Privacy policy

NorthIron is a compliance platform operated by SecComply Technologies Private Limited ("we", "us"), registered office [registered office address to be inserted]. This policy covers the website at northiron.ai.

For the personal data described here we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025. We decide why and how your data is processed, and we are accountable for it.

What this policy does not cover. Data that customers put into the NorthIron platform is processed on their behalf under our customer agreement and our data processing agreement. For that data the customer is the Data Fiduciary and we act as their processor.

We publish this notice under Section 5 of the DPDP Act and Rule 3 of the DPDP Rules, 2025. It is written to be read on its own, in plain language.

This notice is in English. Under Section 5(3) of the DPDP Act you may ask for it in any language listed in the Eighth Schedule to the Constitution of India. Write to info@seccomply.net naming the language and we will provide a translation free of charge.

You can browse the whole website without giving us any personal data. Every form is optional, and we rely on your consent under Section 6 of the DPDP Act for each one.

Website security. To stop automated abuse our forms use a hidden field and a minimum time to submit. Neither stores anything about you. Our hosting provider keeps standard access logs, including IP addresses, for its own security and reliability purposes.

We do not sell your personal data, we do not use it to build advertising profiles, and we make no automated decision about you that has a legal or similarly significant effect.

This website sets no cookies. It keeps two strictly necessary items in your browser's local storage: your cookie choice, so we do not ask again, and whether you closed the announcement bar. Neither identifies you.

No analytics runs on this site today. If we add analytics it will load only after you opt in, and you can withdraw at any time through Cookie preferences in the footer. We honour the Global Privacy Control browser signal as a refusal. The cookie policy lists every item individually.

We share personal data only with service providers who process it on our instructions under written terms, listed on our subprocessors page. Some are based outside India. Section 16 of the DPDP Act permits this except to countries the Central Government has restricted, and we transfer nothing to a restricted country.

Beyond those providers we disclose personal data only where you ask us to, where the law requires it, or where our business changes hands, and in that case subject to the same protections described here.

Under Section 8(7) of the DPDP Act we erase personal data once its purpose is no longer served. In practice:

• Enquiry, demo and report records: 24 months from our last interaction with you. If you become a customer, for as long as that relationship lasts instead.
• Customer and financial records: for the contract term and afterwards for as long as tax, accounting and contractual obligations require.

You can ask us to erase your data sooner at any time, and we will unless the law requires us to keep it.

• Access (Section 11): a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
• Correction and erasure (Section 12): have inaccurate data corrected, incomplete data completed, or your data erased.
• Withdraw consent (Section 6(4)): as easily as you gave it. This does not undo processing that already happened lawfully.
• Nominate (Section 14): name another person to exercise these rights for you if you die or become incapacitated.
• Grievance redressal (Section 13): see the next section.

How to exercise them. Email info@seccomply.net with the subject line "DPDP Rights Request", say which right you are exercising, and include the email address you gave us so we can find your records. We may ask one verifying question first. There is no fee.

Section 15 of the DPDP Act asks Data Principals not to file false or frivolous complaints and to give authentic information when asking for a correction.

If you are unhappy with how we have handled your data or your request, contact our Grievance Officer:

• Grievance Officer, SecComply Technologies Private Limited
• Email: info@seccomply.net
• Address: [registered office address to be inserted]

We acknowledge a grievance within 3 business days and give a full response within 15 business days. Where a matter needs longer we will tell you why, and we will always respond within the period the DPDP Rules, 2025 prescribe.

If you are not satisfied, you may complain to the Data Protection Board of India. Section 13(3) of the DPDP Act requires you to raise the matter with us first.

If a breach affects your data we will tell you without delay, in plain language: what happened, what data was involved, what we are doing and what you can do. We will also report it to the Data Protection Board of India, with a detailed report within 72 hours, as the DPDP Rules, 2025 require.

This website is for businesses and is not directed at anyone under 18. We do not knowingly collect children's data, and we carry out no tracking or targeted advertising directed at children. If you think a child has given us their data, write to info@seccomply.net and we will delete it.

We take the reasonable security safeguards Section 8(5) of the DPDP Act requires, including encryption in transit and at rest, role-based access, collecting only what each form needs, and written terms with every provider. No system is perfectly secure and we will not claim otherwise.

If you are in the European Economic Area or the United Kingdom, the GDPR also applies. We rely on consent for the forms and any analytics, on contractual necessity for steps you ask us to take before a contract, on legitimate interests for website security, and on legal obligation where the law requires us to keep data.

You also have the rights to restrict processing, to data portability, and to object to processing based on legitimate interests. Transfers out of the EEA or UK rely on Standard Contractual Clauses or another recognised mechanism. You may complain to your local supervisory authority, though we would like the chance to resolve it first.

We update this policy when our practices or legal obligations change, and the effective date above always shows the current version. Where a change materially affects how we handle your data we will tell you clearly, and ask for consent again where the law requires it.

• SecComply Technologies Private Limited
• Email: info@seccomply.net
• Address: [registered office address to be inserted]