Privacy Policy.
- Effective from
- 7 October 2026
- Version
- 1.1
- Applies to
- www.mavensmark.com/india/company-incorporation and the incorporation service ordered through it
We ask for the documents the Ministry of Corporate Affairs requires, we use them for your incorporation and nothing else, and we delete what we are not obliged to keep.
We do not sell your personal data. We do not trade it, rent it or hand it to anyone for their own marketing. Nobody outside the people working on your file sees it unless the law puts it there or you tell us to send it. This notice sets out exactly what we hold, why we hold it, how long we hold it, and what you can make us do about it.
This is both our privacy policy and the notice required by Section 5 of the Digital Personal Data Protection Act, 2023. Under that Act you are the Data Principal and we are the Data Fiduciary: you own the data, we are answerable for it.
It is written in English. If you would prefer it in Hindi, Malayalam or any other language in the Eighth Schedule to the Constitution of India, write to us and we will send it to you in that language.
1. Who we are
1.1
Mavensmark Consultancy Private Limited, Corporate Identity Number U74140KL2015PTC038688, with its registered office in Thiruvananthapuram, Kerala, and its place of business at HD-196, WeWork Salarpuria Magnificia, Old Madras Road, Bengaluru, Karnataka 560016. In this notice, we and us mean that company.
1.2
We are the Data Fiduciary for the personal data described here. Our contact for any question about how we handle personal data, and our Grievance Officer, is Deepak Bhasi, whose details are in clause 20.
2. When this notice applies
2.1
This notice applies when you visit our incorporation pages, when you message us on WhatsApp or ask us to call you, when you place and pay for an order, and when you or another subscriber uploads documents for that order.
2.2
Engagements agreed with us separately in writing, and our other service lines, are covered by the terms of those engagements. Where they say nothing about personal data, this notice applies to them too.
3. Whose personal data this is
3.1
An incorporation is never about one person. A Private Limited Company needs at least two subscribers, and we will hold personal data about each of them, about every proposed director, and about anyone who signs a document in your file.
3.2
Each of those people is a Data Principal in their own right. Under Section 6 of the Digital Personal Data Protection Act, 2023 consent must be given by the person whose data it is. One subscriber cannot give it for another, however closely they work together.
3.3
So we send every subscriber and every proposed director their own copy of this notice and ask each of them for their own consent, at their own email address and mobile number, before we process their documents. If you are uploading a document belonging to someone else, please make sure they know it is coming to us. We will contact them directly in any event.
If a person named in your order does not give consent, we cannot process their documents, and the incorporation cannot go forward with them named. We will tell you promptly if that happens so that you can decide what to do, and clause 14 explains what it means for your order.
4. What we collect, and why
The table below is an itemised account of the personal data we collect and the purpose of each item, as Section 5 of the Act and Rule 3 of the Digital Personal Data Protection Rules, 2025 require. We do not collect anything that is not on this list, and we do not use anything on it for a purpose that is not next to it.
| What we collect | Where it comes from | Why we need it |
|---|---|---|
| Name, email address, mobile number | You, when you enquire, order or are named as a subscriber or director, and the person placing the order, for each other subscriber and proposed director | To identify you, to answer you, to send your status updates and to make the one call that completes your Digital Signature |
| Proposed company names, business activity, state, capital, subscriber and director count | You, in the online form | To search and clear your names, to draft the memorandum and articles, and to price the order correctly |
| Director Identification Number, where a person already holds one, and whether each person is 18 or over | You, in the online form, for yourself and for each other subscriber and proposed director | To check before we file that the number is active, its KYC is up to date and its holder is not disqualified under Section 164 of the Companies Act, 2013; to apply for a number only for someone who has none; and because a person under 18 cannot be a director |
| Permanent Account Number | Each subscriber and proposed director | Required by the Ministry of Corporate Affairs for the incorporation form, for a Director Identification Number and for the company's own tax registrations |
| Aadhaar number and Aadhaar document | Each subscriber and proposed director | Accepted as proof of identity and address in the incorporation filings. See clause 7, which explains how we limit this |
| Photograph | Each subscriber and proposed director | Required for the Digital Signature Certificate application and for the incorporation filings |
| Address proof: bank statement or utility bill | Each subscriber and proposed director | Required as proof of residential address in the incorporation filings |
| Registered office proof: utility bill, rent agreement, no objection certificate, ownership proof | You | Required for the intimation of the registered office |
| Specimen signature and Digital Signature Certificate details | Each subscriber, and the Certifying Authority | To apply for the certificate and to sign the incorporation documents |
| Payment reference, amount, date and method | Our payment gateway | To confirm your order, to issue your invoice, to process any refund and to keep the tax records the law requires |
| Your messages to us, and our replies | You, by email, WhatsApp or the call request form | To answer you and to keep a record of what was agreed |
| Device, browser, approximate location and pages viewed | Your browser, through cookies and similar technology | To keep the site working, to measure how it performs and, only if you agree, to measure our advertising. See clause 12 |
4.1
We do not ask for anything about your health, your religion, your caste, your politics or your biometrics, and please do not send us any of it. If a document you send us happens to contain something of that kind, we will redact it or ask you for a clean copy.
4.2
We never see your card number, your card verification value or your banking password. Those go directly to our payment gateway, which is certified to handle them. We receive only the reference, the amount and whether the payment succeeded.
5. The ground on which we process it
5.1
We process your personal data on the ground of your consent, given under Section 6 of the Digital Personal Data Protection Act, 2023. Your consent is asked for separately from our terms, in plain words, by a box you tick yourself. It is never pre-ticked, and we never take silence for agreement.
5.2
Your consent covers only the personal data necessary for the purposes listed in clause 4. If we ever want to use it for something else, we will come back and ask you again.
5.3
Where you have voluntarily given us personal data for a purpose and have not indicated that you object to its use for that purpose, we may also rely on Section 7 of the Act. We do not use that provision to widen anything beyond clause 4.
5.4
Some of what we do with your data is not a matter of choice for either of us. Once you ask us to incorporate a company, the Companies Act, 2013 obliges us to put certain information before the Ministry of Corporate Affairs. Clause 6 explains what that means.
6. What becomes a public record
6.1
This is the part of an incorporation that surprises people most, so we would rather you heard it from us before you pay than discover it afterwards.
6.2
A company is a public institution. Documents filed with the Registrar of Companies become part of the public register, and under Section 399 of the Companies Act, 2013 any person may inspect them and take copies on payment of the prescribed fee. Once your company exists, the following are ordinarily open to public inspection on the portal of the Ministry of Corporate Affairs: the company's name, its registered office address, its date of incorporation and its Corporate Identity Number; the names of its directors, their Director Identification Numbers and the other companies they are associated with; the memorandum and articles of association, which name the subscribers and the shares each has taken; and the documents filed after incorporation.
6.3
We cannot prevent that and neither can you. It follows from choosing a corporate form, and it is the same for every company in India. What we can do is make sure nothing goes on the public record that does not have to. We file only what the form requires.
6.4
Your Permanent Account Number, your Aadhaar number, your photograph, your bank statement and your utility bill are supporting documents. They are not published on the portal for anyone to browse, though they are held by the Ministry and may be seen by the authorities entitled to see them.
7. Aadhaar, and how we limit it
7.1
We treat an Aadhaar number as the most sensitive thing in your file, and we handle it accordingly.
- We ask for a masked Aadhaar, showing only the last four digits, wherever the filing will accept one, and we ask for the full number only where a form we must file requires it.
- We are not a requesting entity under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016. We do not carry out Aadhaar authentication, we do not collect your biometrics and we never ask for your Aadhaar one-time password.
- We never publish or display an Aadhaar number, which Section 29(4) of that Act forbids in any event.
- Aadhaar documents are stored encrypted, are visible only to the people working on your file, and are deleted on the timetable in clause 10.
7.2
If you would rather not give us Aadhaar at all, tell us. In many cases another accepted proof of identity or address will do, and we will tell you honestly whether it will work for your filing.
8. Who we share it with
We share personal data only with the following, and only so much of it as each of them needs.
| Who | Why |
|---|---|
| The Ministry of Corporate Affairs and the Central Registration Centre | Because the Companies Act, 2013 requires the filings to be made |
| The Certifying Authority that issues your Digital Signature Certificate | Because only a licensed Certifying Authority may issue one. It will conduct its own video verification with each subscriber and is answerable for the data it collects in doing so |
| The Income Tax Department, and any other authority named in a linked form | Because the incorporation form applies for the company's permanent account number, tax deduction account number and the other registrations you have asked for |
| Our payment gateway | To take your payment and to make any refund |
| Our information technology suppliers: website hosting, email, secure document storage and the courier that carries your token | So that the service can run at all. Each of them acts on our written instructions and may use your data for nothing else |
| A court, a regulator, a tax authority or a law enforcement agency | Where we are required by law to give it, and only so far as we are required |
8.1
We do not sell personal data. We do not rent it, trade it, or pass it to anyone for their own marketing, and we never will. If we ever transfer our business, any transfer of client data would be subject to the same protections as this notice and we would tell you first.
8.2
Every supplier who processes personal data for us does so under a written contract that binds them to the standards in this notice, as Section 8(2) of the Digital Personal Data Protection Act, 2023 requires. We remain answerable to you for what they do.
9. Where your data is processed
9.1
Your file itself, and the filings we make from it, stay in India. Some of the ordinary tools we use to run a website and a business, including hosting, email and website analytics, are operated by companies whose servers may be located outside India, so limited personal data may be processed there.
9.2
Section 16 of the Digital Personal Data Protection Act, 2023 permits transfer outside India except to a country the Central Government has restricted. We do not transfer personal data to any restricted country, and we will change our arrangements if a restriction is notified.
10. How long we keep it
Section 8(7) of the Act requires us to erase personal data once you withdraw your consent or once the purpose is served, unless a law requires us to keep it. These are the periods we apply.
| What | How long |
|---|---|
| Identity and address documents uploaded for an order that was cancelled and never filed | Erased within 90 days of the cancellation being settled |
| Identity and address documents that were filed, or that supported a filing | 8 years from the end of the financial year in which the incorporation was completed |
| The incorporation file: forms filed, certificates issued, minutes, registers and correspondence | 8 years from the end of the financial year in which the incorporation was completed |
| Payment records, invoices and credit notes | 8 years from the end of the relevant financial year, because tax and company law require it |
| Client identification records, where anti-money-laundering law applies to the engagement | 5 years from the end of the engagement, as that law requires |
| Enquiries that never became an order | 24 months from the last time we heard from you |
| Website analytics | No more than 14 months |
| Access logs of our own systems | At least 1 year, so that we can investigate anything that goes wrong |
10.1
When a period ends we delete the data, and we require our suppliers to delete their copies too. Where deletion is not technically possible straight away, for example in a backup, we put the data beyond ordinary use and delete it when the backup is next cycled.
10.2
We would rather hold less than more. If you think we are holding something we no longer need, tell us and we will look at it.
11. How we protect it
We maintain reasonable security safeguards under Section 8(4) of the Act. In practice that means:
- Documents travel to us over an encrypted connection and are stored encrypted. We do not accept identity documents over WhatsApp or ordinary email, and we will ask you to use the secure upload link instead.
- Access is limited to the people working on your file, on a need to know basis, and every access is logged.
- Access is withdrawn on the day a person stops working on the engagement.
- We keep backups, and we test that they restore.
- Every supplier who touches personal data is bound by a written contract to the same standards.
Nobody at Mavensmark will ever ask you for a one-time password, a banking password or your card details. If someone does, it is not us. Please tell us at once.
12. Cookies, analytics and advertising
12.1
Some cookies are strictly necessary: they keep you logged into your document portal, keep your form entries as you move between steps, and keep the site secure. Those are set without asking, because the site cannot work without them.
12.2
Everything else is asked for first. Analytics cookies, which tell us which parts of the page people read and where they give up, and advertising cookies, which tell us whether an advertisement led to an order, are set only if you agree on the banner shown on your first visit.
12.3
Advertising and analytics tools are operated by companies outside India and they receive limited data about your visit under their own terms. If you decline, the site works exactly as before; you simply become invisible to our measurement.
12.4
You may change your mind at any time from the same banner or from the link in the footer of our website, and your browser settings can block cookies too.
13. Your rights
The Digital Personal Data Protection Act, 2023 gives you the following rights over your own personal data. We do not charge for any of them.
| Right | What it means | Where it comes from |
|---|---|---|
| To know what we hold | A summary of the personal data we hold about you, what we are doing with it, and who we have shared it with | Section 11 |
| To correct or complete it | Correction of anything inaccurate, completion of anything incomplete, and updating of anything out of date | Section 12 |
| To have it erased | Erasure of personal data we are no longer required to keep | Section 12 |
| To be heard when something goes wrong | Our grievance mechanism under clause 20, before you approach the Data Protection Board of India | Section 13 |
| To nominate someone | To name a person who may exercise these rights for you if you die or become unable to do so yourself | Section 14 |
13.1
To use any of them, write to deepak@mavensmark.com from the email address we hold for you. We will acknowledge within 48 hours and answer within 30 days. If we cannot do what you have asked, we will tell you why, in writing, and what you can do next.
13.2
Where the law requires us to keep something you have asked us to erase, we will say so and name the law, rather than simply declining.
14. Withdrawing your consent
14.1
You may withdraw your consent at any time, and it must be as easy to withdraw as it was to give. Write to deepak@mavensmark.com, or use the link in any message we send you.
14.2
We will stop processing within a reasonable time and erase what we are not required to keep. Withdrawal does not undo anything lawfully done before it.
14.3
We should be straight with you about the consequence, because Section 6(5) of the Act makes it yours to bear. If you withdraw consent while your incorporation is under way, we cannot continue it, and the order is treated as cancelled at the stage it had reached. What comes back to you is then decided by our Refund and Cancellation Policy, not by this notice. Nothing in your withdrawal is treated as a breach on your part.
14.4
Anything already filed with the Ministry of Corporate Affairs cannot be withdrawn by us. Clause 6 explains why.
15. Children
15.1
A person under 18 cannot be a director of a company, and this service is not offered to children. We do not knowingly collect the personal data of anyone under 18, and we do not track, profile or advertise to children.
15.2
If we find that we hold a child's personal data without the verifiable consent of a parent or lawful guardian required by Section 9 of the Act, we will delete it. If you believe that has happened, tell us and we will act the same day.
16. If something goes wrong
16.1
If there is a personal data breach affecting you, we will tell you. We will describe what happened, what data was involved, when it happened so far as we know, what it may mean for you, what we have done about it and what you can do to protect yourself.
16.2
We will also report it to the Data Protection Board of India, without delay on becoming aware and in detail within 72 hours, as the Digital Personal Data Protection Rules, 2025 require.
16.3
We will not wait until we have every answer before telling you. Losing time is worse than looking incomplete.
17. Automated decisions
17.1
No decision about you is made automatically. A chartered accountant reviews your file before it is filed. We do not profile you, we do not score you, and we do not use your personal data to train any artificial intelligence system.
18. Our duty of confidentiality
18.1
Data protection law is not the only thing that binds us here. As a firm founded and led by chartered accountants we owe a professional duty of confidentiality over everything you tell us, under the Code of Ethics of the Institute of Chartered Accountants of India.
18.2
That duty continues after your engagement ends and after any relationship between us ends. It yields only where the law compels disclosure, and then only to the extent compelled.
19. What the Act asks of you
19.1
Section 15 of the Digital Personal Data Protection Act, 2023 places a few duties on you as well. In short: give us authentic information and do not impersonate anyone else; do not suppress anything material when supplying a document required by law; and do not register a false or frivolous complaint. We mention this not as a warning but because a notice that sets out only one side of the Act is not a complete one.
19.2
This matters practically in incorporation. Documents supplied to us are filed with the Government under declarations signed by you, and a document that is not genuine creates a problem for the person who signed the declaration, not for us.
20. How to contact us, and how to complain
20.1
For any question about your personal data, and for any complaint about how we have handled it, please write to:
Data protection contact and Grievance Officer
Deepak Bhasi, Founder and Chief Consultant
Mavensmark Consultancy Private Limited
HD-196, WeWork Salarpuria Magnificia, Old Madras Road, Bengaluru, Karnataka 560016
20.2
We acknowledge every complaint within 48 hours and resolve it within 30 days. You will get a written answer, from a person, with a reason.
20.3
If you are not satisfied with our answer, or we do not answer in time, you may complain to the Data Protection Board of India. Section 13(3) of the Act asks you to use our mechanism first, which is why we have tried to make it a real one.
20.4
Nothing here affects your rights under the Consumer Protection Act, 2019, including your right to approach a consumer commission.
21. Changes to this notice
21.1
We may amend this notice. The version that applies to your order is the one in force on the date you gave your consent, and we keep earlier versions. If we make a change that materially affects how we use personal data we already hold, we will tell you and, where the law requires it, ask for your consent again.
21.2
Where this notice differs from anything else said about personal data on our website or by any person on our behalf, this notice prevails.
Schedule. The law this notice is built on
Set out so that nothing here has to be taken on trust.
| Subject | Provision |
|---|---|
| Notice of what we collect and why | Section 5, Digital Personal Data Protection Act, 2023, and Rule 3, Digital Personal Data Protection Rules, 2025 |
| Consent, and its withdrawal | Section 6, Digital Personal Data Protection Act, 2023 |
| Processing for certain legitimate uses | Section 7, Digital Personal Data Protection Act, 2023 |
| Our obligations, including security, accuracy, erasure and grievance redressal | Section 8, Digital Personal Data Protection Act, 2023 |
| Children's personal data | Section 9, Digital Personal Data Protection Act, 2023 |
| Your rights to access, correction, erasure, grievance redressal and nomination | Sections 11 to 14, Digital Personal Data Protection Act, 2023 |
| Your duties | Section 15, Digital Personal Data Protection Act, 2023 |
| Processing outside India | Section 16, Digital Personal Data Protection Act, 2023 |
| Reporting a personal data breach within 72 hours | Digital Personal Data Protection Rules, 2025 |
| Reasonable security practices for personal information | Information Technology Act, 2000, and the rules made under it |
| Aadhaar: no publication or display, and no authentication by us | Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, in particular Section 29(4) |
| Public inspection of documents filed with the Registrar | Section 399, Companies Act, 2013 |
| Incorporation filings, and the information they must carry | Sections 7 and 12, Companies Act, 2013, and the Companies (Incorporation) Rules, 2014 |
| Our duties as a seller of services online, and our grievance officer | Consumer Protection (E-Commerce) Rules, 2020, in particular Rule 4 |
| Professional confidentiality | Code of Ethics, Institute of Chartered Accountants of India |
Mavensmark Consultancy Private Limited
Corporate Identity Number U74140KL2015PTC038688
Place of business: HD-196, WeWork Salarpuria Magnificia, Old Madras Road, Bengaluru, Karnataka 560016
GSTIN 29AAJCM8234A1ZH|Registered office: Thiruvananthapuram, Kerala
Bengaluru · Thiruvananthapuram · Kochi · Kozhikode · Dubai · Qatar · www.mavensmark.com
Register your company anywhere in India.
Start the registration yourself, or talk to us first.