DPDP Policy & Data Principal Notice

Data Fiduciary: Tributaries Unicorn LLP, operating under the brand BlackPapers. This notice covers digital personal data processed through blackpapers.in, enquiry and consultation forms, accounts, admin functions, payments, uploads, communications, public business-record services and associated professional engagements.

This notice supplements our broader Privacy Policy. If a regulated professional independently determines why and how data is used for their engagement or legal record, that professional may also be a separate Data Fiduciary.

We request personal data for the following specified purposes. A service-specific form or notice may narrow or add detail before collection.

We do not require unrelated personal data. If a statutory form or authority requires additional fields, we will use them for that filing and connected legal records.

Where consent is the basis, the request will be clear, specific, informed, unconditional and unambiguous and will require an affirmative action. Optional marketing and analytics are not bundled with a necessary service. You may withdraw consent through the same form or control, the “Manage cookies” control, or by contacting us.

Withdrawal does not affect processing already lawfully completed. We and our processors will stop consent-based processing within a reasonable time unless retention or continued processing is authorised or required by another law. The consequence may be that a requested feature or service cannot continue.

We may also process data for legitimate uses expressly allowed by the DPDP Act, including responding to personal data you voluntarily provide for a specified request, and for compliance with judgments or other law. We do not expand “legitimate use” into an unrestricted commercial-interest ground.

We aim to collect only data necessary for the purpose described. You should use the designated secure channel for KYC, tax, financial and signed documents. Before a filing or decision that may affect you, we take reasonable steps to use complete, accurate and consistent data, while you remain responsible for promptly correcting facts and reviewing drafts supplied for approval.

We may make the necessary data available to authorised personnel; assigned chartered accountants, company secretaries, advocates and other professionals; government portals and regulators; and contracted hosting, storage, email, communication, payment, document, security and consent-management providers. We require processors to act on documented purposes, protect data and support deletion or return as applicable.

We may disclose data to a court, regulator, law-enforcement body, acquirer or adviser where law authorises it or where reasonably necessary to establish or defend a legal claim. We do not sell personal data for an unrelated party’s independent advertising.

The DPDP Act contains an exclusion for personal data made publicly available by the Data Principal or by another person who is legally required to make it public. Our business directory may use such government and corporate records. We nevertheless apply display limits, do not treat all online data as freely reusable, and provide a correction or suppression review for fields that are inaccurate, excessive or not lawfully public.

We erase or anonymise personal data when consent is withdrawn or the specified purpose is no longer served, whichever occurs earlier, unless another law, active claim, fraud-prevention need or required record justifies continued retention. We also instruct relevant processors to erase data made available by us when their retention ground ends.

Operational schedules and longer statutory-record exceptions are described in the Privacy Policy. Once applicable to us, processing data and associated logs covered by Rule 8 will be retained for the prescribed minimum one-year period and then erased unless a longer legal period applies.

Safeguards are selected according to risk and may include encryption or masking, access control, authenticated administration, audit logs and review, backups and continuity measures, incident response, vendor due diligence and contractual processor protections. Access is limited by role and legitimate need.

No method is infallible. Please report suspected exposure or unauthorised access immediately to connect@blackpapers.in.

When the relevant provisions apply, we will notify each affected Data Principal without delay in clear language using the registered account or communication channel. The notice will describe the breach, likely consequences, mitigation, recommended safety steps and a contact. We will notify the Data Protection Board without delay and provide the prescribed detailed update within 72 hours, or within any longer period allowed by the Board.

Subject to commencement, verification and statutory exceptions, a Data Principal may:

• obtain a summary of personal data being processed and the processing activities;
• obtain the prescribed information about other Data Fiduciaries and processors with whom data was shared;
• correct inaccurate or misleading data and complete or update incomplete data;
• request erasure when continued retention is not necessary for the purpose or law;
• withdraw consent with ease comparable to giving it;
• raise a grievance and, after exhausting our process, complain to the Data Protection Board when that route is available; and
• nominate another individual to exercise rights in the event of death or incapacity.

Email connect@blackpapers.in with the subject “Data Principal Request” or use our grievance form. Provide your name, the email or phone used with us, the service or record involved, the right requested and enough detail to locate the data.

We may use proportionate verification and request authority evidence for a representative. We aim to acknowledge within two business days and resolve a complete request promptly. A grievance will receive a final response within a reasonable period not exceeding 90 days once the applicable Rule 14 standard commences. We may retain a minimal request/audit record to show compliance and prevent misuse.

You must comply with applicable law, not impersonate another person, not suppress material information for an official document, not submit a false or frivolous complaint, and provide verifiably authentic information when seeking correction or erasure.

Our services are intended for adults and businesses. Before processing a child’s data where the relevant provisions apply, we will use reasonable technical and organisational measures to obtain verifiable consent of an identifiable parent or lawful guardian. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.

Approved cloud and communications providers may process data outside India. We will comply with restrictions the Central Government specifies for transfers or access by a foreign State or an entity under its control, and with any stricter sector-specific localisation law.

Data Fiduciary: Tributaries Unicorn LLP, operating as BlackPapers
Authorised privacy and grievance contact: Vishvendra Singh, Compliance Lead & Grievance Officer
Address: E49/5, Pocket D, Okhla Phase II, Okhla Industrial Estate, New Delhi, Delhi 110020
Email: connect@blackpapers.in
Phone: +91 82998 24396

Please first use our internal grievance route. Nothing in this notice limits your right to approach the Data Protection Board or another competent authority when the applicable law permits.