/01 Data fiduciary
Mr.Ooi Solutions, GSTIN 37ACEPU0301J1ZR, Hyderabad, Telangana, India. ("we") is the data fiduciary for personal data collected in India through mrooi.com, our forms, ads, calls and client work. This notice adds to the Global Privacy Policy.
You can read this notice in English, हिन्दी (Hindi) or తెలుగు (Telugu); ask privacy@mrooi.com for a copy in any other language in the Eighth Schedule to the Constitution.
/02 Itemised description of personal data and purposes
| Personal data | Purpose | Kept for |
|---|---|---|
| Name, work email, phone or WhatsApp number | To reply to your audit request or enquiry and arrange a call | 24 months after last contact |
| Business name, website, city, search or project details | To prepare your audit or quote | 24 months after last contact |
| Consent record (time, page, notice version) | To prove and manage your consent | Life of the consent plus 3 years |
| Website usage and cookie identifiers | Analytics and, with your consent, advertising measurement and retargeting | Up to 14 months |
| Billing contact and invoice details (clients) | Invoicing, GST and TDS compliance | As required by tax law |
We collect only what is needed for these purposes.
/03 Your consent
Where we rely on consent, it is free, specific, informed and unambiguous, given by ticking the consent box or choosing in Cookie Settings. You can withdraw consent as easily as you gave it: untick in Cookie Settings, use the unsubscribe link, or use the Privacy Request Form. Withdrawal does not affect processing already done.
Some processing does not need consent where the law allows it as a legitimate use, for example when you voluntarily give your details to receive an audit you asked for, or to meet tax obligations.
/04 Your rights
Under the DPDP Act you may: - get a summary of your personal data and the processing activities, and of who it has been shared with; - correct, complete, update or erase your personal data; - nominate another person to exercise your rights if you die or become unable to; - raise a grievance with us, and if not resolved, complain to the Data Protection Board of India.
Make a request through the Privacy Request Form or the Grievance Officer.
/05 Your duties
The Act asks you not to file false or frivolous complaints, not to impersonate anyone, and to give accurate information when you ask us to correct your data.
/06 Children
Our services are for businesses. We do not knowingly process personal data of anyone under 18, and we do not track or target ads at children.
/07 How the DPDP Rules 2025 shape our practice
- Standalone notice. This notice is separate from our terms, written in plain language and itemised, with links to withdraw consent, use your rights and complain (Rule 3).
- Consent managers. You may give, manage and withdraw consent through a consent manager registered with the Data Protection Board once registration opens (Rule 4).
- Security safeguards. Encryption or masking where appropriate, access control, logging and monitoring, backups, and contracts with our processors requiring the same (Rule 6). Logs of access to personal data are kept for at least one year.
- Erasure. Where the Rules set a period of inactivity after which data must be erased, we tell you at least 48 hours before erasure so you can keep your account active (Rule 8).
- Grievances. Answered within the period in our Grievance Officer page, and never later than 90 days (Rule 14).
/08 Security and breaches
We use reasonable security safeguards (see the Security Overview). If a personal data breach affects you, we will tell you without delay, explaining what happened, the likely consequences and what we and you can do, and we will report it to the Data Protection Board as the Rules require (an initial report without delay and a detailed report within 72 hours). See Incident Response.
Related India pages: Grievance Officer · India Terms · Calls, SMS and WhatsApp · Refund and Cancellation
/09 Transfers outside India
Some of our service providers process data outside India (see Sub-processors). We transfer data only to countries not restricted by the Central Government under section 16 of the Act.
/10 Law and status
This notice is written for the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, notified in November 2025, most of whose duties take effect 18 months after notification. Until then, the Information Technology Act 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 also apply.