On this page
1. Who we are
This Privacy Policy applies to udyamregistration.webthropic.com, operated by Webthropic Consulting, a proprietorship based at 204 Business Point, Sector 18, Noida, Uttar Pradesh 201301, India. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we act as a "Data Fiduciary" for personal data you share with us.
2. Data we collect
| Data | When collected | Mandatory? |
|---|---|---|
| Full name | Form submission | Yes |
| Mobile number | Form submission | Yes |
| Email address | Form submission | Yes |
| Existing Udyam Registration Number | Form submission | Yes |
| Description of update needed | Form submission | Yes |
| Aadhaar number of proprietor / signatory | Verified verbally during CA call | Yes, for filing |
| PAN of enterprise or proprietor | Verified verbally during CA call | Yes, for filing |
| Aadhaar-linked OTP | Entered directly on government portal | Not stored |
| IP address, browser info | Automatic (server logs) | No |
| Payment card / UPI details | Collected by PayU, never by us | — |
3. Why we collect it
We collect the above data solely for the following purposes:
- Service delivery: to file your Udyam registration or update on the government portal on your behalf;
- Communication: to confirm details, share the completed certificate, and provide follow-up support;
- Payment processing: to accept fee payments through PayU;
- Fraud prevention: to prevent misuse of our systems (IP logs, unusual submission patterns);
- Legal compliance: to comply with our record-keeping obligations under Indian tax and consumer-protection law.
We will not use your data for any secondary purpose (e.g. marketing unrelated services, profiling, data resale) without your explicit prior consent.
4. How we use & share it
Sharing with third parties
We share limited data with only the following parties, strictly for the purpose you engaged us for:
- Government of India (Ministry of MSME): your Aadhaar, PAN, business details are submitted to udyamregistration.gov.in — the whole point of the service;
- PayU India Pvt. Ltd.: your name, email, mobile, and payment amount are shared with PayU for processing your payment. PayU is PCI-DSS compliant and has its own privacy policy;
- Our email delivery service: when we email you, your email address passes through our SMTP provider;
- Government or judicial authorities: if required by law, court order, or formal government request.
We do not sell, rent, trade, or share your data with advertisers, marketers, data brokers, or any party for commercial gain.
5. Storage & retention
Your data is stored on servers located in India, hosted with reputable providers. We retain data for the following periods:
- Application records (name, contact, Udyam number, update details): 7 years, to comply with tax and consumer-protection recordkeeping obligations;
- Payment records: 8 years, per Income Tax rules;
- Server logs (IP, browser): 90 days;
- Aadhaar number: not stored in written form after filing is completed; verified verbally and typed directly into the government portal.
You may request earlier deletion of your data — see Your Rights below.
6. Security measures
We use commercially reasonable security measures, including:
- TLS 1.2+ encryption for all data in transit (HTTPS website, encrypted email);
- Prepared SQL statements to prevent injection attacks;
- Access controls on our database (only authorised staff can view records);
- Regular security patches on our servers;
- No storage of Aadhaar OTPs, card CVVs, or PayU tokens on our systems.
No system is 100% secure. In the unlikely event of a data breach affecting your personal data, we will notify you and the Data Protection Board of India within the timelines required by the DPDP Act.
7. Your rights under the DPDP Act 2023
As a Data Principal, you have the right to:
- Access: request a copy of the personal data we hold about you;
- Correction: request correction of inaccurate or incomplete data;
- Erasure: request deletion of your data (subject to our legal retention obligations);
- Withdraw consent: withdraw consent for any processing that relies on your consent;
- Grievance: raise a grievance with our designated officer (see below);
- Nominate: nominate an individual to exercise these rights on your behalf in the event of death or incapacity.
To exercise any of these rights, email privacy@udyamregistration.webthropic.com. We will respond within 30 days as required by the DPDP Act.
8. Cookies & tracking
Our website uses minimal cookies:
- Essential cookies: to remember your session and form data between pages;
- Analytics cookies: we may use Google Analytics with IP anonymisation to understand how visitors use our site. This does not identify you personally;
- PayU cookies: set by PayU during the payment flow — governed by PayU's own privacy policy.
We do not use advertising or retargeting cookies. You can block cookies via your browser settings, but some features (like the form) may not work correctly.
9. Children's data
Our service is for enterprise proprietors and authorised signatories, who must be adults. We do not knowingly collect data from anyone under 18. If we learn we have collected data from a minor, we will delete it. If you are a parent and believe your child has provided data, please contact us.
10. Policy updates
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or the law. The "Last updated" date at the top will indicate the most recent revision. For material changes, we will attempt to notify registered users by email.
11. Contact & grievance officer
For any privacy questions, data-access requests, or complaints:
- Designated Grievance Officer: Ms. Priya Kulkarni (Compliance Head)
- Email: privacy@udyamregistration.webthropic.com
- Phone: +91 98765 43210 (Mon-Sat, 10 AM – 7 PM IST)
- Postal: Grievance Officer, Webthropic Consulting, 204 Business Point, Sector 18, Noida, Uttar Pradesh 201301, India
If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India per the DPDP Act 2023.