Privacy Policy

1.1 This Privacy Policy explains how Future Human Technology Private Limited ("Dhanzo", "we", "us") collects, uses, shares, stores and protects your personal data when you use our website, mobile application, APIs and related platforms (the "Platform"), and the choices and rights you have. It is framed in accordance with the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the rules made under it, and the Information Technology Act, 2000.

1.2 This Policy applies to all Users of the Platform, personal data collected through the Platform, and Services requested or delivered through it. It does not apply to third-party websites linked from the Platform, government portals accessed for filings, or services provided by a Regulated Professional under a separate engagement with you, each of which has its own privacy practices.

2.1 Dhanzo is the data fiduciary for personal data processed through the Platform. Experts who deliver Services act on our instructions. Where you engage a Regulated Professional under Clause 4 of the Terms of Use, the Regulated Professional is a separate data fiduciary for the data they process for that engagement.

2.2 Where you upload personal data of other people (for example, directors, partners, employees or family members) for a Service, you confirm that you have their authority to share it with us for that purpose.

We collect data directly from you, from your use of the Platform, from government portals when you authorise us to access them for a filing, and from our payment partners.

We use your personal data to:

1. register and verify your Account, and onboard you;
2. enable bookings and Orders, assign Experts and coordinate Services;
3. verify documents and execute Services, including filings with authorities;
4. process payments, refunds and reconciliation, and issue invoices;
5. provide customer support and resolve grievances;
6. send transactional messages, reminders and due-date alerts;
7. send promotional messages, only with your separate consent;
8. detect and prevent fraud, and keep the Platform secure;
9. comply with legal and regulatory obligations; and
10. improve the Platform and our Services, using aggregated or de-identified data wherever possible.

5.1 We process your personal data on the basis of your consent, given through a clear affirmative action such as ticking a box after reading our consent notice. You can withdraw consent at any time (see Clause 10), as easily as you gave it. Withdrawal does not affect processing already done, and may mean we cannot continue a Service that depends on that data.

5.2 We may also process personal data without consent where the DPDP Act permits it as a legitimate use, including where you voluntarily provide data for a specific purpose and have not objected, to comply with a law or a court order, or in a medical emergency.

We share personal data only when necessary and on a need-to-know basis, with:

1. Experts assigned to your Order, only for delivering that Service;
2. a Regulated Professional you choose to engage, only for that engagement;
3. service providers, such as payment gateways, cloud hosting, communication (SMS, email, WhatsApp) and analytics providers, who are bound by contract to protect your data and use it only for our purposes;
4. government authorities and portals, for filings and registrations you request, or where required by law or a lawful request; and
5. a successor, if Dhanzo is involved in a merger, acquisition or sale of assets, subject to this Policy.

Dhanzo does not sell or trade your personal data.

Your data is stored on secure servers, primarily in India. If we transfer personal data outside India, for example to a cloud service provider, we do so only to countries not restricted by the Government of India under the DPDP Act, and with appropriate safeguards.

8.1 Reasonable security practices. Dhanzo implements and maintains reasonable security practices and procedures to protect personal data, as required by Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (for so long as they apply), and reasonable security safeguards to prevent personal data breaches, as required by Section 8(5) of the DPDP Act.

8.2 IS/ISO/IEC 27001. Dhanzo's information security management system is designed in line with International Standard IS/ISO/IEC 27001 (Information Technology – Security Techniques – Information Security Management Systems – Requirements). Dhanzo is working towards certification under IS/ISO/IEC 27001 and, until certified, maintains the internal controls, security practices and standards described in this Clause.

8.3 Our security programme. Dhanzo maintains a documented information security programme, approved by its management, which includes:

1. an information security policy, and risk assessment and treatment carried out at least once a year;
2. encryption of personal data in transit and at rest, and secure key management;
3. role-based access control on a need-to-know basis, multi-factor authentication for internal systems, and prompt removal of access when a person leaves or changes role;
4. secure servers, firewalls, network segmentation, malware protection and regular patching;
5. logging and monitoring of access to personal data, with logs retained as required by law;
6. secure software development, testing and change management, including vulnerability assessment and penetration testing before major releases and at least once a year;
7. regular, secure backups and a tested business continuity and disaster recovery plan;
8. written contracts requiring Expert Partners, Regulated Professionals and service providers who process personal data on our behalf to keep it confidential and secure, and to use it only for the agreed purpose;
9. confidentiality obligations, background checks where appropriate, and security and privacy training for staff; and
10. a documented incident response plan.

8.4 Audits. Dhanzo's security practices are audited at least once a year, and whenever there is a significant change to its systems, by an independent auditor or, once certified, the IS/ISO/IEC 27001 certification body. Findings are reported to management and remedied within agreed timelines.

8.5 Security incidents and breaches. No digital system is completely secure. If a cyber security incident or personal data breach occurs, Dhanzo will act promptly to contain it and will:

1. report reportable cyber security incidents to the Indian Computer Emergency Response Team (CERT-In) within six (6) hours of noticing them, as required by its directions under Section 70B of the Information Technology Act, 2000; and
2. notify the Data Protection Board of India and each affected User of a personal data breach, in the form and within the time required by the DPDP Act and its rules, including what happened, the likely consequences, the steps taken and what you can do to protect yourself.

8.6 Your part. Please protect your login details and OTPs, never share them outside the Platform's secure channel, and tell us immediately at compliance@dhanzoapp.com if you suspect any unauthorised access to your Account.

9.1 We keep personal data only for as long as needed to provide Services, comply with law and resolve disputes. In particular:

1. invoices, transaction records and documents relating to filings are kept for at least eight (8) years, or longer where tax, GST, company or other laws require;
2. Account data is deleted within ninety (90) days of Account deletion, except data we must keep by law; and
3. OTPs are not stored after use.

9.2 After the retention period, data is securely deleted or anonymised. Where the law requires, we will notify you before erasing your data.

Subject to the DPDP Act, you have the right to:

1. obtain a summary of your personal data we process and how we process it, and the identities of those we have shared it with;
2. correct, complete or update inaccurate or incomplete data;
3. request erasure of your data that is no longer needed, unless we must keep it by law;
4. withdraw consent at any time;
5. nominate another person to exercise your rights if you die or become incapable; and
6. raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.

You can exercise these rights from your Account settings, the Delete Account page, or by writing to our Grievance Officer from your registered mobile number or email. We may need to verify your identity before acting on a request.

You are responsible for providing accurate information, for submitting lawful and authentic documents, and for keeping your login details and OTPs safe. You must not provide false data or impersonate another person.

The Platform is meant for persons aged 18 or above. We do not knowingly collect personal data of children. If a Service involves a child's data (for example, a minor's PAN application), we will process it only with verifiable consent of the parent or lawful guardian, as required by the DPDP Act.

We use cookies and similar technologies to keep you logged in, remember your preferences, secure the Platform and understand how it is used. You can control cookies through your browser settings, although some features may not work without them.

Your conversations with Fira are processed to respond to you and to improve Fira, using de-identified data where possible. Please do not share passwords, OTPs or full Aadhaar or bank details with Fira.

We may update this Policy from time to time. We will notify you of material changes by email, SMS or in-app notice before they take effect, and ask for fresh consent where the law requires it.

16.1 Grievance Officer. Dhanzo has appointed a Grievance Officer to address your questions, requests and complaints about the processing of your personal data, this Privacy Policy and the exercise of your rights, as required by the DPDP Act, the Information Technology Act, 2000 and the rules made under them:

Any change in these details will be updated on this page promptly.

16.2 How to raise a complaint. You may raise a complaint by email, by phone, by letter to the address above, or from the Support or Privacy Settings section of your Account. Please write from your registered mobile number or email address, and include your name, a description of the issue, the relevant order number (if any) and the outcome you are seeking. We may ask for information to verify your identity before acting on a request.

16.3 Timelines. The Grievance Officer will:

1. acknowledge your complaint within twenty-four (24) hours of receipt, with a reference number;
2. resolve it, and tell you the outcome and the reasons in writing, within fifteen (15) days of receipt; and
3. where a complaint needs more time because of its complexity, tell you why and the expected date, which will in any case be within one (1) month of receipt, or any shorter period required by Applicable Law.

16.4 Escalation. If you are not satisfied with the outcome, you may ask for your complaint to be reviewed by a Director of Dhanzo other than the Grievance Officer, by writing to compliance@dhanzoapp.com marked "Escalation", within fifteen (15) days of receiving the outcome. The review will be completed within fifteen (15) days.

16.5 Data Protection Board of India. Under Section 13 of the DPDP Act, you must first use this redressal mechanism. If you are not satisfied with Dhanzo's response, or do not receive one within the period above, you may complain to the Data Protection Board of India through its digital platform.

16.6 Records. Dhanzo keeps a record of every privacy complaint, its handling and its outcome, and reviews these records periodically to improve its practices.

16.7 No retaliation. Raising a complaint will not affect your access to the Platform or the Services.

This Policy is governed by the laws of India. Subject to your statutory rights, the courts at Gurugram, Haryana have jurisdiction.