Privacy Policy & DPDP Compliance Notice

Effective Date: October 2026 | Last Updated: October 2026

1. Regulatory Framework & Scope

Third Estate ("we," "our," or "us") operates as a Data Fiduciary under the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act). This notice explains how we collect, process, store, and protect digital personal data collected from individuals ("Data Principals") who interact with our survey instruments, digital access passes, research memberships, public audit disclosures, and workforce analytics services.

2. Lawful Grounds & Purpose Limitation

We collect digital personal data solely on the basis of your freely given, specific, informed, unconditional, and unambiguous consent, or for legitimate commercial uses recognized under the DPDP Act. We adhere strictly to data minimisation principles and process data exclusively to:

Facilitate verified workforce surveys and aggregate proprietary research analytics.
Verify and maintain records of access pass subscriptions, research fees, and operational disbursements.
Address user requests, support queries, and privacy grievances.

3. Information We Collect

Survey Responses: Feedback, employment experiences, or academic disclosures submitted voluntarily through our research forms.
Transaction & Payment Identifiers: Gateway reference numbers, timestamps, and digital access pass or research membership considerations. We do not store credit/debit card numbers, CVVs, or net-banking login credentials.
Communications & Correspondence: Name, email address, or query details provided when reaching out to our founding team.
System Logs: Basic technical telemetry (such as IP addresses and device browser strings) retained temporarily solely for anti-abuse, fraud prevention, and server security.

4. Your Rights as a Data Principal

Under the DPDP Act, you possess explicit statutory rights regarding your personal information:

Right to Access: Review a summary of your personal data processed by us and the processing activities undertaken.
Right to Correction & Completion: Request the correction, updating, or completion of inaccurate or outdated personal details.
Right to Erasure (Removal): Request the deletion of personal data when the purpose of collection is achieved or consent is withdrawn, subject to mandatory legal, statutory, and accounting retention requirements.
Right to Withdraw Consent: Withdraw previously granted consent at any time without adverse consequences.
Right to Nominate: Nominate an individual to exercise your data rights in the event of death or incapacity.

Important Notice: Ledger Immutability & The Anonymization Option

Third Estate publishes verifiable transaction logs, operational accounting, and audit trails to maintain absolute institutional transparency.

Technical Immutability of Ledgers: Because our transparency records and ledgers operate on an append-only, cryptographically verifiable structure, an existing entry or transaction line—once verified and written—cannot be altered, deleted, or removed from the historic ledger.

Your Option to Anonymize: To balance complete public auditability with personal privacy, you are given the option to fully anonymize your subscriber profile or survey submission. When anonymization is selected (either during pass activation or subsequently requested), all personal identifiers—including your name and email address—are severed and permanently purged. Only an anonymous hash and the transaction value remain on the permanent ledger, ensuring your personal identity cannot be linked to the record.

5. Exercising Data Removal or Anonymization Requests

To request the erasure of your personal details, withdraw consent, or request retrospective anonymization of your public records, write to us with the subject line "DPDP Rights Request":

Contact Email: [email protected]

Verification Requirement: Please send the request from your registered email address and provide any relevant transaction or submission ID to authenticate ownership.

Response Timeline: We review and act upon all genuine requests within statutory turnaround timelines (ordinarily within 30 days).

6. Data Security & Cross-Border Restrictions

We implement industry-standard organizational and technical safeguards—including TLS encrypted channels and restricted access protocols—to protect personal data against unauthorized disclosure, alteration, or compromise. We store and process personal data in compliance with cross-border transfer directives issued by the Central Government of India under the DPDP Act.

7. Protection of Children’s Personal Data

Third Estate does not knowingly collect or process personal data of individuals under 18 years of age without verifiable parental or legal guardian consent, nor do we perform behavioral tracking or targeted profiling on minors.

8. Grievance Redressal & DPBI Escalation

In compliance with the DPDP Act's grievance mechanism requirements, our designated redressal contact can be reached directly:

Role: Grievance Redressal & Privacy Lead

Organization: Third Estate

Email: [email protected]

If our team does not resolve your concern within the stipulated statutory period, you retain the right under the DPDP Act to submit an escalation to the Data Protection Board of India (DPBI).