Privacy notice

This notice explains what personal data The Firm collects through this website, why we collect it, how long we keep it, and what you can ask us to do with it. It is written to meet our obligations as a Data Fiduciary under the Digital Personal Data Protection Act, 2023.

Who we are

The Firm, Indiranagar, Bengaluru. For any question about this notice, or to exercise a right described below, write to privacy@thefirm.world.

What we collect, and why

We collect only what we need to assess an application or an expression of interest. We do not buy personal data, and we do not build profiles.

• Membership applications. Your name, email address, telephone number, optional LinkedIn URL, occupation, role, company, locality, the name of any member who nominated you, the card you are interested in, and your answer to what you would use the room for. Purpose: to assess your application, arrange a conversation with the committee, and tell you the outcome.
• Investor registrations. Your name, email address, telephone number, entity name, investor type, intended amount band, timeline, any message, and your self-certification. Purpose: to review your registration and, if appropriate, send you materials.
• Technical data. Your IP address is used transiently to rate-limit form submissions and is not stored against your record.

Consent

We process this data on the consent you give at the point of collection. That consent is specific to the purpose stated above. You may withdraw it at any time by writing to privacy@thefirm.world. Withdrawing consent does not affect anything we did lawfully before you withdrew it, and it will normally mean we cannot take an application further.

Cookies and analytics

This site sets no advertising or analytics cookies, and there is no third-party tracking on it. An unfinished application is kept in your own browser’s local storage so that a refresh does not lose your answers; it never leaves your device until you submit, and clearing your browser data removes it.

Who else sees it

Your data is seen by the founding committee and the small number of people who administer the club. We use processors to host the site and to send transactional email; they act on our instructions only. We do not sell personal data, and we do not share it for anyone else’s marketing.

How long we keep it

• Applications that are declined or withdrawn: erased twelve months after the decision.
• Applications that become memberships: kept for the life of the membership and for eight years afterwards, where tax and company law require it.
• Investor registrations: kept for eight years, as records relating to a securities transaction.

Your rights

Under the DPDP Act, 2023 you may ask us to:

• Confirm what personal data of yours we hold, and give you a summary of it.
• Correct anything inaccurate, complete anything incomplete, or update anything out of date.
• Erase your data where it is no longer needed for the purpose it was collected for.
• Nominate another person to exercise these rights on your behalf in the event of death or incapacity.

Write to privacy@thefirm.world and we will respond within thirty days.

Grievances

If you are not satisfied with how we have handled your data or your request, our Grievance Officer can be reached at the same address, marked for their attention. If we cannot resolve it between us, you may complain to the Data Protection Board of India.

Security

Data is transmitted over HTTPS and held in access-controlled systems. Credentials and keys are held as deployment secrets and never in our source code.

Changes

If this notice changes materially we will update the date at the top and, where the change affects a purpose you consented to, tell you directly.