Privacy Policy

This policy explains what information Comriq collects when you use our website or engage us for a service, why we collect it, and the choices you have. The data controller is Green Rajasthan Private Limited (trading as Comriq). Because we help clients incorporate and stay compliant, some of what you share with us is sensitive — identity and company documents used for know-your-customer (KYC) checks — so we treat it accordingly.

Information we collect

• Enquiry details — your name, email address, company and the message or requirement you send us.
• Onboarding and KYC documents — where you engage us, the identity documents, proof of address, company and ownership documents and financial records needed to deliver the service and to file with the relevant authority.
• Site data — limited technical and preference data set by cookies, described in our Cookie Policy.

How we use it

• To respond to your enquiry and prepare a quote.
• To deliver the service you engage us for, including preparing and submitting filings to the relevant government authority on your instruction.
• To meet our own record-keeping and legal obligations as a provider of professional services.
• To operate, secure and improve our website.

Who we share it with

We share information only where it is needed to do the work: with the government authorities and registries your service requires, and with service providers who process data on our behalf under contract (for example hosting, email and payment providers). We do not sell your information. We may disclose information where the law requires it.

Where it is stored, and who processes it

Named, because "reputable providers" tells you nothing you can check. The processors that hold your information on our behalf, under contract, are:

• Supabase — the database and the document vault. Your identity and constitutional documents live here, encrypted at rest and scoped to your organisation by row-level security.
• Vercel — hosting and delivery of this website, including server logs and cookieless usage analytics.
• Postmark — transactional email: order confirmations, document requests and ticket replies.
• Microsoft 365 — the mailbox behind support@comriq.com.

We will name a payment processor here before we take a payment, and not after.

How long we keep it

Two different clocks, because two different things are being kept.

• An enquiry that never became an engagement — deleted within 24 months of the last contact.
• Engagement records: what we filed for you, when, and the documents supporting it — kept for eight years from the end of the financial year the work relates to. That is not a number we chose: s.128 of the Companies Act 2013 requires books and the papers behind them to be preserved for eight financial years, and a filing agent that destroyed the evidence behind your filing sooner would leave you unable to answer a question from the authority.
• A document you ask us to delete — removed from the vault on request, unless it is part of an engagement record inside the eight-year window above, in which case we say so and tell you when it can go.

Security

We take reasonable technical and organisational measures to protect your information. No method of storage or transmission is completely secure, so we cannot guarantee absolute security, but we work to reduce the risk.

Your choices

You can ask us what information we hold about you, ask us to correct or delete it, or withdraw an enquiry, by emailing support@comriq.com from the address the request relates to. We acknowledge within one business day and answer in full within 30 days.

Where we cannot do what you ask — because the record is inside the eight-year retention window above — we will say so, say why, and tell you the date it can be deleted. We will not simply not reply.

Where the law applies, and where the data goes

We are a company incorporated in India, so the Digital Personal Data Protection Act 2023 governs how we handle your personal data. Where we act for a client established elsewhere, the law of that market may apply to that engagement as well.

The processors named above operate globally, and your information may therefore be processed on infrastructure outside India. We use them under contract and for the purposes set out on this page only.

What we will not do is claim a compliance certification we do not hold. Our formal data-protection documentation — the consent notices, the grievance officer appointment and the breach-reporting procedure the DPDP Act requires — is being prepared with counsel and is not complete. We would rather tell you that than display a badge.

Changes and contact

We may update this policy as our practices and legal review develop. Questions can be sent to support@comriq.com.