Privacy Policy
FirstStartup.in · Ontaxco Professional Workforce Private Limited
Part A — Preamble, Applicability and Definitions
A.1 Data Fiduciary. This Privacy Policy (the “Policy”) is issued by Ontaxco Professional Workforce Private Limited, a company incorporated under the Companies Act, 2013, CIN U74999DL2018PTC332242, having its registered office at K-318, 3rd Floor, Nai Basti, Lado Sarai, Mehrauli–Badarpur Road, New Delhi – 110030 (the “Company”, “we”, “us”), which owns and operates the brand FirstStartup and the website www.firststartup.in. For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), the Company is the Data Fiduciary in respect of Personal Data processed under this Policy.
A.2 Legal framework. This Policy is published in compliance with Section 5 of the DPDP Act and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”), as brought into force in phases, and, until their repeal takes effect, Section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), together with Rule 3(1)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, to the extent applicable.
A.3 Applicability. This Policy applies to Personal Data of (a) visitors to the Platform; (b) persons who submit an enquiry or create an account; (c) Clients; (d) Related Persons whose Personal Data is furnished by Clients; and (e) persons who communicate with us by email, telephone, WhatsApp or social media. It applies to Personal Data collected in digital form, and to Personal Data collected in non-digital form and subsequently digitised.
A.4 Relationship with Terms. This Policy forms part of, and shall be read with, the Terms of Service. Capitalised terms not defined in this Policy have the meanings given in the Terms of Service.
A.5 Definitions. In this Policy:
- a“Consent Manager”, “Data Principal”, “Data Processor”, “Personal Data”, “Personal Data Breach”, “Processing” and “Board” have the meanings given in Section 2 of the DPDP Act;
- b“Data Principal” includes, in the case of a child or a person with disability who has a lawful guardian, the parent or lawful guardian acting on his or her behalf;
- c“Platform” means the website www.firststartup.in, its sub-domains, client dashboards and the Company’s official email, telephone and WhatsApp Business channels;
- d“Purpose” means each purpose specified in Part B; and
- e“Related Person” has the meaning given in the Terms of Service.
Part B — Notice: Personal Data Processed, Purposes and Legal Basis
B.1 Itemised description. The following table sets out the Personal Data we process, its source, the specified Purpose, and the legal basis under the DPDP Act.
| # | Category of Personal Data | Source | Purpose | Legal basis |
|---|---|---|---|---|
| 1 | Name, email, mobile number, city, enquiry details | Data Principal, via forms, calls, chat, WhatsApp | Respond to enquiry; provide quotation; follow-up on the enquiry | Consent (s. 6); voluntary provision for a specified purpose (s. 7(a)) |
| 2 | Identity and address proofs: PAN, Aadhaar (masked), passport, voter ID, driving licence, utility bills, rent agreement, NOC, photograph | Client; Related Persons through Client | Prepare and submit Filings; KYC of directors, partners, trustees, subscribers | Consent; compliance with law (s. 7(d)) |
| 3 | DIN, DPIN, DSC details, specimen signatures, email and mobile for OTP | Client; Related Persons | Apply for DSC and DIN; authenticate Filings on government portals | Consent; compliance with law |
| 4 | Business and financial information: entity details, shareholding, capital, bank statements, invoices, books, GST/TDS/ITR data, financial statements | Client | Perform the Services within Scope | Consent; performance of the Engagement |
| 5 | Brand names, marks, logos, works, designs and owner details | Client | Searches and IP Filings | Consent |
| 6 | Billing name, address, GSTIN, transaction reference, payment status | Client; payment gateway | Invoicing, accounting, refunds, fraud prevention, tax compliance | Consent; compliance with law |
| 7 | Account credentials, login history | Client | Account access and security | Consent |
| 8 | Communications: emails, chat and WhatsApp messages, call recordings | Data Principal | Service delivery, quality, training, evidence of instructions and approvals | Consent; legitimate use for legal claims |
| 9 | Device and usage data: IP address, browser, device type, pages visited, referral source, cookie identifiers | Automatic collection | Security, analytics, Platform improvement, advertising measurement | Consent (non-essential cookies); legitimate use for security |
| 10 | Reviews, testimonials, public comments | Data Principal | Publication on the Platform and marketing | Consent |
| 11 | Contact details | Data Principal | Marketing communications, newsletters, regulatory updates | Consent, withdrawable at any time |
B.2 Data minimisation. We collect only the Personal Data that is necessary for the Purpose concerned or required by the relevant Governmental Authority. Personal Data shall not be processed for any Purpose other than one specified in this Part, save as permitted by Section 7 of the DPDP Act.
B.4 Aggregated data. We may create aggregated or de-identified data that does not identify any individual, and use it for analytics, research and business purposes. Such data is not Personal Data.
Part C — Consent, Legitimate Uses and Special Categories
C.1 Manner of consent. Where processing is based on consent, consent is sought through a clear affirmative action — such as ticking an unticked checkbox, clicking “I agree” or “Submit”, or confirming by email or WhatsApp — after this notice has been made available. Consent so given is free, specific, informed, unconditional and unambiguous, and is limited to the Personal Data necessary for the specified Purpose, in accordance with Section 6(1) of the DPDP Act.
C.2 Withdrawal of consent. A Data Principal may withdraw consent at any time, with the same ease with which it was given, by: (a) clicking “unsubscribe” in any marketing email; (b) replying “STOP” to any WhatsApp or SMS message; (c) using the account settings on the Platform (where available); or (d) writing to [email protected]. Upon withdrawal, the Company shall cease, and cause its Data Processors to cease, processing the relevant Personal Data within a reasonable time, unless processing without consent is required or authorised under the DPDP Act or any other law.
C.4 Consent Managers. A Data Principal may give, manage, review or withdraw consent through a Consent Manager registered with the Board under Section 6(7) of the DPDP Act, once such facility becomes operational and is integrated with the Platform.
C.5 Legitimate uses. The Company may process Personal Data without consent for the legitimate uses permitted by Section 7 of the DPDP Act, including: (a) for a specified purpose for which the Data Principal has voluntarily provided Personal Data and has not indicated that she does not consent to its use; (b) for compliance with any judgment, decree or order issued under any law; (c) for fulfilling any obligation under law to disclose information to the State or any of its instrumentalities; and (d) for responding to a medical emergency or ensuring safety during a disaster or breakdown of public order.
C.6 Personal Data of Related Persons. Where a Client furnishes Personal Data of a Related Person, the Client is responsible, under Clause 6.3 of the Terms of Service, for having informed that Related Person of this Policy and having obtained his or her valid consent. The Company may, at its discretion, contact a Related Person directly to verify consent or to obtain OTPs and signatures. A Related Person may exercise all rights under Part F directly against the Company.
C.7 Children and persons with disability. The Platform and the Services are intended for persons who have completed eighteen (18) years of age. The Company does not knowingly process Personal Data of a child (a person below 18 years) except upon obtaining verifiable consent of the parent or lawful guardian in accordance with Section 9 of the DPDP Act and the DPDP Rules — for instance, where a minor is a shareholder, member, beneficiary or nominee of an entity. The Company does not undertake tracking, behavioural monitoring or targeted advertising directed at children. The same safeguards apply, with necessary modifications, to persons with disability acting through a lawful guardian.
C.8 Aadhaar. The Company does not seek to collect or store full Aadhaar numbers except where a Governmental Authority requires the full number for a Filing. Clients are requested to furnish masked Aadhaar (showing only the last four digits) wherever acceptable. Where a full Aadhaar number or copy is furnished, it is used solely for the Filing for which it is required, is not used for authentication by the Company, and is handled subject to the restrictions in the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 and its regulations.
C.9 Sensitive personal data. To the extent the SPDI Rules remain in force, financial information such as bank account details, and passwords, constitute sensitive personal data or information; such data is collected only with consent in writing (including electronic form) and is subject to the safeguards in Part E.
Part D — Disclosure and Transfer of Personal Data
D.2 Recipients. Personal Data may be disclosed only to the following categories of recipients, and only to the extent necessary for the Purposes:
| Recipient | Examples | Reason |
|---|---|---|
| Governmental Authorities | MCA / ROC / CRC, GSTN, Income-tax Department, IP India, MHA (FCRA), FSSAI, Registrars of Societies and Trusts | To make Filings within the Scope |
| Certifying Authorities | Licensed DSC issuers | To issue Digital Signature Certificates |
| Independent Professionals | Chartered accountants, company secretaries, advocates, valuers | Certification, attestation, representation |
| Banks and financial institutions | Banks where the Client requests account-opening support | At the Client’s instruction |
| Data Processors | Payment gateway (Razorpay), cloud hosting, CRM, email, SMS and WhatsApp Business providers, analytics and tag-management tools, e-sign providers | Operating the Platform and delivering the Services |
| Legal, regulatory and enforcement bodies | Courts, tribunals, police, investigating and regulatory agencies | Compliance with law, orders and lawful requests |
| Professional advisers | Auditors, lawyers, insurers of the Company | Audit, legal advice, insurance |
| Successors | Acquirer or transferee in a merger, amalgamation, acquisition or asset sale | Business continuity, bound by this Policy |
D.3 Data Processors. The Company engages Data Processors only under a valid contract, as required by Section 8(2) of the DPDP Act, obliging them to process Personal Data only on the Company's instructions, to implement reasonable security safeguards, and to delete Personal Data on termination of the engagement. The Company remains responsible for processing by its Data Processors in accordance with the DPDP Act.
D.4 Public registers. The Data Principal acknowledges that certain Personal Data contained in Filings (for example, names and addresses of directors, partners, proprietors, trademark applicants and trustees) is published by Governmental Authorities in public registers by operation of law. The Company does not control, and is not responsible for, such publication or its subsequent use by third parties.
D.5 Disclosures required by law. The Company may disclose Personal Data without notice where required by law, by an order of a court or tribunal, or upon a lawful request by a Governmental Authority, or where the Company believes in good faith that disclosure is necessary to prevent fraud, protect its rights or property, or protect the safety of any person.
D.6 Cross-border transfer. Some Data Processors (including cloud, email and analytics providers) may store or process Personal Data outside India. Such transfer is made in accordance with Section 16 of the DPDP Act and shall not be made to any country or territory notified by the Central Government as restricted. The Company shall comply with any additional requirements prescribed under the DPDP Rules in respect of such transfer.
D.7 Third-party platforms. Government portals, payment gateways, social-media platforms and other third-party services linked from or integrated with the Platform process Personal Data under their own privacy policies, for which the Company is not responsible.
Part E — Retention, Security, Breach and Cookies
E.1 Retention principle. In accordance with Section 8(7) of the DPDP Act, Personal Data is retained only for as long as necessary for the specified Purpose, or for such longer period as is required for compliance with any law, and is thereafter erased or irreversibly de-identified, and the Company shall cause its Data Processors to do likewise.
E.2 Retention schedule. Subject to any longer period required by law or by a pending dispute, the following periods apply:
| Data | Retention period | Basis |
|---|---|---|
| Enquiry data with no Engagement | 24 months from last interaction, or until consent is withdrawn | Purpose limitation |
| Client Materials and Filing records | 8 years from the end of the financial year in which the Engagement concludes | Companies Act, 2013 (s. 128(5)); income-tax record-keeping; limitation for claims |
| Invoices and payment records | 8 years from the end of the relevant financial year, and not less than the period under s. 36 of the CGST Act, 2017 | Tax and accounting law |
| Communications and call recordings | 3 years from the conclusion of the Engagement | Evidence of instructions; Limitation Act, 1963 |
| System, access and security logs | Not less than the minimum periods prescribed by the DPDP Rules and the CERT-In Directions dated 28 April 2022 | Security and law |
| Marketing preferences and opt-out records | For as long as needed to honour the opt-out | Compliance |
E.3 Security safeguards. The Company implements reasonable security safeguards, as required by Section 8(5) of the DPDP Act and the DPDP Rules, including: encryption of data in transit (TLS/SSL) and, where feasible, at rest; role-based and need-to-know access controls; multi-factor authentication for administrative access; logging and monitoring of access to Personal Data; periodic back-ups; contractual confidentiality obligations on employees, Independent Professionals and Data Processors; and periodic review of these measures. These measures are designed to align with IS/ISO/IEC 27001 practices.
E.4 No absolute security. No system of transmission or storage over the internet is completely secure. While the Company takes reasonable measures, it cannot warrant absolute security, and the Data Principal shares Personal Data with this understanding. Nothing in this Clause limits any obligation of the Company under the DPDP Act.
E.5 Impersonation. The Company will never ask for OTPs, passwords or payment except through its official email domain (@firststartup.in), its official telephone and WhatsApp numbers published on the Platform, or its payment gateway. The Company is not responsible for Personal Data shared with persons impersonating it, though it will cooperate with any investigation.
E.6 Personal Data Breach. In the event of a Personal Data Breach, the Company shall: (a) intimate each affected Data Principal without delay, describing the breach, its likely consequences, the mitigation measures taken, safety measures the Data Principal may take, and contact details of a person who can respond on the Company's behalf; and (b) intimate the Board within the time and in the form prescribed by the DPDP Rules. Cyber-security incidents shall also be reported to CERT-In within the time prescribed under the Information Technology Act, 2000 and directions issued under it.
E.7 Cookies and similar technologies
The Platform uses:
- Strictly necessary cookies — required for login, security and core functions; these cannot be switched off;
- Analytics cookies — such as Google Analytics, to understand usage in aggregate;
- Marketing cookies and tags — such as Google Tag Manager and advertising pixels, to measure and improve campaigns.
Analytics and marketing cookies are set only with consent through the cookie banner, which may be changed at any time through the banner or browser settings. Disabling cookies may affect Platform functionality.
Part F — Rights and Duties of Data Principals, Grievances and General
F.1 Rights. Subject to the DPDP Act and the DPDP Rules, every Data Principal has the right to:
- aAccess information (s. 11): obtain a summary of Personal Data processed by the Company and the processing activities undertaken, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared, along with a description of the Personal Data so shared;
- bCorrection and erasure (s. 12): have inaccurate or misleading Personal Data corrected, incomplete Personal Data completed, Personal Data updated, and Personal Data erased once it is no longer necessary for the Purpose, unless retention is necessary for compliance with law;
- cGrievance redressal (s. 13): have a readily available means of grievance redressal in respect of any act or omission of the Company or its Data Processors; and
- dNomination (s. 14): nominate any other individual to exercise these rights in the event of death or incapacity.
F.2 Exercising rights. Requests shall be sent to [email protected] from the email address or phone number registered with the Company, or through the means published on the Platform. The Company may verify the identity of the requester before acting. Requests shall be responded to within the period prescribed by the DPDP Rules. The Company may decline or limit a request to the extent permitted by the DPDP Act, including where processing is required for compliance with law, and shall communicate the reasons.
F.3 Duties of Data Principals (s. 15). A Data Principal shall: (a) comply with applicable law while exercising rights; (b) not impersonate another person while providing Personal Data; (c) not suppress material information while providing Personal Data for any document issued by the State; (d) not register a false or frivolous grievance or complaint; and (e) furnish only verifiably authentic information when exercising the right to correction or erasure. Breach of these duties may attract a penalty under Section 33 of the DPDP Act.
F.4 Grievance Officer and contact person
In accordance with Section 8(9) of the DPDP Act, Rule 5(9) of the SPDI Rules (while in force) and the Consumer Protection (E-Commerce) Rules, 2020, the contact person who can answer questions about the processing of Personal Data is:
F.5 Timelines. Grievances shall be acknowledged within forty-eight (48) hours and resolved within the period prescribed by the DPDP Rules or, where no period is prescribed, within one (1) month of receipt.
F.6 Data Protection Board. A Data Principal who is not satisfied with the Company's resolution of a grievance may, after exhausting the grievance-redressal mechanism of the Company as required by Section 13(3) of the DPDP Act, file a complaint with the Data Protection Board of India in the manner prescribed.
F.7 Marketing opt-out. Requests to stop marketing communications shall be given effect within ten (10) Business Days. Transactional, service and compliance communications relating to an active Engagement shall continue.
F.8 Amendments. The Company may amend this Policy to reflect changes in law, technology or its processing activities. The amended Policy takes effect on publication on the Platform with a revised “Last Updated” date. Where an amendment materially changes a Purpose for which consent was obtained, the Company shall give fresh notice and, where required by law, seek fresh consent.
F.9 Governing law and disputes. This Policy is governed by the laws of India. Subject to the rights of a Data Principal before the Board and any Consumer Disputes Redressal Commission, disputes arising from this Policy shall be resolved in accordance with Article 21 of the Terms of Service.
Related reading: DPDP Act, 2023 · Consumer Protection (E-Commerce) Rules, 2020
Questions about your personal data?
Exercise your DPDP rights or raise a grievance — we acknowledge every request within 48 hours.