QUANTIVA ADVISORY
Privacy Policy
Incorporating the EU/UK General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection Act, 2023 (DPDP Act)
Effective date: September 21, 2026 Last updated: September 26, 2026 Version: 2.0
Introduction
Quantiva Advisory (“Quantiva,” “we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. We are an accounting, financial, advisory and consulting firm established in India. This Privacy Policy explains how we collect, use, disclose, transfer, store and protect personal data when you visit https://www.quantivaadvisory.in/ (the “Website”), contact us, submit an enquiry, subscribe to our communications, or use our services.
This policy applies to Website visitors, prospective clients, clients and their personnel, business contacts, vendors, job applicants, and any other individual whose personal data we process. It is designed to meet the requirements of:
- India: the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”), under which Quantiva acts as a Data Fiduciary and you are a Data Principal; together with the Information Technology Act, 2000 and the SPDI Rules, 2011 to the extent still applicable.
- European Economic Area (EEA) and United Kingdom: Regulation (EU) 2016/679 (the “GDPR”) and the UK GDPR / Data Protection Act 2018 (together, “GDPR”), under which Quantiva acts as a Controller (or, for certain client engagements, a Processor) and you are a Data Subject.
Where this policy uses the term “personal data,” it means any information relating to an identified or identifiable natural person, and includes “digital personal data” as defined in the DPDP Act and “personal data” as defined in the GDPR. Where the two regimes impose different standards, we apply the standard that gives you the greater protection unless a specific section states otherwise.
1. Who We Are and How to Contact Us
| Role | Details |
| Data Fiduciary / Controller |
Quantiva Advisory Quantiva Advisory LLP Registered address:
Greenfield Heights
Sandhyatara 1A
Action Area 1
Block DJ
New Town
Kolkata 700156
India
|
| Privacy contact (all regions) |
Email: info@quantivaadvisory.in Subject line: “Privacy Request” |
| Grievance Officer (DPDP Act s.8(10); IT Rules) |
Reva Maheshwari Bhatia Managing Director Reva@quantivaadvisory.in |
| Data Protection Officer (GDPR Art. 37; DPDP Act s.10 if designated a Significant Data Fiduciary) | Reva Maheshwari Bhatia Managing Director Reva@quantivaadvisory.in |
| EU / UK Representative (GDPR Art. 27) | Reva Maheshwari Bhatia Managing Director Reva@quantivaadvisory.in |
2. Personal Data We Collect
We collect only the personal data that is adequate, relevant and limited to what is necessary for the purposes described in this policy (GDPR Art. 5(1)(c); DPDP Act s.6(1)). The categories below are collected depending on how you interact with us.
2.1 Data you provide directly
- Identity and contact details: name, business or company name, job title, email address, telephone number, postal address, country/state.
- Enquiry details: information submitted through contact or consultation forms, the services in which you are interested, and your communication preferences.
- Correspondence: messages, documents and attachments you send us, and notes of meetings, calls or other communications.
- Recruitment data (job applicants): CV, qualifications, employment history, references and right-to-work information.
Secure-channel requirement. Do not submit financial, tax, banking, payroll, government identification (e.g. PAN, Aadhaar, passport, national ID, social security numbers) or client information through the general Website contact form. We will direct you to an approved encrypted channel (client portal, secure file-transfer or encrypted email) for such information.
2.2 Client and engagement data
When you or your organisation engages us, we process the data necessary to deliver the agreed services, which may include:
- Business and financial records, accounting and transaction data, general ledger and trial balances
- Invoices, expenses, payment records and bank or payment-account details
- Tax-related information, including tax identification numbers (e.g. PAN, GSTIN, TIN, VAT/UTR numbers)
- Payroll and employee information supplied by a client employer
- Customer and vendor records held in a client’s accounting, ERP, CRM or financial systems
- Know-Your-Client (KYC) and identity-verification data required by anti-money-laundering, professional-conduct or tax law
- Information supplied by authorised representatives, accountants, advisers or other service providers
2.3 Data collected automatically
When you visit the Website, we or our service providers collect technical data through cookies and similar technologies (see Section 6): IP address; browser type and version; device type and operating system; approximate location derived from IP address; referring and exit pages; pages viewed; date, time and duration of visits; navigation patterns; cookie and device identifiers; and diagnostic, security and performance logs.
2.4 Data from third parties
We may receive personal data about you from: your employer or organisation (as our client or prospective client); publicly available sources such as company registries, professional networks and regulatory databases; referral partners; KYC, sanctions-screening and credit-reference providers; and our professional advisers.
2.5 Special categories and sensitive data
We do not intentionally collect special categories of personal data under GDPR Art. 9 (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation) or data relating to criminal convictions (Art. 10). If such data is contained in records a client provides for an engagement (for example, payroll records disclosing union dues or medical leave), we process it only where an Art. 9(2) condition applies, typically because processing is necessary for compliance with employment or social-security law obligations of the client, or with your explicit consent, and always subject to enhanced access controls.
The DPDP Act does not create a separate “sensitive data” category; however, we apply the same enhanced safeguards to financial-account data, government identifiers, biometric data and health data of Indian Data Principals, and, where the SPDI Rules 2011 continue to apply, we honour their consent and disclosure requirements.
3. Purposes of Processing and Legal Bases
We process personal data only for specified, explicit and lawful purposes (GDPR Art. 5(1)(b), Art. 6; DPDP Act s.4). The table below sets out each purpose, the GDPR legal basis, and the DPDP Act ground on which we rely.
| Purpose | Categories of data | GDPR legal basis (Art. 6) | DPDP Act ground (ss. 4, 6, 7) |
| Responding to enquiries and consultation requests; preparing proposals | Identity, contact, enquiry details | Pre-contractual steps at your request (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) | Voluntary provision of data for a specified purpose (s.7(a)); or consent (s.6) |
| Providing accounting, financial, advisory and consulting services under an engagement | Identity, contact, engagement data | Performance of a contract (Art. 6(1)(b)) | Consent (s.6) obtained through the engagement letter, or voluntary provision (s.7(a)) |
| KYC, anti-money-laundering, sanctions screening and identity verification | Identity, KYC, government identifiers | Legal obligation (Art. 6(1)(c)) | Compliance with law or court order (s.7(c)); consent where required |
| Maintaining financial, tax, audit and engagement records | Engagement data, invoices, payments | Legal obligation (Art. 6(1)(c)); contract (Art. 6(1)(b)) | Compliance with law (s.7(c)); consent (s.6) |
| Managing client relationships and communicating with authorised contacts | Identity, contact, correspondence | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) | Consent (s.6) or voluntary provision (s.7(a)) |
| Operating, securing and improving the Website; fraud and abuse prevention | Technical data, logs | Legitimate interests (Art. 6(1)(f)): network and information security | Consent for non-essential cookies (s.6); voluntary provision (s.7(a)) for strictly necessary processing |
| Website analytics and content personalisation | Technical data, cookie identifiers | Consent (Art. 6(1)(a)), via the cookie banner | Consent (s.6), via the cookie banner |
| Marketing communications, insights and event invitations | Identity, contact, preferences | Consent (Art. 6(1)(a)); or legitimate interests for existing clients (soft opt-in) where permitted | Consent (s.6), with an easy withdrawal option |
| Recruitment | Recruitment data | Pre-contractual steps (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) | Employment-related purposes (s.7(i)); voluntary provision (s.7(a)) |
| Establishing, exercising or defending legal claims; enforcing contracts | Any relevant category | Legitimate interests (Art. 6(1)(f)); Art. 9(2)(f) for special categories | Compliance with law or judgment (s.7(c)); legitimate uses (s.7) |
| Responding to lawful requests from regulators, courts and authorities | Any relevant category | Legal obligation (Art. 6(1)(c)) | State functions and compliance with law (ss.7(b), 7(c)) |
| Corporate transactions (merger, acquisition, restructuring) | Any relevant category | Legitimate interests (Art. 6(1)(f)) | Merger, amalgamation or similar approved by a competent authority (s.7(g)) |
Legitimate interests. Where we rely on legitimate interests under GDPR, we have carried out a balancing test to confirm that our interests are not overridden by your rights and freedoms. You may request a summary of that assessment by contacting us.
Purpose limitation. We will not process your personal data for a purpose incompatible with the purpose for which it was collected without first providing notice and, where required, obtaining fresh consent.
Statutory or contractual requirement. Provision of KYC and engagement data is a statutory and contractual requirement; if it is not provided we will be unable to onboard you or deliver the services.
4. Consent and Notice (DPDP Act ss. 5–6; GDPR Arts. 4(11), 7)
4.1 Notice
Where we process personal data on the basis of your consent, we will, at or before the time of requesting consent, give you a clear and stand-alone notice in plain language describing: (a) the personal data to be processed and the purpose; (b) how you may exercise your rights, including withdrawal of consent; and (c) how you may make a complaint to the Data Protection Board of India or the relevant EU/UK supervisory authority. For Indian Data Principals, this notice is available in English and, on request, in any language specified in the Eighth Schedule to the Constitution of India.
4.2 Standard of consent
Consent that we obtain will be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. We do not use pre-ticked boxes, bundled consent or consent as a condition of a service where the processing is not necessary for that service.
4.3 Withdrawal of consent
You may withdraw consent at any time with the same ease with which it was given, by using the unsubscribe link in our communications, adjusting the cookie-consent tool, or contacting us at the address in Section 1. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. After withdrawal we (and any Data Processor acting for us) will cease the relevant processing within a reasonable time unless retention is required by law, and you accept that withdrawal may mean we cannot continue to provide certain services.
4.4 Consent Managers (India)
Where you have registered with a Consent Manager registered with the Data Protection Board of India, you may give, manage, review and withdraw consent to Quantiva through that Consent Manager’s interoperable platform, and we will honour those instructions.
4.5 Processing where consent was given before this policy
If you gave consent to Quantiva before the DPDP Act came into force, we will continue processing on that basis and provide you with the Section 4.1 notice as soon as reasonably practicable, as permitted by s.5(2) of the DPDP Act, unless you withdraw consent.
5. Children’s Data
Our Website and services are intended for businesses and adults. We do not knowingly collect personal data from children. Under the DPDP Act, a “child” is any individual under 18 years of age; under the GDPR, the age of digital consent is 16 (or lower, down to 13, as set by individual Member States and the UK). If we become aware that we hold a child’s personal data, we will process it only with the verifiable consent of the parent or lawful guardian, obtained in the manner required by the DPDP Rules, and we will never undertake tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has provided personal data to us, please contact us so that we can delete it.
6. Cookies and Similar Technologies
The Website uses cookies, pixels, tags, local storage and similar technologies. We classify them as follows:
| Category | Purpose | Legal basis | Your control |
| Strictly necessary | Enable core functions, security, load-balancing and consent storage | Legitimate interests / not subject to consent (ePrivacy Art. 5(3) exemption) | Cannot be disabled via banner; browser settings only |
| Preference | Remember language, region and display settings | Consent | Cookie banner / browser settings |
| Analytics / performance | Understand how visitors use the Website and measure content performance | Consent | Cookie banner / browser settings |
| Marketing | Measure campaign effectiveness and deliver relevant content | Consent | Cookie banner / browser settings |
Non-essential cookies are set only after you give consent through the cookie banner, and you can change or withdraw your choices at any time using the “Cookie Settings” link in the Website footer. Session cookies expire when you close your browser; persistent cookies remain for the period stated in our Cookie Policy. Disabling cookies may affect Website functionality. Full details of each cookie, its provider and its lifespan are in our Cookie Policy at [Insert link].
7. Data Processors and Third-Party Services
We engage third-party service providers to process personal data on our behalf (Data Processors under the DPDP Act; Processors under GDPR Art. 28). Each is bound by a written contract that requires it to process personal data only on our documented instructions, to implement appropriate security measures, to keep the data confidential, to assist us with data-subject requests and breach notification, to delete or return the data at the end of the engagement, and not to appoint sub-processors without our authorisation. We remain responsible under the DPDP Act for compliance by any Data Processor we engage.
Categories of provider currently used:
| Category | Provider(s) | Location of processing | Transfer safeguard |
| Website hosting and content management | [Insert, e.g. hosting provider] | [Insert country] | [Insert, e.g. SCCs / adequacy / in-country] |
| Analytics and performance monitoring | [Insert, e.g. Google Analytics 4] | [Insert] | [Insert] |
| Email, productivity and business communications | [Insert, e.g. Microsoft 365 / Google Workspace] | [Insert] | [Insert] |
| CRM and enquiry management | [Insert, e.g. HubSpot / Zoho] | [Insert] | [Insert] |
| Appointment scheduling | [Insert, e.g. Calendly] | [Insert] | [Insert] |
| Security, spam detection and fraud prevention | [Insert, e.g. Cloudflare] | [Insert] | [Insert] |
| Cloud storage and document collaboration | [Insert] | [Insert] | [Insert] |
| Accounting, payment and business software | [Insert, e.g. Tally / Zoho Books / Razorpay] | [Insert] | [Insert] |
8. How We Share Personal Data
We disclose personal data only where a lawful basis exists, to the following categories of recipient:
- Our partners, employees and contractors who need it to perform their responsibilities, under confidentiality obligations and role-based access
- Data Processors listed in Section 7
- Professional advisers, including lawyers, auditors, insurers and (where required) professional regulators such as ICAI
- Banks, payment providers and financial institutions where necessary to process payments or deliver services
- Tax authorities, the Reserve Bank of India, the Ministry of Corporate Affairs, the Data Protection Board of India, EU/UK supervisory authorities, courts, regulators and law-enforcement agencies where required by law or a binding order
- A buyer, investor, successor or adviser in connection with a merger, acquisition, restructuring, financing or sale of all or part of our business, subject to confidentiality and, where required, notice to you
- Other parties at your direction or with your consent
We do not sell personal data, and we do not share it with third parties for their own direct-marketing purposes. Where a third party receives personal data as an independent controller (for example, a bank or regulator), that party’s own privacy notice governs its processing.
9. Client Engagements: When Quantiva Acts as Processor
Where we process personal data contained in a client’s records solely to deliver services under the client’s instructions (for example, bookkeeping, payroll processing or tax compliance), the client is the Data Fiduciary / Controller and Quantiva is a Data Processor / Processor. In those cases:
- We process the data only on the client’s documented instructions and the terms of the engagement letter and Data Processing Agreement, which contains the GDPR Art. 28(3) mandatory terms.
- Data-principal / data-subject requests relating to that data should be directed to the client; we will assist the client in responding within the statutory time limits.
- We will notify the client without undue delay on becoming aware of a personal data breach affecting that data, so that the client can meet its own notification duties.
- On termination we will return or delete the data as the client instructs, subject to our own professional record-keeping obligations.
- Where we determine the purposes and means of processing ourselves (for example, our own client-relationship records, invoicing and conflict checks), we are the Data Fiduciary / Controller for that processing and this policy applies.
10. International Data Transfers
10.1 Transfers from India (DPDP Act s.16)
We may transfer personal data of Indian Data Principals outside India to the countries in which our Data Processors and clients operate, except to any country or territory restricted by notification of the Central Government. We comply with any conditions on such transfers specified by the Central Government and with sector-specific localisation requirements (for example, RBI directions on payment-system data). Where personal data is processed on behalf of an Indian client, we follow the client’s instructions and applicable localisation rules.
10.2 Transfers from the EEA and UK (GDPR Chapter V)
India has not received an adequacy decision from the European Commission or the UK Government. Accordingly, when we receive personal data from the EEA or UK, or transfer it to a third country, we rely on one of the following safeguards:
- the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) or the UK International Data Transfer Agreement / Addendum, supplemented by a Transfer Impact Assessment and additional technical measures such as encryption where required;
- an adequacy decision for the destination country (GDPR Art. 45);
- binding corporate rules approved by a supervisory authority (Art. 47); or
- a derogation under Art. 49, such as your explicit consent or the necessity of the transfer for the performance of a contract with you, used only for occasional transfers.
You may obtain a copy of the safeguards we use by contacting us. Data protection laws in other countries may differ from those in your jurisdiction; the safeguards above are designed to ensure your data receives an essentially equivalent level of protection.
11. Data Security (GDPR Art. 32; DPDP Act s.8(5))
We implement appropriate technical and organisational measures, proportionate to the risk, to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure. These measures reflect the minimum standards specified in the DPDP Rules and industry practice for financial-services firms, and include:
| Control domain | Measures |
| Access control | Role-based, least-privilege access; multi-factor authentication for all systems holding personal data; prompt revocation on role change or exit; privileged-access logging |
| Encryption and masking | TLS 1.2+ for data in transit; AES-256 or equivalent encryption of data at rest in cloud storage, laptops and backups; masking or tokenisation of identifiers where practical |
| Secure communication | Approved encrypted channels for client financial data; prohibition on unencrypted email for KYC documents and bank details |
| Monitoring and logging | Centralised logging of access to personal data with logs retained for at least one year, as required by the DPDP Rules, to detect, investigate and remediate unauthorised access |
| Backup and resilience | Regular encrypted backups, tested restoration, and business-continuity plans to ensure ongoing availability and integrity |
| Vulnerability management | Patch management, endpoint protection, periodic vulnerability assessment and penetration testing of the Website and client portal |
| Vendor security | Due diligence and contractual security obligations for all Data Processors; periodic review of certifications (e.g. ISO/IEC 27001, SOC 2) |
| People | Confidentiality undertakings; mandatory privacy and security training on joining and annually; clear-desk and secure-disposal practices |
| Governance | Documented information-security policy, incident-response plan, data-protection impact assessments for high-risk processing, and annual review of this policy |
No system can be guaranteed completely secure. You are responsible for safeguarding your devices, passwords and account credentials and for using the secure channels we designate.
12. Personal Data Breach Notification
We maintain an incident-response plan to detect, contain and assess personal data breaches. In the event of a breach:
- India (DPDP Act s.8(6); DPDP Rules): we will notify the Data Protection Board of India and each affected Data Principal without delay, in the form and within the timelines prescribed by the DPDP Rules, describing the nature, extent, timing and likely impact of the breach, the measures taken to mitigate risk, and the safety measures you may take, together with the contact details of the person able to respond to your queries.
- EEA / UK (GDPR Arts. 33–34): where we are the Controller, we will notify the competent supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to individuals, and will inform affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
- Client data: where we act as Processor / Data Processor, we will notify the affected client without undue delay so that it can fulfil its own obligations.
We keep an internal register of all personal data breaches, whether or not notifiable.
13. Data Retention and Erasure
We retain personal data only for as long as necessary for the purpose for which it was collected, to satisfy legal, regulatory, tax, accounting and professional obligations, or to establish, exercise or defend legal claims (GDPR Art. 5(1)(e); DPDP Act s.8(7)). Under the DPDP Act, we will erase personal data, and cause our Data Processors to erase it, when you withdraw consent or as soon as it is reasonable to assume the specified purpose is no longer being served, unless retention is required by law. Indicative retention periods:
| Category | Retention period | Basis |
| Website enquiries that do not lead to an engagement | 12 months from last contact | Legitimate interests; purpose exhausted |
| Client engagement files, working papers and correspondence | 8 years after the end of the financial year to which they relate (or longer if required by professional standards or ongoing proceedings) | Companies Act 2013 s.128; Income-tax Act 1961; ICAI standards; limitation periods |
| Invoices, payment and tax records | 8 years | Companies Act 2013; GST law; Income-tax Act |
| KYC / AML records | 5 years after the end of the client relationship | PMLA 2002 and rules; professional-conduct obligations |
| Marketing consent and preference records | Duration of consent plus 3 years as evidence of consent | GDPR Art. 7(1) accountability; DPDP Act |
| Website technical logs | Up to 12 months | Security and DPDP Rules log-retention requirement |
| Unsuccessful job applications | 12 months from decision | Legitimate interests; defence of claims |
Before erasing personal data under the DPDP Act, we will give you at least the notice period required by the DPDP Rules so that you may contact us if you wish us to continue processing. When retention ends, we securely delete or irreversibly anonymise the data.
14. Your Rights
You have the following rights, subject to the conditions and exemptions in applicable law. The table shows which right applies under each regime.
| Right | GDPR | DPDP Act | What it means |
| Information / notice | Arts. 13–14 | s.5 | To be told, in this policy and the consent notice, how your data is used |
| Access | Art. 15 | s.11 | To obtain a summary of the personal data we process, the processing activities, and the identities of all Data Fiduciaries and Data Processors with whom it has been shared |
| Rectification / correction | Art. 16 | s.12 | To have inaccurate or incomplete data corrected, completed or updated |
| Erasure | Art. 17 | s.12 | To have your data deleted where it is no longer necessary, consent is withdrawn, or processing is unlawful, unless retention is required by law |
| Restriction of processing | Art. 18 | — | To limit how we use your data while a dispute about accuracy or lawfulness is resolved |
| Data portability | Art. 20 | — | To receive data you provided in a structured, machine-readable format, and to have it transmitted to another controller |
| Object | Art. 21 | — | To object to processing based on legitimate interests, and at any time to direct marketing |
| Withdraw consent | Art. 7(3) | s.6(4) | To withdraw consent at any time, as easily as it was given |
| Automated decision-making | Art. 22 | — | Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects |
| Grievance redressal | Art. 77 (complaint to supervisory authority) | s.13 | To have a readily available means of grievance redressal with Quantiva, and thereafter to approach the Data Protection Board of India or your EU/UK supervisory authority |
| Nominate | — | s.14 | To nominate another individual to exercise your rights in the event of your death or incapacity |
14.1 How to exercise your rights
Submit requests to the privacy contact or Grievance Officer in Section 1, using the subject line “Privacy Request”. Please identify yourself, the relationship you have with us (e.g. Website visitor, client contact, employee of a client), and the right you wish to exercise. We may need to verify your identity, and may ask for additional information for that purpose, which we will use only for verification.
14.2 Timelines
- DPDP Act: we will acknowledge and respond to your request or grievance within the period specified in the DPDP Rules, which will not exceed 90 days, and in practice we aim to respond within 30 days.
- GDPR: we will respond within one month of receipt, extendable by two further months for complex or numerous requests, in which case we will tell you why.
Requests are free of charge, except where they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, giving reasons. We will not discriminate against you for exercising your rights.
14.3 Data held for clients
If your data was provided to us by one of our clients (for example, as an employee, customer or vendor of that client), please direct your request to that client; we will support the client in responding.
14.4 Complaints
We encourage you to raise concerns with our Grievance Officer first, and we will make every effort to resolve them. If you are not satisfied, you have the right to lodge a complaint with:
- India: the Data Protection Board of India, through the complaint mechanism published on its website, after first exhausting our grievance-redressal process as required by s.13(3) of the DPDP Act.
- EEA: the supervisory authority of the Member State in which you live, work or where the alleged infringement occurred (list at edpb.europa.eu).
- UK: the Information Commissioner’s Office (ico.org.uk).
15. Duties of Data Principals (DPDP Act s.15)
The DPDP Act also places duties on you as a Data Principal. When interacting with Quantiva you must: comply with applicable law when exercising your rights; not impersonate another person; not suppress any material information when providing personal data for a document, identity proof or address proof issued by the State; not register a false or frivolous grievance or complaint; and provide only verifiably authentic information when exercising the right to correction or erasure. The Data Protection Board may impose a penalty for breach of these duties.
16. Marketing Communications
We send marketing emails, insights, newsletters and event invitations only with your consent or, for existing clients, in reliance on legitimate interests where the law permits a “soft opt-in” for similar services. Every marketing message contains an unsubscribe link, and you may opt out at any time by using that link or contacting us. Opting out does not affect essential administrative, contractual, security or service communications, which we will continue to send. We do not use third-party marketing lists and do not engage in profiling for marketing purposes without your consent.
17. Automated Decision-Making and Artificial Intelligence
We may use automation and AI-assisted tools to support internal research, data extraction and organisation, document processing, quality review, analytics and service delivery. When we do so:
- We do not make decisions producing legal or similarly significant effects on you based solely on automated processing (GDPR Art. 22). Any such decision is subject to meaningful human review, and you may contest it and request human intervention.
- AI tools are procured only after a privacy and security review; personal data is not input into public or consumer AI services, and enterprise tools are contractually prohibited from training on our or our clients’ data unless the client has authorised this in writing.
- Access to AI outputs is role-restricted, and outputs are validated by a qualified professional before being relied upon in any client deliverable.
- Where a high risk to individuals is likely, we conduct a Data Protection Impact Assessment (GDPR Art. 35) before deployment.
18. Our Accountability and Governance Measures
In line with the GDPR accountability principle (Art. 5(2), Art. 24) and the obligations of a Data Fiduciary under s.8 of the DPDP Act, Quantiva:
- maintains a Record of Processing Activities (Art. 30) and a register of Data Processors;
- implements privacy by design and by default (Art. 25), including data minimisation and pseudonymisation where practical;
- conducts Data Protection Impact Assessments for high-risk processing and, if notified as a Significant Data Fiduciary, appoints a Data Protection Officer based in India, an independent data auditor, and carries out periodic DPIAs and audits as required by s.10;
- ensures the completeness, accuracy and consistency of personal data used to make decisions affecting you or disclosed to another Data Fiduciary (s.8(3));
- trains all personnel and reviews this policy, our security controls and our vendor contracts at least annually; and
- maintains professional-indemnity and cyber-insurance cover appropriate to our services.
19. Third-Party Websites
The Website may contain links to third-party websites, applications or services. We do not control and are not responsible for their privacy, security, content or practices. We recommend reviewing the privacy policy of every external website or service you use.
20. Additional Region-Specific Disclosures
20.1 India
This policy constitutes the privacy policy required under Rule 4 of the SPDI Rules, 2011 to the extent those rules continue to apply, and the notice required under s.5 of the DPDP Act. Quantiva is not currently notified as a Significant Data Fiduciary. Personal data is stored on servers located in [Insert location(s)].
20.2 European Economic Area and United Kingdom
The Controller for personal data of EEA/UK individuals is the entity named in Section 1. Where required, our EU and UK representatives under Art. 27 are named in Section 1 and may be contacted on all matters relating to processing. You may exercise all rights in Section 14 and lodge a complaint with a supervisory authority as described in Section 14.4.
20.3 United States
Residents of certain US states may have additional rights under state privacy laws, including rights to know, access, correct, delete or obtain a copy of personal data and to opt out of certain sales, sharing, profiling or targeted advertising. Quantiva does not sell or share personal data for cross-context behavioural advertising. Where we deny or limit a request as permitted by law, we will explain why and, where available, how to appeal.
21. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, technology, business practices or legal obligations, including the phased commencement of provisions of the DPDP Act and DPDP Rules. The revised policy will be posted on this page with an updated “Last updated” date and version number. If changes are material, or if they would alter the basis on which we obtained your consent, we will provide direct notice and, where required, seek fresh consent before the changes take effect. Previous versions are available on request.
22. Contact Us
If you have questions, concerns, complaints or requests concerning this Privacy Policy or our handling of personal data, contact:
Quantiva Advisory LLP
Registered address:
Greenfield Heights
Sandhyatara 1A
Action Area 1
Block DJ
New Town
Kolkata 700156
India
Privacy email:
info@quantivaadvisory.in
Grievance Officer:
Reva Maheshwari Bhatia
Managing Director
Reva@quantivaadvisory.in
Website: https://www.quantivaadvisory.in/
For privacy requests and complaints, use the subject line “Privacy Request”. If you are contacting us regarding personal data processed for one of our clients, please identify the relevant client or engagement without including unnecessary sensitive information.
Annex A — Internal Implementation Checklist
| # | Action | GDPR ref. | DPDP ref. | Owner | Status |
| 1 | Appoint and publish Grievance Officer contact; define 30-day internal SLA | Art. 12 | s.8(10), s.13 | ☐ | |
| 2 | Assess need for DPO and EU/UK Art. 27 representative; appoint if required | Arts. 27, 37 | s.10 | ☐ | |
| 3 | Deploy stand-alone, itemised consent notice on enquiry form and onboarding pack; log consent records | Arts. 7, 13 | ss.5–6; DPDP Rules | ☐ | |
| 4 | Implement cookie-consent banner blocking non-essential cookies until consent; publish Cookie Policy | ePrivacy Art. 5(3) | s.6 | ☐ | |
| 5 | Complete Record of Processing Activities and processor register (Section 7 table) | Art. 30 | s.8(2) | ☐ | |
| 6 | Execute Data Processing Agreements with every vendor; verify SCCs / DPF for non-EEA vendors; document TIAs | Arts. 28, 44–46 | s.8(2), s.16 | ☐ | |
| 7 | Add Processor-mode DPA clauses to engagement letter template | Art. 28(3) | s.8(2) | ☐ | |
| 8 | Adopt breach-response plan with 72-hour (GDPR) and DPDP Rules timelines; maintain breach register | Arts. 33–34 | s.8(6) | ☐ | |
| 9 | Implement security baseline: MFA, encryption at rest/in transit, 1-year log retention, backups | Art. 32 | s.8(5); DPDP Rules | ☐ | |
| 10 | Adopt retention schedule (Section 13) and automated erasure / pre-erasure notice workflow | Art. 5(1)(e) | s.8(7) | ☐ | |
| 11 | Build DSAR / Data Principal request procedure and tracking log | Arts. 12–22 | ss.11–14 | ☐ | |
| 12 | Verifiable parental-consent process (if any child data could be processed) | Art. 8 | s.9 | ☐ | |
| 13 | Conduct DPIA for AI tools and any high-risk processing; AI acceptable-use policy | Art. 35 | s.10 (if SDF) | ☐ | |
| 14 | Annual staff privacy & security training; confidentiality undertakings | Art. 39 | s.8 | ☐ | |
| 15 | Provide policy and consent notice in Eighth Schedule languages on request | — | s.5(3) | ☐ | |
| 16 | Monitor DPDP Rules commencement dates and Central Government transfer restrictions; update policy | — | s.16; Rules | ☐ |