Draft for review. [REVIEW: this policy is a plain-language draft, not legal advice. Remove this notice once a lawyer and CA have reviewed it.] Items marked in blue need checking; items in yellow need your details.

Privacy Policy

Last updated: [PLACEHOLDER: date of publishing]

1.1 Who we are

This website, sanketjiwane.com (the "Site"), is run by Sanket Jiwane, an individual based in Pune, Maharashtra, India [PLACEHOLDER: trade name, if operating as a sole proprietorship] ("I", "me", "we", "us"). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), I am the Data Fiduciary for personal data collected through this Site. [CA/LAWYER TO CHECK: applicability of DPDP Act and DPDP Rules timelines to an individual / sole proprietor, and any exemptions]

Contact for privacy questions and grievances: [PLACEHOLDER: email] | [PLACEHOLDER: postal address, Pune, Maharashtra]

This Site is my personal website. It is separate from Growloc Private Limited, where I am Co-founder & Director and CEO. Growloc does not receive personal data collected through this Site.

1.2 What personal data I collect

• Contact and enquiry forms: name, email, phone/WhatsApp number, organisation, event or startup details, and your message.
• Consulting bookings: name, email, phone, the details you share about your farm or business, documents you send for review, and booking details (date, time) through Calendly.
• Payments (UPI at launch): the payment screenshot you send, which may show your name, UPI ID or bank name, transaction ID, amount and date. I do not collect your UPI PIN, card numbers or bank passwords. When Razorpay checkout is added, payment details will be processed by Razorpay under its own policies.
• Digital product orders: name, email address for delivery, and payment details as above.
• Newsletter: email address (and name, if you give it), plus standard engagement data collected by Beehiiv such as opens and clicks.
• Website usage: basic technical data such as IP address, browser, device and pages visited, collected through my hosting provider (Cloudflare) and any analytics tools I enable [PLACEHOLDER: list analytics tools, e.g. Cloudflare Web Analytics / Google Analytics, if used]. Cookies are described in section 1.9.

Please don't send sensitive information (for example health or financial account details) unless it's needed for your consultation.

1.3 Why I use your data (purposes)

• To reply to your enquiry and arrange speaking, mentoring or consulting
• To confirm your payment, send your booking link and run your call
• To deliver digital products and updates you're entitled to
• To issue invoices and keep records required by law (for example tax records) [CA/LAWYER TO CHECK: retention periods under GST / Income Tax rules]
• To send the newsletter you subscribed to
• To keep the Site secure and understand, in general, how it is used

I do not sell your personal data. I do not use it for purposes unrelated to the ones above without asking you.

1.4 Legal basis: consent and legitimate uses

I process your personal data on the basis of your consent, which you give when you submit a form, make a payment and share details, book a call or subscribe. Some processing also falls under legitimate uses permitted by the DPDP Act, for example where you voluntarily provide data for a specific purpose (such as sending me a payment screenshot so I can confirm your booking), or where I must keep records to comply with law. [CA/LAWYER TO CHECK: correct reliance on Section 7 "certain legitimate uses"]

You can withdraw consent at any time by writing to [PLACEHOLDER: email] or, for the newsletter, by clicking "unsubscribe". Withdrawal doesn't affect processing already done, and I may still keep data I'm legally required to keep.

1.5 Who I share data with (service providers)

I use trusted service providers who process data on my behalf (Data Processors) only to provide their service:

I may also disclose data if required by law, a court order or a government authority.

1.6 International transfers

Some providers (for example Calendly, Beehiiv and Google) may store or process data outside India. I use them only as permitted under Indian law and any restrictions the Government of India notifies under the DPDP Act. [CA/LAWYER TO CHECK: cross-border transfer position under Section 16 and notified restrictions]

1.7 How long I keep data

• Enquiries: up to [PLACEHOLDER: e.g. 2 years] after our last contact, unless we start working together
• Consulting notes and documents you send: up to [PLACEHOLDER: e.g. 2 years] after the call; deleted sooner on request, unless I must keep them
• Payment and invoice records: as long as tax law requires [CA/LAWYER TO CHECK: e.g. GST/Income Tax record-keeping periods]
• Newsletter: until you unsubscribe, then removed or suppressed within [PLACEHOLDER: e.g. 30 days]

When data is no longer needed, I delete or anonymise it. [CA/LAWYER TO CHECK: erasure obligations and timelines under DPDP Rules]

1.8 Your rights

Under the DPDP Act you can:

• Access: ask for a summary of your personal data I hold and how I use it
• Correct and update: ask me to correct, complete or update your data
• Erase: ask me to delete your data, unless I must keep it by law
• Withdraw consent: at any time, as easily as you gave it
• Grievance redressal: raise a complaint with me and get a response
• Nominate: nominate someone to exercise your rights in case of death or incapacity

To use any right, email [PLACEHOLDER: email] with the subject "Privacy request". I'll reply within [PLACEHOLDER: e.g. 30 days] [CA/LAWYER TO CHECK: response timeline required by DPDP Rules]. If you're not satisfied with my response, you may approach the Data Protection Board of India.

1.9 Cookies

The Site may use cookies needed for it to work, and [PLACEHOLDER: analytics / marketing cookies, if any]. You can block or delete cookies in your browser settings; some parts of the Site may not work properly without them. [CA/LAWYER TO CHECK: whether a cookie consent banner is required for the tools used]

1.10 Security

I take reasonable security steps, such as using reputable providers, strong passwords and two-factor authentication, and limiting who can access data. No method of transmission or storage is 100% secure. If a personal data breach occurs, I will inform affected people and the Data Protection Board as required by law. [CA/LAWYER TO CHECK: breach notification requirements under DPDP Rules]

1.11 Children

This Site and its services are meant for adults (18 and above). I do not knowingly collect personal data from children. If you believe a child has shared data with me, please write to me and I will delete it. [CA/LAWYER TO CHECK: verifiable parental consent obligations]

1.12 Changes

I may update this policy. The "Last updated" date will change, and significant changes will be highlighted on the Site or by email.

1.13 Grievance contact

Grievance contact: Sanket Jiwane | [PLACEHOLDER: email] | [PLACEHOLDER: postal address, Pune, Maharashtra, India] [CA/LAWYER TO CHECK: whether a designated Grievance Officer is required under the IT Rules / Consumer Protection (E-Commerce) Rules, 2020 for this set-up]