Privacy Policy.
DPDP Act, 2023.

Last Updated: 30 June 2026   |   Effective Date: 30 June 2026

This Privacy Policy is issued by Affluent Consultancy Services ("ACS", "we", "us", or "our"), having its principal place of business at Kendrapara, Odisha, India. It governs the collection, use, storage, and protection of your Digital Personal Data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and other applicable Indian laws.

By creating an account, using our website (affluentconsultancy.in), or otherwise providing us with your personal data, you give free, specific, informed, unconditional, and unambiguous consent to this Privacy Policy.

1. Identity of the Data Fiduciary

Under the DPDP Act, ACS is the Data Fiduciary — the entity that determines the purpose and means of processing your personal data.

• Business Name: Affluent Consultancy Services
• Address: Kendrapara, Odisha, India
• Website: affluentconsultancy.in
• Contact Email: info@affluentconsultancy.in
• Contact Phone: +91 9348807611

2. Personal Data We Collect

We collect only the personal data necessary to provide our services. This includes:

• Identity Data: Full name, email address, mobile number
• Account Security Data: Password (stored only as a secure cryptographic hash — never in plain text)
• Payment & Order Data: Order ID, payment reference, amount paid, payment status, and the service category selected
• Communication Data: Messages you send us via the contact form or email
• Technical Data: IP address, browser user agent, and session metadata (used for security purposes such as login attempt tracking)

We do not collect or store your debit card number, credit card number, CVV, UPI PIN, net banking credentials, OTPs, or any other sensitive payment instrument details. All payments are processed by authorised third-party payment gateway providers.

3. Purpose of Processing

We collect and process your personal data only for the following specific, lawful, and clearly defined purposes:

• Creating and managing your customer account
• Providing the services you have requested and contracted
• Processing and verifying payments made through our platform
• Communicating with you about your account, orders, and service updates
• Providing customer support and resolving queries or disputes
• Maintaining login security, including detecting and preventing unauthorised access
• Complying with our legal obligations under Indian law
• Improving our website, products, and service quality

Your personal data will not be used for any purpose other than those stated above without obtaining fresh, specific consent from you.

4. Lawful Basis for Processing (Consent)

Under the DPDP Act, we process your personal data on the basis of your freely given, specific, informed, unconditional, and unambiguous consent, which you provide at the time of account creation.

You have the right to withdraw your consent at any time. Withdrawing consent will not affect the legality of processing carried out before withdrawal. To withdraw consent, please contact our Grievance Officer at the details provided in Section 9. Note that withdrawal of consent may affect your ability to access or use certain features of our services.

5. How We Store and Protect Your Data

We take reasonable technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include:

• Passwords stored using strong cryptographic hashing (PBKDF2-SHA512 with 210,000 iterations)
• Session tokens signed with HMAC-SHA256 and stored as hashed values
• Automatic session expiry after 20 minutes of inactivity
• Database access restricted to authorised functions only
• Login attempt rate-limiting to prevent brute-force attacks
• SSL/TLS encryption for all data in transit

Despite our security measures, no method of transmission over the internet is completely secure. In the event of a personal data breach that is likely to result in harm to you, we will notify you and, where required, the Data Protection Board of India without undue delay.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law:

• Account Data: Retained for the lifetime of your active account
• Payment & Order Records: Retained for a minimum of 7 years as required under Indian financial and tax laws
• Session Logs and Login Attempts: Retained for up to 90 days for security purposes
• Inactive Accounts: Accounts with no login activity for 6 consecutive months may be scheduled for deletion. We will send a notification to your registered email address at least 7 days before any deletion. If you log in during this notice period, the deletion will be cancelled

Upon account deletion, personal data that is no longer required will be permanently erased, except for records we are legally obligated to retain.

7. Sharing of Personal Data

We do not sell, rent, or trade your personal data to any third party for commercial purposes.

Your personal data may be shared only in the following limited circumstances:

• Payment Gateway Providers: To process transactions securely (e.g., PhonePe, Razorpay). These providers process only the data required for payment completion and are bound by their own privacy and security obligations
• Hosting and Infrastructure Providers: Our website and database are hosted on Netlify (which uses Neon-backed Postgres). These providers process data on our behalf as Data Processors under appropriate contractual obligations
• Legal Obligations: When required to disclose data to government authorities, law enforcement agencies, or courts of law under applicable Indian law
• Business Transfer: In the event of a merger, acquisition, or sale of our business, personal data may be transferred to the successor entity, subject to the same privacy protections

8. Your Rights as a Data Principal

Under the Digital Personal Data Protection Act, 2023, you have the following rights as a Data Principal:

• Right to Access: You have the right to obtain a summary of your personal data being processed by us and the purposes for which it is being processed
• Right to Correction and Erasure: You have the right to correct inaccurate or incomplete personal data, and to request erasure of personal data that is no longer necessary for the purpose for which it was collected
• Right to Grievance Redressal: You have the right to a readily available means to register a grievance with our Grievance Officer and to receive a timely response
• Right to Nominate: You have the right to nominate another individual who shall, in the event of your death or incapacity, exercise your rights under the DPDP Act on your behalf
• Right to Withdraw Consent: You may withdraw consent for processing of your personal data at any time
• Right to Complain to the Data Protection Board: If your grievance is not resolved to your satisfaction, you have the right to file a complaint with the Data Protection Board of India

To exercise any of these rights, please contact our Grievance Officer as detailed in Section 9 below.

9. Grievance Officer

In accordance with the DPDP Act and the Information Technology Act, 2000, we have appointed a Grievance Officer to address your privacy-related concerns. You may contact the Grievance Officer at:

• Name: Grievance Officer, Affluent Consultancy Services
• Email: info@affluentconsultancy.in
• Phone: +91 9348807611
• Address: Kendrapara, Odisha, India
• Response Time: We aim to acknowledge your grievance within 48 hours and resolve it within 30 days of receipt

If you are not satisfied with our resolution, you may escalate your complaint to the Data Protection Board of India once it is constituted and operational under the DPDP Act.

10. Children's Personal Data

Our services are not directed at children under the age of 18. We do not knowingly collect personal data from children. In accordance with the DPDP Act, processing of a child's personal data requires verifiable consent from a parent or lawful guardian. If you believe a child under 18 has provided us with personal data without appropriate consent, please contact us immediately at info@affluentconsultancy.in and we will take steps to delete that data promptly.

11. Cross-Border Transfer of Personal Data

Your personal data may be processed or stored on servers located outside India as part of our use of cloud hosting services (including Netlify's infrastructure). Where such transfers occur, we take reasonable steps to ensure that your personal data receives a level of protection equivalent to that provided under the DPDP Act. We do not transfer your personal data to countries or territories that are restricted by the Central Government of India.

12. Personal Data Breach Notification

In the event of a personal data breach that is likely to affect your rights or cause you harm, we will:

• Notify you at your registered email address without undue delay
• Notify the Data Protection Board of India as required under the DPDP Act
• Provide you with relevant details about the nature of the breach, the data affected, and steps taken to mitigate harm

13. Cookies and Technical Data

We use a single secure, HttpOnly, first-party session cookie (acs_session) to maintain your login session. This cookie is not used for advertising or tracking. It is automatically cleared when your session expires or when you log out. We do not use third-party tracking cookies or advertising pixels.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after changes are posted constitutes your acceptance of the revised policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us:

• Email: info@affluentconsultancy.in
• Phone: +91 9348807611 / +91 7008040540
• Address: Affluent Consultancy Services, Kendrapara, Odisha, India