Privacy Policy & DPDP Compliance Notice

1. Regulatory Framework & Scope

Third Estate ("we," "our," or "us") operates as a Data Fiduciary under the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act). This notice explains how we collect, process, store, and protect digital personal data collected from individuals ("Data Principals") who interact with our survey instruments, voluntary contributions, public audit disclosures, and initiatives.

2. Lawful Grounds & Purpose Limitation

We collect digital personal data solely on the basis of your freely given, specific, informed, unconditional, and unambiguous consent, or for legitimate uses recognized under the DPDP Act. We adhere strictly to data minimisation principles and process data exclusively to:

• Facilitate voluntary community surveys and aggregate transparency analytics.
• Verify and maintain records of financial contributions and operational disbursements.
• Address user requests, support queries, and privacy grievances.

3. Information We Collect

• Survey Responses: Feedback, employment experiences, or academic disclosures submitted voluntarily through our forms.
• Transaction & Payment Identifiers: Gateway reference numbers, timestamps, and voluntary contribution amounts. We do not store credit/debit card numbers, CVVs, or net-banking login credentials.
• Communications & Correspondence: Name, email address, or query details provided when reaching out to our founding team.
• System Logs: Basic technical telemetry (such as IP addresses and device browser strings) retained temporarily solely for anti-abuse, fraud prevention, and server security.

4. Your Rights as a Data Principal

Under the DPDP Act, you possess explicit statutory rights regarding your personal information:

• Right to Access: Review a summary of your personal data processed by us and the processing activities undertaken.
• Right to Correction & Completion: Request the correction, updating, or completion of inaccurate or outdated personal details.
• Right to Erasure (Removal): Request the deletion of personal data when the purpose of collection is achieved or consent is withdrawn, subject to mandatory legal and financial retention requirements.
• Right to Withdraw Consent: Withdraw previously granted consent at any time without adverse consequences.
• Right to Nominate: Nominate an individual to exercise your data rights in the event of death or incapacity.

5. Exercising Data Removal or Anonymization Requests

To request the erasure of your personal details, withdraw consent, or request retrospective anonymization of your public records, write to us with the subject line "DPDP Rights Request":

6. Data Security & Cross-Border Restrictions

We implement industry-standard organizational and technical safeguards—including TLS encrypted channels and restricted access protocols—to protect personal data against unauthorized disclosure, alteration, or compromise. We store and process personal data in compliance with cross-border transfer directives issued by the Central Government of India under the DPDP Act.

7. Protection of Children’s Personal Data

Third Estate does not knowingly collect or process personal data of individuals under 18 years of age without verifiable parental or legal guardian consent, nor do we perform behavioral tracking or targeted profiling on minors.

8. Grievance Redressal & DPBI Escalation

In compliance with the DPDP Act's grievance mechanism requirements, our designated redressal contact can be reached directly:

If our team does not resolve your concern within the stipulated statutory period, you retain the right under the DPDP Act to submit an escalation to the Data Protection Board of India (DPBI).