Draft for legal review. Remove this note once your lawyer has approved the text.
Who we are
InspireGRC Solutions Private Limited ("InspireGRC", "we", CIN U62011TN2026PTC198582) runs this website and the InspireGRC platform. Our registered office is at Innov8 Featherlite, 8th Floor, 200 Ft MMRD Road, Pallavaram, Chennai 600044, Tamil Nadu, India. You can reach us at info@inspiregrc.com.
For personal data we collect for ourselves, such as enquiries through this website, we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
When our customers put personal data into the InspireGRC platform, such as names of their employees or suppliers, the customer is the Data Fiduciary and we act as their Data Processor, under our Data Processing Agreement. Questions about that data are best sent to the customer first.
What we collect
- Enquiries: your name, work email, company and message when you use "Talk to us" or the contact form.
- Free tools: your answers and email address if you ask us to send your DPDP readiness report.
- Newsletter: your email address if you subscribe to The Compliance Brief.
- Platform accounts: name, work email, role, and sign-in records such as time and IP address.
- Technical data: our hosting provider records IP addresses and browser details in server logs to keep the service secure.
- Visit counts: which pages are viewed, the website that referred you, your browser type and an approximate location. We use Microsoft Azure Application Insights, hosted in India, without cookies or browser storage. Your IP address is used only to estimate location and is not stored. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is counted.
We do not use advertising trackers, and we do not buy or sell personal data.
How we use it
- To reply to your enquiry and arrange a conversation.
- To send the report or newsletter you asked for.
- To provide, secure and support the platform for our customers.
- To meet our legal obligations, including tax, accounting and reporting incidents to CERT-In.
We process data on the basis of your consent, which you give when you submit a form, or for a legitimate use allowed under section 7 of the DPDP Act, such as meeting a legal obligation. We will not use your data for a purpose you have not been told about.
Who we share it with
We share personal data only with service providers that help us run InspireGRC, listed on our subprocessors page, and with authorities when the law requires it. We do not sell personal data.
Where it is stored
The platform and its database are hosted in Microsoft Azure's Central India region. Some providers process data outside India, for example our AI model provider and email provider, as listed on the subprocessors page. Any transfer outside India follows section 16 of the DPDP Act, and we will not transfer data to a country the Government of India restricts.
How long we keep it
- Enquiries and newsletter subscriptions: until you ask us to delete them, or two years after our last contact with you.
- Platform data: for the length of the customer's contract, then deleted as set out in our DPA.
- Records we must keep by law, such as invoices: for the period the law requires.
How we protect it
We use the measures described on our Security & trust page, including encryption, separation between customer companies and restricted administrator access.
Your rights
Under the DPDP Act you can ask us to:
- tell you what personal data we hold about you and who we have shared it with;
- correct, complete or update it;
- erase it, when we no longer need it;
- withdraw your consent at any time, as easily as you gave it;
- nominate someone to exercise these rights if you die or cannot act.
Email info@inspiregrc.com. We reply within 30 days. Every newsletter has an unsubscribe link.
Grievance officer
If you have a concern about how we handle your data, contact our Grievance Officer, Vijayasekar M V, Founder & CEO, at info@inspiregrc.com or by post at our registered office. We will acknowledge your complaint within 48 hours and aim to resolve it within 30 days.
If you are not satisfied, you may complain to the Data Protection Board of India.
Children
Our website and platform are for businesses. They are not directed at children, and we do not knowingly collect personal data of anyone under 18.
Changes to this policy
We will post any change on this page with a new date. If a change is significant, we will tell customers by email before it takes effect.