1. About this Notice

Dhruva Advisors India Private Limited (“Dhruva”, “we”, “us”, or “our”) is a tax and regulatory advisory firm operating in India and certain international markets. Dhruva is affiliated with Ryan, LLC (“Ryan”) and may coordinate with Ryan and its affiliates as described in this Notice; Dhruva remains independently operated in its day-to-day activities. Dhruva is committed to processing personal data responsibly and transparently, in accordance with applicable data protection law in India, including the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and applicable rules and, to the extent applicable, the Information Technology Act, 2000 and the rules thereunder.
We value the trust you place in us. This Notice explains what personal data we collect, why we collect it, how we use it, and the choices available to you.

This Privacy Notice (“Notice”) describes how Dhruva collects, uses, discloses, and otherwise processes personal data in connection with its website located at www.dhruvaadvisors.com (the “Website”), its marketing and business-development activities, and its professional services, in each case in relation to external individuals.

This Notice is provided for transparency and to inform you about how we handle your personal data.

This Notice is available in English and, at your option, in any language specified in the Eighth Schedule to the Constitution of India. To request this Notice in another such language, please write to the Grievance Officer using the details in Clause 16.

2. Scope of this Notice / Who this Notice applies to

This Notice applies to external individuals whose personal data Dhruva processes, including:

• Any visitor to our Website;
• Individuals who contact us through our Website, by email, or by telephone;
• Contact persons for our clients and prospective clients;
• Contact persons for our vendors, suppliers, and service providers;
• Event and webinar participants, newsletter subscribers, and other external business contacts; and
• Any other individual whose personal data is processed by Dhruva in the ordinary course of its professional activities.

This Notice does not apply to Dhruva’s employees, contractors, job applicants, or other internal personnel, whose personal data processing is addressed in a separate employee/workforce privacy policy.

3. Definitions

In this Notice, the following terms have the meanings given below. Where not separately defined, terms carry the meaning given to them under the DPDP Act and applicable rules and, where relevant, the Information Technology Act, 2000 and the Sensitive Personal Data or Information Rules (“SPDI Rules”), which continue to apply pending the commencement of Section 44(2) of the DPDP Act.

4. Personal Data We Collect

Depending on your interactions with us, Dhruva may collect or receive the following categories of personal data:

1. Personal identifiable information
   • Full name, designation, and professional title.
   • Postal and email address.
   • Telephone and mobile numbers.
   • Internet Protocol (IP) address and device identifiers.
   • Personal data relating to any individual provided to us by our clients and vendors in the course of professional engagements.
   • Information you provide when you contact us, subscribe to our publications, register for events or webinars, request information, or otherwise engage with us.
2. Professional and organisational information
   • Employment history, job title, and professional affiliations.
   • Educational qualifications and professional memberships.
   • Name and details of employer or corporate entity.
3. Sensitive or special-category data (collected only where necessary)
   • Financial and tax identification particulars provided in connection with an engagement or business relationship, such as bank account details, tax identifiers (including PAN and TAN), where required to deliver the engaged services or to comply with applicable tax, regulatory, and professional obligations.
     Dhruva does not collect payment card information, and does not operate an online payment facility through the Website. Dhruva does not collect health, biometric, or similar categories of data through the Website or in the ordinary course of its professional engagements.
4. Technical and usage data
   • Browser type, operating system, and device information.
   • Pages visited, time spent on the website, referral URLs, and clickstream data collected via cookies.
5. Information received from clients in the course of engagements
   In the course of professional engagements, Dhruva may receive personal data relating to third parties
   connected with our clients, vendors, or service providers. Such processing is governed by the relevant
   client, vendor, or service-provider agreement.

5. Sources of Personal Data

We may obtain personal data:

1. directly from you;
2. from our clients, prospective clients, vendors, and business partners;
3. from public sources;
4. from events, webinars, publications, referrals, professional networking activities, and other business interactions; and
5. from Website technologies such as cookies and analytics tools.

We may also supplement, verify, update, or enrich business contact information using publicly available sources, business information providers, referral sources, and other third-party sources. We may combine such information with information maintained in our customer relationship management (CRM), marketing, and client relationship management systems to improve data accuracy, maintain business relationships, and support our marketing and business-development activities.

6. Children’s data

Dhruva’s Website and services are directed to businesses and professionals and are not intended for children. Dhruva does not knowingly collect personal data of children; if we become aware that we have done so, we will delete it in accordance with applicable law.

7. Purposes of processing and legal grounds for processing

Dhruva is a Data Fiduciary under the DPDP Act, and a data controller (or equivalent) under other applicable data protection laws, including those of the UAE and Singapore, in respect of personal data for which it determines the purpose and means of processing. We process personal data on the following basis:

• Consent: where you have given consent through a clear affirmative action for one or more specified purposes, following a notice describing the personal data sought and the purpose of processing. You may withdraw your consent at any time as described in Clause 9.

Certain legitimate uses under Section 7 of the DPDP Act. Where applicable, we may process personal data without consent only in the circumstances permitted by Section 7, including where:

1. you have voluntarily provided your personal data to us for a specified purpose and have not indicated that you object to its use for that purpose (for example, where you send us a business enquiry or share your card at an event);
2. processing is necessary to comply with a legal obligation, judgment, decree, or order, in India or in relation to a claim arising outside India;
3. processing is necessary to respond to a medical emergency or a threat to life or health; or
4. processing is necessary to safeguard Dhruva from loss or liability, including through the prevention and detection of fraud and the protection of Dhruva’s confidential information, trade secrets, and intellectual property.

Where the data protection law of another jurisdiction applies to our processing, we rely on the lawful bases available under that law, which may include your consent, the necessity of processing to enter into or perform a contract with you, compliance with a legal obligation, protection of vital interests, or our legitimate interests (or those of a third party), in each case as permitted by that law.

Subject to grounds set out above, Dhruva may process your personal data for the following purposes: (a) operating and securing the website; (b) responding to inquiries; (c) providing and managing professional services; (d) managing client, vendor, and business relationships; (e) maintaining customer relationship management (“CRM”) records; (f) sending newsletters, tax and regulatory updates, thought leadership, publications, event invitations and other communications relating to our services where permitted by applicable law; (g) developing and improving our services; (h) fraud prevention, security, and dispute resolution; (i) complying with legal, regulatory, tax, accounting, and professional obligations and defending Dhruva’s legal rights; (j) analyzing interactions with our website, marketing communications, and digital content, including associating website activity with CRM, marketing, or business-contact records where permitted by applicable law, in order to improve marketing effectiveness, client relationship management, business-development activities, and service delivery, and (k) coordinating with Ryan, LLC and its affiliates for client relationship management, coordination of professional services, referrals or related service opportunities, events or insights, administrative support, business operations, and compliance, in each case subject to applicable law and, where required, your consent or your right to opt out.

Dhruva does not use automated decision-making or profiling to make decisions about you. We may analyse engagement with our website and communications to understand general areas of interest and improve the relevance of our communications..

8. Purpose Limitation

Personal data will be used only for the purposes for which it was collected or as otherwise permitted under applicable law. Where we intend to process your personal information for a new purpose, Dhruva will ensure that such processing is permitted under applicable law. Where required, we will provide you with information about the new purpose and obtain your consent before carrying out such processing.

9. Consent and Marketing

1. Grant of consent
   Where we rely on consent to process your personal data, we will request your consent for specified purposes in accordance with applicable law, and we will obtain that consent through a clear affirmative action.
2. Option not to provide and consequences:
   If you choose not to provide certain personal data (or provide only part of it), Dhruva may be unable to provide all or part of the relevant services, and may decline to do so. To the extent permitted by applicable law, Dhruva will not be responsible for any loss or consequence arising from such non‑provision or the resulting inability to provide the relevant services.
3. Right to withdraw consent:
   You may withdraw your consent for any specified purpose at any time by writing to us using the contact details set out in Clause 16 (“How to Contact Us / Grievance Contact”) of this Notice.Withdrawal of consent is effective prospectively and does not affect the lawfulness of processing carried out before withdrawal. Upon receiving a valid withdrawal request, Dhruva will, within a reasonable time, cease processing your personal data for the relevant purpose, except where continued processing or retention is required or permitted under applicable law.
4. Marketing and Ryan affiliate coordination:
   Where permitted by applicable law, and where required with your consent, we may share business contact information and marketing preferences with Ryan, LLC and its affiliates so that Dhruva and Ryan affiliates may coordinate services, referrals, events, insights, and other business communications that may be relevant to you or your organisation.

10. Data retention and erasure

We retain personal data only for as long as reasonably necessary for the purposes described in this Notice, including to manage business relationships, provide services, comply with legal and professional obligations, resolve disputes, enforce agreements, and maintain records, after which it is deleted or anonymised.

Where required by applicable law, we will erase personal data when the purpose for which it was collected is no longer being served or when you withdraw your consent, as applicable, unless retention is necessary to comply with applicable law.

We may retain certain personal data for longer periods where necessary to comply with legal or regulatory obligations, establish, exercise or defend legal claims, prevent fraud, or address security matters, where permitted by applicable law.

When personal data is no longer required, we will delete or otherwise dispose of it in accordance with our applicable data-retention and deletion procedures

11. How We Share Personal Data

Dhruva may share personal data with: (a) Ryan, LLC and Ryan affiliates; (b) Dhruva affiliates and related entities; (c) service providers, including hosting, CRM, marketing, analytics, IT, and professional support providers; (d) professional advisers; (e) regulators, courts, government authorities, and law enforcement where required; (f) parties to a corporate restructuring, acquisition, integration, or similar transaction; and (g) clients or counterparties where necessary for professional services.

12. International Transfers

Dhruva may, to the extent permitted by applicable law, transfer or share personal data with its service providers and affiliated entities, including Ryan, LLC and its affiliates, or other entities located outside India (including in jurisdictions such as the United States), in connection with the provision of its services and for client relationship management, coordination of professional services, administrative support, business operations, and the other purposes described in this Notice.

Any such cross-border transfer is made in accordance with applicable data protection law and, where required, subject to appropriate contractual, technical, organisational, and security safeguards. Dhruva does not make any adequacy or certification claim in respect of recipient jurisdictions.

Where we collect personal data from individuals located outside India, including in the UAE and Singapore, that personal data may be transferred to and processed in India and in the other locations described above; in some cases, it may instead be processed locally in the country of collection. Any such transfer is subject to the safeguards required by applicable law, which may include your consent, contractual protections such as standard contractual clauses, or transfer on another lawful basis.

13. Data security

Dhruva maintains reasonable technical and organisational security measures appropriate to the personal data it processes. While Dhruva makes every reasonable effort to secure personal data, no information system can be guaranteed to be completely secure. Dhruva does not warrant absolute security, but undertakes to take reasonable steps to respond to and mitigate identified vulnerabilities in a timely manner.

In the event of a personal data breach affecting your personal data, Dhruva will notify the Data Protection Board of India andmanner, where applicable, any other competent supervisory authority (such as the UAE Data Office or the Personal Data Protection Commission of Singapore), together with each affected individual, in within the timelines prescribed under applicable law. Where appropriate, we will provide information about the breach, the steps we are taking to address or mitigate its impact, and any actions you can take to help protect yourself from potential harm.

14. Rights available to you

Subject to applicable law, including the DPDP Act, you may have rights in relation to your personal data, including the right to access and obtain information about processing, to correct or update inaccurate or incomplete data, to seek deletion/erasure where applicable, to withdraw consent where processing is based on consent, to nominate another individual to exercise your rights in the event of your death or incapacity, to grievance redressal, and to complain to the Data Protection Board of India or escalate to the relevant authority. Where you are located in a jurisdiction whose data protection law applies to our processing, additional or differently framed rights may apply to the extent required by that law. For example, if you are in the UAE, you may have rights of access, rectification, erasure, restriction of processing, data portability, and to object to processing (including for direct marketing), and you may lodge a complaint with the UAE Data Office; if you are in Singapore, you may have rights to access and correct your personal data and to withdraw consent, and you may lodge a complaint with the Personal Data Protection Commission of Singapore.

15. How to exercise your rights

To exercise any of the rights set out above, please write to us using the contact details below, providing sufficient particulars to enable us to identify your personal data. Dhruva may request verification of your identity before acting on any such request. We will respond within the timeframe required by applicable law or, where no specific timeframe is prescribed, within a reasonable period.

Depending on the nature of your request and the applicable legal framework, there may be circumstances in which Dhruva is unable to fully comply with your request. In such cases, the fact of rejection and the reasons for it will be communicated to you.

Dhruva is not required to comply with a request to delete or erase personal data where the processing or retention of that data is necessary: (a) to comply with a legal, regulatory, or judicial obligation; or (b) for the establishment, exercise, or defence of legal claims, or on any other lawful ground for retention recognised under applicable law.

16. How to Contact Us / Grievance Contact

Dhruva maintains a grievance redressal mechanism in accordance with applicable data protection law. Dhruva has designated a Grievance Officer (the individual designated by Dhruva to receive and address grievances, queries, complaints, and requests relating to personal data and this Notice) / Privacy Contact, whose details are set out below, as the point of contact for queries, complaints, and requests relating to personal data or this Notice.

Grievance Officer
Name: Arunima Jha
Designation: Director Legal
Email: arunima.jha@dhruvaadvisors.com
Telephone: +91 22 6108 1000/1900
Postal Address: 1101, One World Center, 11th Floor, Tower 2B,
Senapati Bapat Marg, Elphinstone Road (West), Mumbai – 400013, Maharashtra, India
Working Hours: Monday to Friday, 09:00 – 17:00 IST

The Grievance Officer / Privacy Contact will seek to address such grievances expeditiously and, in any event, within the timeframe required by applicable law.

17. Third-Party websites and links

The Website may contain links to third-party websites, including websites maintained by Dhruva’s affiliate firms including Dhruva affiliates, Ryan affiliates, event platforms and other third-party websites, which are not governed by this Notice. Dhruva is not responsible for the content, security practices, or privacy practices of such third-party websites. You are encouraged to review the applicable privacy notices before providing personal data on any third-party website.

18. Cookies, log files, and similar technologies

Dhruva’s website uses standard web technologies, including cookies and server log files, to collect technical and usage information.

• Log files: When you visit the website, our servers automatically record certain information in log files. This may include your internet protocol (IP) address, browser type, Internet Service Provider (ISP), date and time of access, referring/exit pages, and general interaction data such as the number and pattern of clicks. These logs are used for purposes such as analysing trends, administering and securing the website, understanding how users navigate the Website, and compiling aggregate statistics and demographic information.
• Cookies and similar technologies: Cookies are small data files stored on your browser or device. Dhruva uses cookies, analytics tools, identifiers, and similar technologies to understand how visitors interact with our website, improve user experience, measure engagement with our digital content and publications, and support our business development activities . Where permitted by applicable law, we may associate interactions with our website and digital communications with existing client or business-contact records to better understand engagement and improve our services.. Where required by law, Dhruva will seek your consent before placing or accessing non-essential cookies (such as analytics or advertising cookies). You may manage or disable cookies through your browser settings; however, this may impact the availability or functionality of certain features of the website.

Where log data, cookies, or similar identifiers constitute personal data under applicable law, Dhruva processes such information in accordance with this Notice and applicable law, including, where required, on the basis of your consent for analytics and other non-essential purposes.

Where consent is required, Dhruva will obtain it through a cookie banner or similar mechanism presented on the Website before non-essential cookies are placed. You may change your preferences at any time using that mechanism or through your browser settings.

19. Applicable Law

This Notice is provided in connection with Dhruva’s operations in India and its dealings with individuals in other markets, including the United Arab Emirates, and Singapore. It should be read consistently with applicable data protection law, including the Indian DPDP Act and, to the extent applicable to the processing of your personal data, the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and its Executive Regulation, and the Singapore Personal Data Protection Act 2012. Where more than one such law applies, we will comply with each to the extent applicable. Nothing in this Notice limits any rights you may have under applicable data protection law.

20. Changes to This Notice

Dhruva may amend or update this Notice from time to time to reflect changes in data practices, applicable law, or regulatory requirements. We encourage you to review this Notice periodically to stay informed about how we protect your personal data. The date of the latest revision is indicated at the top of this Notice.