Privacy Policy.

At Brydgework Consultants, trust is the foundation of every engagement. This Privacy Policy explains, clearly and honestly, what personal data we collect, why we collect it, how we use and protect it, and the rights you can exercise over it.

Introduction

This Privacy Policy ("Policy") describes how Brydgework Consultants ("Brydgework", "we", "us" or "our") handles personal data in the course of operating this website and delivering advisory, branding, financial, organisational and consulting services to micro, small and medium enterprises (MSMEs), NGOs, social enterprises and government bodies across India.

We act as a "Data Fiduciary" within the meaning of the Digital Personal Data Protection Act, 2023 ("DPDP Act") in respect of the personal data we determine the purposes and means of processing. By using this website or engaging our services, you acknowledge that you have read and understood this Policy.

Information We Collect

We collect only the personal data we reasonably need to operate our business, deliver our services and meet our legal obligations. The categories of data we may collect include:

• Identity & contact data: your name, designation, organisation, email address, postal address and telephone number.
• Engagement data: information you share when scoping or delivering a consulting engagement, including business plans, financial statements, organisational details and project documentation.
• Enquiry data: the content of messages you send through our contact forms, by email or over the phone.
• Technical data: IP address, browser type and version, device information, and general location inferred from your IP address.
• Usage data: pages viewed, links clicked, time spent and similar analytics that help us understand how the website is used.

We do not knowingly collect special categories of sensitive data through this website. Where an engagement requires us to handle sensitive commercial or financial information, we do so under a separate written agreement.

How We Use Information

We use personal data for clearly defined, lawful purposes, including to:

• respond to your enquiries and provide the information or consultation you request;
• scope, deliver, manage and improve our advisory and consulting services;
• administer contracts, raise invoices and process payments;
• send service communications and, where you have opted in, our monthly insights brief;
• maintain the security, integrity and performance of our website; and
• comply with applicable laws, regulations and lawful requests from authorities.

We will not use your personal data for a materially different purpose without first informing you and, where required, obtaining your consent.

Legal Basis for Processing

Under the DPDP Act, we process personal data on the following lawful bases:

• Consent, for example, when you subscribe to our newsletter or voluntarily submit an enquiry. You may withdraw consent at any time, as described under "Your Rights".
• Performance of a contract, to deliver the services you have engaged us for and to manage our commercial relationship.
• Legitimate uses and legal obligation, to comply with statutory, tax, regulatory and record-keeping requirements applicable in India.

Cookies & Tracking

Our website uses a small number of cookies and similar technologies to function correctly and to help us understand usage. These fall into two broad groups:

• Essential storage, required for the site to operate and keep it secure, including remembering your cookie choice.
• Analytics cookies (Google Analytics), to measure traffic and improve our content in aggregate form. We do not use advertising cookies and never sell your data. If you choose Decline in our cookie notice, no analytics cookies are set and only anonymous, cookie-free visit counts are recorded.

You can change your cookie choice at any time, or control cookies through your browser settings. Disabling essential storage may affect how parts of the website function.

Data Sharing & Third Parties

We do not sell your personal data. We share it only where necessary and with appropriate safeguards in place, including with:

• Trusted service providers ("Data Processors") who support our operations (such as hosting, email, analytics and payment providers) under contracts that require them to protect your data and use it only on our instructions;
• Professional advisers such as auditors, accountants and legal counsel, where reasonably required; and
• Authorities and regulators where we are legally obliged to disclose information.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, tax or reporting requirements. Engagement records are typically retained for the duration of the relationship and for a defined period thereafter in line with statutory limitation periods. When data is no longer required, we securely delete or anonymise it.

Data Security

We maintain reasonable technical and organisational safeguards designed to protect personal data against unauthorised access, alteration, disclosure or destruction. These include access controls, encryption in transit, confidentiality obligations on our team, and regular review of our practices. While no method of transmission or storage is completely secure, we work continuously to protect the information entrusted to us and will notify the Data Protection Board and affected individuals of a personal data breach where required by law.

Your Rights

Subject to applicable law, and in particular the DPDP Act, you have the right to:

• access a summary of the personal data we hold about you and how it is processed;
• correct or update inaccurate, incomplete or out-of-date data;
• erase personal data that is no longer necessary for the purpose it was collected;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• nominate another individual to exercise your rights in the event of death or incapacity; and
• grievance redressal, to raise a concern with our Grievance Officer and, if unresolved, with the Data Protection Board of India.

To exercise any of these rights, please contact us using the details below. We will respond within the timelines prescribed under applicable law.

Children's Privacy

Our website and services are intended for businesses and professionals and are not directed at children. We do not knowingly collect the personal data of children (individuals below eighteen years of age) without verifiable consent from a parent or lawful guardian, as required by the DPDP Act. If you believe we have inadvertently collected such data, please contact us so we can delete it.

International Transfers

We primarily store and process personal data within India. Where a service provider processes data outside India, we transfer it only to jurisdictions permitted under applicable law and ensure that appropriate contractual and security safeguards are in place to protect it.

Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology or legal obligations. When we make material changes, we will revise the "Last updated" date above and, where appropriate, notify you directly. We encourage you to review this Policy periodically.

Contact Us & Grievance Officer

If you have questions about this Policy or wish to exercise your rights, please reach out. In line with the DPDP Act, we have appointed a Grievance Officer to address your concerns.

This Privacy Policy is provided for general informational purposes and does not constitute legal advice. Please contact us if you require clarification on how it applies to your engagement.