Privacy Policy

1. Who We Are and Scope

Growify Consulting ("Growify", "we", "our" or "us") is an upcoming boutique consulting initiative based in Bengaluru, India, focused on growth transformation, executive advisory and strategic partnerships. As at the date of this Policy, Growify Consulting has not been incorporated or registered as a separate legal entity. Amit Joseph is the individual responsible for the initiative and its handling of personal data. This Privacy Policy applies to personal data collected through the Growify website, enquiries, professional communications and activities undertaken in connection with the initiative.

For personal data where Growify determines the purposes and means of processing, Growify acts as a Data Fiduciary under the DPDP Act. Where we process personal data solely on a client’s documented instructions, the client may be the relevant Data Fiduciary; the applicable client notice and contractual arrangements will also govern that processing.

"Personal data" means data about an individual identifiable by or in relation to that data. This Policy covers digital personal data and personal data collected offline and subsequently digitised, to the extent covered by applicable law.

2. Personal Data We Collect

Depending on your interaction with Growify, we may collect:

• Identity and contact details: name, business email address, telephone number and preferred contact method.
• Professional details: employer or organisation, job title, department, industry, professional profile and other details you choose to share.
• Enquiry and communication details: enquiry category, message contents, meeting requests, correspondence and follow-up preferences.
• Engagement information: proposal, contractual, billing and project-contact information and information needed to assess and deliver an agreed engagement.
• Technical and usage data: IP address, device/browser details, server and security logs, cookies and website interaction data, only to the extent actually collected by our systems or providers.

Please avoid submitting personal data about other individuals, confidential client information or sensitive material in open website forms unless specifically requested through a suitably secure channel and you are authorised to share it.

3. Specific Purposes for Processing

We use personal data for the purposes relevant to your interaction:

• To receive, review and respond to your enquiry or request, and communicate regarding requested services or meetings.
• To evaluate potential consulting, advisory and partnership engagements; prepare proposals; establish and manage business relationships.
• To deliver agreed services, communicate with authorised client representatives, administer engagements and maintain business records.
• To operate, maintain and protect our website, investigate misuse, diagnose faults and maintain appropriate security.
• To manage optional subscriptions, send marketing or business updates where supported by valid consent or another legally permitted ground, and honour opt-out requests.
• To meet applicable statutory, regulatory, accounting and legal obligations and respond to lawful requests.

We do not use your personal data for unrelated new purposes without an appropriate lawful basis and, where necessary, a fresh notice and consent.

4. Lawful Grounds and Consent

Where the DPDP Act applies, we process personal data for a lawful purpose with valid consent or for a use specifically permitted under section 7 of the DPDP Act, as applicable to the circumstances. We do not assume that a general business interest or a contractual relationship is, by itself, a separate lawful ground under the DPDP Act.

When seeking consent, we will identify the personal data requested and the specific purposes for which it is required, using clear and plain language. Consent will involve a clear affirmative action and will not be inferred merely from silence or a pre-ticked box. Where required, a concise collection-point privacy notice will be provided independently of this Policy, with access to this fuller Policy.

You may withdraw consent by contacting us using Section 14 or by using the unsubscribe or preference mechanism provided with the relevant communication. We will make withdrawal as easy as giving consent where required by law. Withdrawal will not invalidate earlier lawful processing, but may affect services that necessarily depend on the withdrawn consent. Processing may continue where another provision of applicable law authorises or requires it.

Where applicable under section 5 of the DPDP Act, the notice and request for consent may be made available in English or an Eighth Schedule language of your choice through arrangements we provide.

5. How We Share Personal Data

We do not sell your personal data. We may disclose only relevant information, subject to appropriate authorisation and safeguards, to:

• Website hosting, email, forms, security, analytics, CRM, cloud infrastructure or other vendors that process data on our behalf under appropriate contractual arrangements.
• Professional advisers (for example, legal and accounting advisers) where necessary for legitimate professional services and subject to applicable obligations.
• Clients, specialist partners or other engagement participants where required for a specific, disclosed purpose and where lawful and appropriately authorised.
• Courts, regulatory authorities and public agencies when legally required or otherwise permitted under applicable Indian law.
• Successor entities in a genuine reorganisation or transfer, subject to relevant notice, legal requirements and safeguards.

We remain responsible for applicable Data Fiduciary obligations in respect of personal data processed by service providers on our behalf. We require processors to use the data only for authorised purposes and to implement appropriate security measures.

6. Cookies, Analytics and Tracking

Our website may use strictly necessary technologies for basic functions and security and may use optional analytics or similar technologies if enabled. Actual cookie and third-party tool usage should be confirmed in the website’s cookie inventory before publication.

Where consent is necessary for a particular use of personal data, optional technologies will be activated only after an appropriate affirmative choice. We will provide available ways to change or withdraw that choice. Browser controls can also limit certain cookies, although some functionality may be affected.

A separate cookie notice or preference panel may provide tool-specific details, including provider names, purposes, categories and retention periods, once the deployed technology stack is confirmed.

7. Storage, Security and Data Breaches

We implement reasonable technical and organisational safeguards appropriate to the personal data and processing risks, which may include access restrictions, encryption or masking where appropriate, secure backups, monitoring, logs, personnel controls and contractual requirements for service providers.

If we become aware of a personal data breach, we will investigate, mitigate and notify affected individuals and the Data Protection Board of India in the manner and within the periods required by the DPDP Act and Rules when the relevant provisions apply. Other incident reporting obligations under applicable Indian law may also apply.

No electronic system is completely free of risk; however, this does not limit our statutory responsibilities.

8. Retention and Erasure

We retain personal data only for as long as needed for the relevant identified purpose or as otherwise required or authorised by law, taking account of engagement records, legal claims, security records and statutory accounting obligations.

When the specified purpose is no longer being served, or consent is withdrawn, we will erase relevant personal data and instruct applicable processors to erase it, unless continued retention is necessary under law. We will observe any applicable mandatory retention of personal data, associated traffic data and logs under the DPDP Rules, including the one-year rule where and when applicable. We will implement deletion, backup expiry and record-retention schedules based on the data category and actual operational needs.

9. International Processing and Transfers

Our service providers may store or access relevant personal data outside India. Where applicable, any transfer will comply with the DPDP Act, including restrictions the Central Government may notify for transfers to specified countries or territories, and any other binding sector-specific or contractual obligations.

10. Children and Persons with Disabilities

Our website and services are intended for business and professional audiences and are not directed at children (individuals under 18 years of age). We do not knowingly solicit personal data from children through our general enquiry channels.

If processing the personal data of a child becomes necessary, we will obtain verifiable parental consent and comply with the applicable restrictions and exceptions under the DPDP Act and Rules. Where applicable, the consent requirements relating to persons with disabilities who have a lawful guardian will also be followed. If you believe a child has submitted personal data to us, please contact us.

11. Your Rights

Subject to the relevant provisions being in force and to applicable legal exceptions, an individual whose personal data we process as a Data Fiduciary may:

• Obtain a summary of personal data being processed and specified information about processing and sharing, in accordance with section 11.
• Request correction, completion or updating of personal data, and erasure where applicable.
• Withdraw consent where processing depends on consent.
• Raise a grievance through our published grievance-redressal channel.
• Nominate another individual to exercise the rights available under the Act in the event of death or incapacity, subject to applicable requirements.

Submit a request using the contact route in Section 14 and provide sufficient details to help us locate the relevant records and verify identity where reasonably necessary. We will publish the process for exercising rights, including any relevant identification particulars, and respond within applicable legal timelines.

12. Grievance Redressal and Regulatory Complaints

You may submit a privacy grievance to the Growify privacy contact in Section 14. We will acknowledge and review grievances and communicate a response within the period published for our grievance mechanism, which will not exceed the maximum prescribed under applicable DPDP Rules once in force.

Where your rights under the DPDP Act apply, you may approach the Data Protection Board of India in accordance with the Act and applicable procedures, ordinarily after first exhausting the grievance-redressal opportunity available with Growify. We will provide the relevant official Board complaint link or access instructions when the statutory mechanism is applicable and available.

13. Third-Party Links and Policy Updates

Our website may include links to independent third-party websites or platforms. Their operators control their own processing of your personal data and publish their own notices. Please review those notices before sharing information.

We may update this Policy to reflect changes in our business, actual data practices or legal obligations. The current version and its revision date will be posted on our website. Where a change requires a new notice or consent, we will provide it in accordance with applicable law.

14. Privacy Contact and Grievance Details

Initiative / business name: Growify Consulting (upcoming initiative; no separate legal entity registered as at 11 October 2026)

Website: https://growifyconsulting.com

Email for privacy requests, consent withdrawal and grievances: contact@growifyconsulting.com

Location: Bengaluru, Karnataka, India. Correspondence address: Purva Skydale, Haralur, Bengaluru - 560068

Individual responsible for personal-data handling and privacy grievances: Amit Joseph. Business contact details: amit@growifyconsulting.com

If an independently appointed Data Protection Officer is legally required for Growify in the future, we will publish the appropriate DPO business contact details.

15. Applicable Law

This Policy is governed by applicable laws of India, including the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 to the extent their relevant provisions are in force, alongside other applicable information-technology and sector-specific laws. Nothing here excludes a right or remedy that cannot lawfully be excluded.