Who is responsible for your information

This site is operated by [legal entity name to be confirmed], with its registered office at [registered office to be confirmed]. For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary in respect of the personal data described below, and you are the Data Principal.

Questions about this policy, or any request described in it, can be sent to contact@tdrsetu.in.

What we deliberately do not collect

This is stated first because it is the most important thing to know, and because it is a property of how the platform is built rather than a promise about how we behave.

• Development Rights Certificate numbers are not collected at enquiry stage. There is no field on either enquiry form and no column in our records for one.
• Certificate holder identity documents are not collected at enquiry stage, for the same reason.
• Neither enquiry form has any facility to upload a document of any kind.
• No enquiry is published. A certificate holder may separately and afterwards authorise an anonymised card, which carries no certificate number, no identity and no document, and which they may withdraw at any time.

What we collect, and when

We collect only what you give us, and only at the point you choose to give it.

• Enquiry forms: your name, email address, telephone number, and where you provide them your company and role; together with the project or entitlement details you choose to enter, such as locality, planning authority, areas, floor area ratios, quantity, timeline and any notes.
• Accounts: if you register, your email address and the name, company and role you supply. Sign-in uses a one-time code sent to your email address; we do not store a password.
• Engaged reviews only: where you commission a due diligence review and separately provide records for it, those documents and their metadata.
• Usage: aggregate, cookieless analytics about which pages are visited. This does not identify you and is not linked to any enquiry or account.
• Technical: standard server logs generated when any website is accessed, including IP address and browser user agent, retained for security and diagnostics.

Why we collect it, and on what basis

Enquiry and account information is processed on the basis of your consent, which you give by ticking the consent box and submitting the form. We record the moment consent was given as a timestamp against your enquiry, rather than as a simple yes or no, so that what was agreed and when can be evidenced.

We use the information to review your enquiry, to contact you about it, and to carry out any work you subsequently engage us to do. We do not use it for automated decision-making, and we do not profile you.

Cookies and similar technologies

If you sign in, we set a session cookie so that you remain signed in. This is strictly necessary for the account area to function and is not used for advertising or tracking.

Our analytics is cookieless. It sets no cookie, stores no identifier on your device, and does not follow you across sites. We do not use advertising cookies, remarketing pixels or third-party trackers, which is why this site shows no cookie consent banner.

Who else sees it

We do not sell personal data, and we do not share it for anyone else's marketing.

We share it only with the service providers that operate this platform on our behalf, each acting on our instructions:

• Our hosting and database providers, who store the data and serve the site.
• Our transactional email provider, which delivers sign-in codes and internal notifications.
• Professional advisers instructed on a specific engagement, and only with your knowledge.

Where it is stored

Our database and our application servers are located in India, in the Mumbai region. Enquiry records, account records and documents are stored there.

Some service providers may process limited technical information outside India in the ordinary course of operating a global network. Where that happens we rely on the provider's contractual commitments, and we do not transfer enquiry content for that purpose.

How it is protected

The protections below are enforced by the system, not by procedure:

• Enquiry records are not readable by the public interface at all. Access is refused at the database level rather than hidden in the application.
• Documents provided for an engaged review are held in private storage with no public address. They are released only through short-lived links, valid for two minutes, and only after an entitlement check that is re-run on every single request.
• The administrative interface is access-controlled and excluded from search engines, and fails closed: if its credentials are absent it refuses all access rather than permitting it.
• Published opportunity cards are generated by a server-side projection that can only expose a named, limited set of fields, and that re-checks the holder's consent on every read. Withdrawal of consent removes a card immediately, without anyone having to remember to unpublish it.

How long we keep it

Enquiries are retained as a business record for as long as necessary for the purpose for which they were submitted and for any period required by law, and are then deleted or anonymised. If you close your account, your enquiries survive as unlinked business records with your account identifier removed.

A specific retention period for each category is being finalised and will be stated here.

Your rights

Under the Digital Personal Data Protection Act, 2023, you may:

• ask what personal data we hold about you and how it has been used;
• ask us to correct or complete anything inaccurate;
• ask us to erase personal data where it is no longer needed for the purpose it was given for;
• withdraw your consent at any time, which stops further processing but does not affect anything done before withdrawal;
• nominate another person to exercise these rights in the event of your death or incapacity; and
• complain, first to us and then to the Data Protection Board of India.

Grievance redressal

Our Grievance Officer is [grievance officer to be named], contactable at contact@tdrsetu.in. Write with enough detail to identify your enquiry or account. We will acknowledge your complaint and respond within the period prescribed by law.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Children

This service is intended for professional use and is not directed at children. We do not knowingly collect the personal data of anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

Changes to this policy

We may update this policy. The date at the top of this page tells you when it was last substantively revised. Where a change materially affects how we handle information you have already given us, we will take reasonable steps to tell you.