AramGRC ("AramGRC", "we", "us") respects your privacy. This policy explains what personal data we collect, how we use and protect it, and the rights you have. We act as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) in respect of the personal data we determine the purposes and means of processing.
1. Scope
This policy covers our website, the AramGRC platform, and related services (together, the "Services"). Where we process personal data on behalf of a customer (for example, data entered into a gap assessment), we act as a Data Processor and process that data under our customer's instructions and our agreement with them.
2. Information we collect
- Account information — name, work email, organisation, role, and authentication credentials.
- Organisation and assessment data — information you enter into assessments, governance records, gaps, action plans, comments, and any evidence files you upload.
- Marketing and contact data — work email and preferences when you subscribe, download a resource, or complete the self-assessment.
- Self-assessment results — the answers you submit and the resulting score and tier (and your email, if you choose to receive a copy).
- Usage data — log data, device and browser information, pages viewed, and similar analytics.
- Cookies and similar technologies — see Section 6.
3. How we use your data
- To provide, operate and secure the Services.
- To create and manage your account and respond to requests.
- To send service communications and, where you have opted in, relevant updates and resources.
- To improve our Services and develop new features.
- To detect, prevent and address security incidents, fraud and misuse.
- To comply with legal obligations.
4. Legal basis
We process personal data on the basis of your consent and/or other lawful grounds permitted under the DPDP Act and applicable law, including the performance of a contract with you and our legitimate operational and security purposes. Where we rely on consent, you may withdraw it at any time (Section 8).
5. How we share data
We do not sell your personal data. We share it only with:
- Service providers / sub-processors who help us run the Services (for example, cloud hosting and database infrastructure, email delivery, and analytics), bound by appropriate contractual obligations.
- Authorities or third parties where required by law or to protect our rights, users or the public.
- A successor entity in connection with a merger, acquisition or reorganisation, subject to this policy.
6. Cookies and analytics
We use necessary cookies to operate the site and, with your consent where required, analytics cookies to understand usage. You can control cookies through your browser settings and our cookie controls.
7. Data retention
We retain personal data only as long as necessary for the purposes described here, to provide the Services, and to meet legal, accounting or reporting requirements. Customer assessment data is retained per our agreement with the relevant customer and deleted or returned on termination.
8. Your rights
Subject to applicable law, you have the right to access, correct, update and erase your personal data; to withdraw consent; to grievance redressal; and to nominate another individual to exercise your rights in case of death or incapacity. To exercise any right, contact our Grievance Officer (Section 10). We will respond within the timelines required by law.
9. Security and international transfers
We apply technical and organisational safeguards to protect personal data — see our Security page. Where data is processed outside India, we do so in line with applicable legal requirements.
10. Grievance / Data Protection contact
Grievance Officer, AramGRC
contact@aramgrc.com
11. Children's data
The Services are not directed to children. We do not knowingly collect children's personal data without verifiable parental consent as required by law.
12. Changes
We may update this policy; we will post the revised version with a new "Last updated" date and, where appropriate, notify you.
Questions? Contact contact@aramgrc.com. Or visit our contact page.