1. Legislative Framework & DPDP Act, 2023 Alignment
CraftEgon Corporate Services (CCS) complies strictly with the Digital Personal Data Protection Act, 2023 (DPDP Act) enacted by the Parliament of India. This Data Policy sets forth our institutional architecture for managing digital personal data belonging to directors, promoters, key managerial personnel, and enterprise stakeholders.
2. Roles: Data Fiduciary & Data Processor
Under the DPDP Act, 2023:
- CraftEgon as Data Fiduciary: When determining the purposes and means of processing personal data directly provided by clients for advisory, onboarding, and platform accounts.
- CraftEgon as Data Processor: When processing employee payroll data, POSH inquiries, or HR governance records on behalf of client enterprise accounts.
3. Itemized Consent & Notice Protocol
In accordance with Section 6 of the DPDP Act, 2023, data intake on CCS is governed by clear, standalone notices outlining:
- The specific personal data requested (e.g. Aadhaar, PAN, Passport).
- The precise statutory purpose (e.g. DIN allotment, MCA SPICe+ filing).
- The manner in which the Data Principal may exercise statutory rights or file grievances.
Consent is collected via explicit affirmative digital actions and can be managed or reviewed via our compliance desk.
4. Statutory Data Retention vs. Right to Erasure
Because corporate records are governed by the Companies Act, 2013 (requiring 8-year statutory retention of books and filings), the Income Tax Act, 1961 (6 to 10 years assessment audit retention), and the Prevention of Money Laundering Act (PMLA), 2002, certain KYC records cannot be expunged prior to the expiration of mandatory statutory periods.
5. Data Principal Rights Architecture
Every Data Principal interacting with CraftEgon retains enforceable statutory rights:
Right to Access
Request a summary of personal data being processed and identities of all professional entities with whom it was shared.
Right to Correction
Correct misleading, inaccurate, or outdated KYC and directorship records across active platform accounts.
Right to Grievance Redressal
Access rapid institutional resolution of privacy concerns prior to escalating to the Data Protection Board of India.
Right to Nominate
Nominate an individual to exercise data rights in the event of death or incapacity of the corporate principal.
6. Data Localization & Cross-Border Transfers
All primary corporate client registries, encrypted DSC tokens, and statutory e-forms are hosted exclusively in Tier-4 enterprise data centers geographically located within the sovereign borders of the Republic of India, adhering strictly to Central Government transfer restrictions.
7. Data Protection Officer (DPO) Contact
For data protection inquiries or to exercise your statutory rights under the DPDP Act, 2023, contact our designated Data Protection Officer:
Designation: Data Protection Officer (DPO)
Email: dpo@craftegon.com | support@craftegon.com
Telephone: +91 99952 04905
Address: CraftEgon Corporate Services, Technopark, Trivandrum, Kerala 695581, India