: We process data with a valid legal basis, in a fair manner, and we inform individuals about our practices through this policy and privacy notices at the point of collection.
• Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes and is not further processed in a manner incompatible with those purposes.
• Data Minimisation: We collect only the data that is adequate, relevant, and necessary for the stated purposes, and we regularly review collection forms to remove unnecessary fields.
• Accuracy: We keep personal data accurate and up to date, and we provide individuals with the means to correct inaccuracies promptly.
• Storage Limitation: Data is retained only as long as necessary to fulfil the purposes for which it was collected, after which it is securely deleted or anonymised.
• Integrity and Confidentiality: Data is secured against unauthorised access, accidental loss, destruction, or damage using appropriate technical and organisational measures.
• Accountability: We can demonstrate compliance with these principles through documentation, records of processing activities, and regular internal reviews.

2. Data We Process

We process the following categories of personal data, each tied to a specific business purpose:

• Client and lead contact information: name, email address, phone number, job title, and company, used to respond to enquiries and deliver services.
• Project data: requirements, briefs, specifications, and correspondence, used to scope and deliver client engagements.
• Payment and billing records: invoicing details, tax identification numbers, and transaction history, used for accounting and statutory compliance.
• Website analytics and technical data: IP address, browser type, device information, and usage patterns, used to improve site performance and security.
• Employee and contractor data: identity documents, payroll information, performance records, and emergency contacts, used for human resources administration.
• Marketing data: newsletter subscriptions and engagement metrics, used only with explicit consent.

3. Data Protection Officer

MaquishTech Venture Pvt Ltd has designated a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and ensuring compliance with applicable laws. The DPO serves as the primary point of contact for data subjects, the Data Protection Board of India, and other regulatory authorities. The DPO's responsibilities include monitoring internal compliance, advising on data protection impact assessments, conducting awareness training, cooperating with supervisory authorities, and handling data subject requests in a timely manner. The DPO operates independently and reports directly to senior management to ensure that data protection considerations are embedded in all business decisions.

You may contact our Data Protection Officer using the details below:

• Email: Ankur@AnpaCorporation.com
• Phone: +91 9650697032
• Postal address: GIDA Sector 7, Badgahan, Gorakhpur, Uttar Pradesh – 273212, India

We aim to acknowledge all enquiries within five working days and to provide a substantive response within thirty days, in accordance with statutory timelines.

4. Lawful Basis for Processing

We rely on the following lawful bases when processing personal data, and we document the basis for each processing activity:

• Consent: The individual has given clear, affirmative consent to the processing of their data for a specific purpose, such as subscribing to a newsletter. Consent can be withdrawn at any time.
• Contractual necessity: Processing is necessary to perform a contract with the individual or to take steps before entering into one, such as delivering a commissioned project or issuing an invoice.
• Legal obligation: Processing is required to comply with a legal obligation, such as maintaining tax records or responding to lawful requests from authorities.
• Vital interests: Processing is necessary to protect the vital interests of an individual, such as in a medical emergency involving an employee.
• Public task: Processing is necessary for a task carried out in the public interest or in the exercise of official authority, where applicable.
• Legitimate interests: Processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by the individual's rights. This includes fraud prevention, network security, and business analytics.

For processing based on consent, we ensure that consent is freely given, specific, informed, and unambiguous, and we maintain records demonstrating how consent was obtained.

5. Data Processing Activities

We maintain a record of processing activities that describes each operation we perform on personal data. Our principal processing activities include:

• Lead management: collecting enquiry submissions from our website and routing them to the relevant sales team for follow-up.
• Service delivery: storing project briefs, deliverables, and communications to fulfil client contracts.
• Billing and accounting: generating invoices, recording payments, and maintaining financial records for audit and tax purposes.
• Recruitment and HR: processing job applications, conducting background checks, and managing employee lifecycle data from onboarding through exit.
• IT operations: logging system events, monitoring security, and maintaining access controls to protect information assets.
• Marketing: sending promotional communications to individuals who have opted in, and measuring engagement to improve relevance.
• Vendor management: assessing and onboarding suppliers who may process data on our behalf, under written agreements.

6. Data Subject Rights

Under applicable laws, individuals whose data we process have the following rights:

• Right to be informed: to receive clear information about how their data is used.
• Right of access: to obtain a copy of the personal data we hold about them.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure: to request deletion of their data, subject to legal retention obligations.
• Right to restrict processing: to limit how we use their data in certain circumstances.
• Right to data portability: to receive their data in a structured, machine-readable format and transmit it to another provider.
• Right to object: to object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent: to withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: to complain to the Data Protection Board of India or the relevant supervisory authority.

7. Data Subject Access Requests

Individuals may exercise any of the rights above by submitting a request to our Data Protection Officer at Ankur@AnpaCorporation.com. We will verify the identity of the requester using reasonable means before disclosing any personal data. Requests are handled free of charge, although we may charge a reasonable fee for manifestly unfounded or excessive requests. We respond to access requests within thirty days of receipt; where a request is complex, this period may be extended by a further two months, in which case we will inform the requester of the extension and the reasons for it within the initial thirty days. If we refuse to act on a request, we will explain the reasons and inform the requester of their right to complain to the Data Protection Board of India.

8. Data Security Measures

We implement a layered security programme designed to protect personal data against unauthorised access, alteration, disclosure, and destruction. Our measures include:

• Encryption in transit: HTTPS/TLS encryption for all data transmitted between users and our systems.
• Password security: password hashing using bcrypt and enforced strong password policies.
• Access controls: role-based access controls following the principle of least privilege, with access reviews conducted quarterly.
• Secure payments: payment processing through PCI-DSS compliant gateways; we never store full card details.
• Network security: firewalls, intrusion detection, and regular vulnerability scanning of internet-facing systems.
• Physical security: restricted access to premises and secure disposal of paper records.
• Backup and recovery: encrypted, geographically separated backups with tested restoration procedures.
• Security reviews: periodic penetration testing and independent security assessments.

9. Data Breach Response

In the event of a personal data breach, MaquishTech follows a documented incident response plan. Our response includes the following steps:

• Containment and assessment: the breach is contained and its scope assessed within 24 hours of discovery.
• Notification: affected individuals and the Data Protection Board of India are notified within 72 hours where the breach is likely to result in a risk to individuals.
• Documentation: the breach, its effects, and the actions taken are recorded in our breach register.
• Remediation: corrective measures are implemented to prevent recurrence, and lessons learned are shared with relevant teams.
• Post-incident review: a review is conducted to evaluate the effectiveness of the response and to update controls where necessary.

10. International Data Transfers

MaquishTech primarily processes personal data within India. Where we transfer personal data outside India—for example, to cloud service providers or to support global clients—we ensure that the transfer is subject to appropriate safeguards. These safeguards include standard contractual clauses approved by the relevant authority, binding corporate rules, adequacy assessments of the destination country's data protection regime, or explicit consent from the individual. We maintain records of all international transfers, including the categories of data transferred, the recipient, and the safeguard relied upon. We do not transfer data to jurisdictions that lack an adequate level of protection unless a suitable safeguard is in place.

11. Data Retention

We retain personal data only as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements. Our retention schedule is as follows:

• Lead and enquiry data: 2 years from the last interaction.
• Client project data: 7 years, for tax and audit compliance.
• Payment records: 7 years, as required by Indian tax law.
• Website analytics: 26 months.
• Employee records: 7 years after the end of employment, or longer where required by law.
• Marketing data: until the individual withdraws consent or 2 years of inactivity, whichever is sooner.

At the end of the retention period, data is securely deleted or anonymised so that it can no longer identify an individual.

12. Children's Data

Our services are directed at businesses and professionals, and we do not knowingly collect personal data from children under the age of 18. Where we process data that may relate to a child—for example, through a parent or guardian acting on their behalf—we obtain verifiable parental consent in accordance with the DPDP Act. If we become aware that we have collected personal data from a child without the required consent, we take steps to delete that data promptly. Parents or guardians may contact our Data Protection Officer to review, correct, or delete any data relating to their child.

13. Employee Data

We process employee and contractor data for legitimate HR purposes, including recruitment, payroll, performance management, and statutory compliance. The categories of data we process include identity documents, contact details, bank account information for salary credits, tax declarations, attendance records, and performance evaluations. We rely on contractual necessity and legal obligation as the primary lawful bases for processing employee data. Employee data is accessible only to authorised HR and management personnel, and access is reviewed regularly. Employees have the right to access, correct, and, where applicable, request deletion of their personal data, subject to legal retention requirements.

14. Vendor and Processor Agreements

Where we engage third-party vendors or processors to handle personal data on our behalf, we do so only under a written data processing agreement that meets the requirements of the DPDP Act and the GDPR. These agreements specify the purposes of processing, the categories of data involved, the security measures to be applied, and the vendor's obligations to assist us in fulfilling data subject requests and breach notifications. We conduct due diligence on vendors before onboarding and review their compliance periodically. Vendors are prohibited from engaging sub-processors without our prior written authorisation, and they are required to delete or return all personal data at the end of the engagement.

15. Training and Awareness

We believe that effective data protection depends on a culture of awareness. All employees and contractors receive data protection training as part of their onboarding and refresher training annually thereafter. Training covers the principles of data protection, individuals' rights, secure handling of personal data, breach reporting procedures, and the proper use of access controls. We also conduct targeted training for teams handling sensitive data, such as HR and finance. Completion of training is tracked, and additional resources are made available through our internal knowledge base. We regularly reinforce key messages through internal communications and simulated phishing exercises to keep security top of mind.

16. Changes to This Policy

We may update this Data Protection Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated through our website or directly to affected individuals where appropriate. The date at the top of this policy indicates when it was last updated. We encourage visitors to review this page periodically to stay informed about how we protect personal data.

17. Contact

For data protection enquiries, to exercise your rights, or to raise a concern about how we handle personal data, please contact our Data Protection Officer:

• Email: Ankur@AnpaCorporation.com
• Phone: +91 9650697032
• Address: GIDA Sector 7, Badgahan, Gorakhpur, Uttar Pradesh – 273212, India

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India or the relevant supervisory authority in your jurisdiction.