Privacy Policy

Last Updated: 10 September 2026
Effective Date: 10 September 2026

1. About This Privacy Policy

This Privacy Policy explains how Lapras Business Consultants Private Limited, having its office at C-803, Noida One, Sector 62, Noida – 201309, Uttar Pradesh, India (“Lapras,” “we,” “us,” or “our”), collects, uses, stores, shares and protects personal data when you visit or interact with our website at https://lapras.in (the “Website”).

For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Lapras acts as the Data Fiduciary in respect of personal data for which it determines the purpose and means of processing. The individual to whom such personal data relates is referred to as a Data Principal.

Our contact details are:

Lapras Business Consultants Private Limited
C-803, Noida One, Sector 62
Noida – 201309, Uttar Pradesh, India
Email: reachus@lapras.in
Phone: +91 96433 49020

This Policy applies primarily to personal data collected through the Website. Personal data collected after you formally engage us for professional services may also be governed by an engagement letter, contract, consent form or separate privacy notice.

2. Website Functions Covered by This Policy

The Website currently provides:

Information about Lapras and its professional services;
Articles, blogs and business insights;
A contact and service-enquiry form;
A newsletter subscription form;
Links for communicating with us through WhatsApp;
Links to our Facebook, LinkedIn and Instagram pages; and
CAPTCHA or anti-spam protection for online forms.

The Website does not currently provide user accounts, online payments, online purchases, public comments, appointment booking or document-upload facilities.

If these functions are added in the future, this Privacy Policy will be updated accordingly.

3. Personal Data We Collect

A. Contact and service-enquiry form

When you submit the contact form, we may collect:

Full name;
Email address;
Mobile number, where provided;
Company name, where provided;
Service selected by you;
Comments, questions or information entered in the message field; and
Technical information associated with the form submission, such as the page URL, referring page, date, time and security-validation data.

Your full name, email address, selected service and comments are required to submit the contact form. Mobile number and company name are optional unless otherwise indicated on the form.

Please do not include Aadhaar numbers, PAN, bank details, passwords, health information or other sensitive or confidential information in the general Website enquiry form unless specifically requested through an appropriate secure channel.

B. Newsletter subscription

When you subscribe to our newsletter, we collect your email address.

We use this information to send professional updates, articles, regulatory updates, service information and other communications for which you have subscribed.

C. Direct communications

If you contact us through email, telephone or WhatsApp, we may collect:

Your name;
Email address or telephone number;
Your WhatsApp profile information made available through WhatsApp;
Company or professional details;
The contents of your communication; and
Any documents or information voluntarily shared by you.

Communications through WhatsApp are also subject to WhatsApp’s own privacy terms and policies.

D. Technical and usage information

When you visit the Website, our Website infrastructure may automatically process limited technical information, including:

IP address;
Browser type and version;
Device type;
Operating system;
Date and time of access;
Pages visited;
Referring website or page;
Website interaction and diagnostic information;
Security and access logs; and
Cookie or similar technical identifiers, where used.

This information may be processed for delivering the Website, maintaining security, preventing misuse, diagnosing technical issues and understanding general Website performance.

4. Purposes for Which We Use Personal Data

We may process Website-related personal data for the following specified purposes:

Responding to your enquiry or request;
Contacting you about the service selected by you;
Understanding your business or professional requirements;
Arranging an introductory discussion or consultation;
Providing requested information about our services;
Maintaining records of enquiries and communications;
Following up on an enquiry initiated by you;
Sending newsletters and professional updates where you have subscribed;
Operating, maintaining and securing the Website;
Detecting spam, fraud, misuse or security threats;
Measuring and improving Website performance and user experience;
Complying with applicable legal and regulatory requirements; and
Establishing, exercising or defending legal rights and claims.

We will not use personal data collected through an enquiry form for an unrelated purpose unless we provide an appropriate notice and obtain consent where required.

5. Grounds for Processing

We process personal data only for lawful purposes in accordance with the DPDP Act.

A. Consent

We may rely on your consent when you:

Submit a Website form;
Subscribe to our newsletter;
Agree to receive marketing or promotional communications; or
Accept non-essential cookies, where applicable.

Where consent is requested, it will be sought through clear and affirmative action and will be limited to the personal data reasonably necessary for the specified purpose.

B. Certain legitimate uses

We may process personal data for certain legitimate uses permitted under the DPDP Act, including where you voluntarily provide your personal data for a specified purpose and have not indicated that you do not consent to its use for that purpose.

For example, if you submit your contact details and request information about company-formation services, we may use those details to respond to that enquiry.

We may also process personal data where necessary to comply with a judgment, order, legal obligation or another use expressly permitted under applicable law.

6. Contact-Form Consent

By selecting the consent box and submitting the contact form, where such a box is provided, you consent to Lapras processing the information entered by you for the following purposes:

Reviewing and responding to your enquiry;
Contacting you by email or telephone regarding the selected service; and
Maintaining an internal record of the enquiry and our response.

Submitting a service enquiry does not automatically subscribe you to marketing or newsletter communications. Separate consent should be obtained for promotional communications.

7. Newsletter and Marketing Communications

We will use your email address to send newsletters or promotional communications only where you have subscribed or otherwise provided valid consent.

You may unsubscribe at any time by:

Clicking the unsubscribe link included in the communication, where available; or
Emailing us at reachus@lapras.in.

After receiving an unsubscribe request, we will stop sending the relevant marketing communications within a reasonable period. We may retain limited suppression information to ensure that your preference continues to be respected.

You may still receive non-promotional communications relating to an enquiry or professional engagement.

8. Withdrawal of Consent

Where processing is based on consent, you may withdraw your consent at any time by emailing reachus@lapras.in.

Withdrawal of consent will be made reasonably as easy as giving consent.

Withdrawal will not affect the lawfulness of processing undertaken before your consent was withdrawn. After receiving a valid withdrawal request, we will stop the relevant processing within a reasonable period unless continued processing or retention is required or permitted by law.

If you withdraw consent required to respond to an active enquiry, we may be unable to continue processing that enquiry.

9. CAPTCHA and Anti-Spam Protection

The contact form uses CAPTCHA or similar anti-spam technology to distinguish genuine users from automated submissions and to protect the Website against spam, fraud and abuse.

The CAPTCHA provider may process limited technical information such as:

IP address;
Browser and device information;
Date and time of interaction;
Mouse, keyboard or Website-interaction information; and
Information required to assess whether a submission is automated.

This processing is also subject to the privacy terms of the relevant CAPTCHA provider.

We recommend that the Website identify and link to the privacy policy of the specific CAPTCHA provider currently configured on the contact form.

10. Cookies and Similar Technologies

The Website may use cookies and similar technologies necessary to:

Display and operate Website pages;
Process and secure Website forms;
Maintain Website security;
Prevent spam and automated misuse;
Remember technical preferences;
Improve Website speed and performance; and
Diagnose errors.

At the time of this Policy, the Website does not state that it uses advertising cookies or behavioural advertising technologies.

If analytics, advertising or other non-essential cookies are introduced, Lapras will:

Update this Privacy Policy and its Cookie Policy;
Provide information about the relevant cookies and providers; and
Obtain consent before placing non-essential cookies where required by law.

You may manage or delete cookies through your browser settings. Blocking essential cookies may affect Website functionality.

11. WhatsApp and Social-Media Links

The Website contains links to:

WhatsApp;
Facebook;
LinkedIn; and
Instagram.

When you click one of these links, you leave the Lapras Website and interact with the relevant third-party platform. That platform may collect information about your visit, device, account or interaction in accordance with its own privacy policy.

Lapras does not control the cookies, tracking technologies or data-processing practices of these third-party platforms.

Information sent to us through WhatsApp or a social-media platform may be accessible to and processed by the relevant platform. You should avoid sending highly confidential documents or credentials through these channels unless an appropriate secure method has been agreed.

12. How We Share Personal Data

We do not sell or rent personal data collected through the Website.

We may share personal data, where reasonably necessary, with:

Authorized directors, employees and team members responsible for responding to enquiries;
Website hosting and maintenance providers;
Email and communication-service providers;
Form-management and newsletter-service providers;
CAPTCHA, spam-prevention and cybersecurity providers;
Cloud-storage and IT-support providers;
Professional advisers where necessary;
Government, regulatory, judicial or law-enforcement authorities where required by law; and
Other persons where disclosure is necessary to establish, exercise or defend legal claims.

A Data Processor processing personal data on our behalf will be engaged under a valid contract and required to follow appropriate confidentiality, security and data-processing obligations.

13. International Processing

The Website refers to Lapras’s business presence and services across multiple jurisdictions. Some Website, email, cloud, communication, social-media or anti-spam service providers may process information outside India.

Any transfer or processing of personal data outside India will be subject to:

Restrictions or requirements notified by the Central Government;
Other applicable Indian laws imposing a higher standard of protection;
Appropriate contractual and security safeguards; and
The requirements of the relevant service engagement, where applicable.

14. Retention and Erasure

We retain personal data only for as long as reasonably necessary for the specified purpose or as required under applicable law.

Generally:

Unsuccessful or inactive Website enquiries may be retained for up to two years after the last communication;
Active client enquiries may be retained for the duration of the enquiry and any resulting professional engagement;
Newsletter subscription details may be retained until you unsubscribe or withdraw consent;
Unsubscribe or suppression records may be retained to respect your communication preference;
Website security and technical logs may be retained for a reasonable security and compliance period; and
Information required for legal claims, regulatory compliance or dispute resolution may be retained for a longer period.

If an enquiry results in a professional engagement, relevant information may be transferred to the client file and retained for the period required under tax, corporate, accounting, professional or other applicable laws.

When consent is withdrawn or the specified purpose is no longer being served, we will erase the relevant personal data and require applicable Data Processors to erase it, unless retention remains necessary under law.

Anonymous or aggregated information that cannot identify an individual may be retained for lawful purposes.

15. Security Safeguards

We take reasonable technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, misuse or destruction.

These measures may include:

Access controls and restricted permissions;
Secure Website hosting;
Website security and anti-spam controls;
Password and authentication measures;
Encryption where appropriate;
System monitoring and access logs;
Backup and recovery processes;
Confidentiality requirements for personnel and service providers; and
Incident-response procedures.

No Website or electronic transmission method is completely secure. Accordingly, we cannot guarantee absolute security, but we will apply safeguards that are reasonable and proportionate to the nature and risks of processing.

16. Personal Data Breach

If we become aware of a personal data breach, we will take reasonable steps to contain, investigate and remediate it.

Where required under the DPDP Act and applicable Rules, we will notify:

The affected Data Principals, without delay and in the prescribed manner; and
The Data Protection Board of India, in the prescribed form and within the applicable period.

A breach notification may describe the nature and likely consequences of the breach, the measures taken by us, steps the affected individual may take and contact details for further information.

17. Rights of Data Principals

Subject to the DPDP Act, applicable Rules and lawful limitations, you may have the following rights:

A. Right to access information

You may request:

A summary of the personal data being processed;
A summary of the processing activities undertaken;
Details of other Data Fiduciaries and Data Processors with whom the data has been shared, subject to lawful exceptions; and
Other information prescribed under applicable law.

B. Right to correction, completion and updating

You may request that we correct inaccurate or misleading personal data, complete incomplete personal data or update personal data that is no longer current.

C. Right to erasure

You may request erasure of personal data previously provided with consent, unless retention remains necessary for the specified purpose or compliance with law.

D. Right to withdraw consent

Where processing is based on consent, you may withdraw that consent.

E. Right to grievance redressal

You may raise a grievance relating to our processing of your personal data or the exercise of your rights.

F. Right to nominate

You may nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity, in the prescribed manner.

18. Exercising Your Rights

To exercise an applicable right, email reachus@lapras.in with:

Your full name;
The email address or mobile number used when contacting us;
The nature of your relationship or interaction with Lapras;
A clear description of your request; and
Any information reasonably required to verify your identity and locate the relevant personal data.

Please mention “Data Protection Request” in the subject line.

We may request additional information where reasonably necessary to verify your identity and prevent unauthorized disclosure or erasure.

19. Duties of Data Principals

When providing personal data or exercising rights under the DPDP Act, you must:

Comply with applicable law;
Not impersonate another person;
Not suppress material information while providing personal data for official documents or identifiers;
Not submit false or frivolous grievances or complaints; and
Provide verifiably authentic information when requesting correction or erasure.

You should also ensure that information submitted through the Website is accurate and up to date.

20. Children’s Personal Data

The Website and Lapras’s professional services are intended primarily for businesses and adults.

We do not knowingly collect personal data directly from an individual below 18 years of age through the Website. If a child’s personal data must be processed, we will obtain verifiable consent from the child’s parent or lawful guardian where required.

We do not knowingly undertake behavioural monitoring of children or direct targeted advertisements at children.

If you believe that a child has submitted personal data without appropriate authorization, contact us at reachus@lapras.in.

21. Third-Party Websites

The Website may contain links to external websites and services. Once you leave our Website, the collection and processing of your personal data will be governed by the third party’s privacy policy.

We are not responsible for the content, security or privacy practices of third-party websites or platforms.

22. Privacy and Grievance Contact

For questions, requests or grievances concerning this Privacy Policy or our processing of personal data, contact:

Privacy and Grievance Officer
Lapras Business Consultants Private Limited
C-803, Noida One, Sector 62
Noida – 201309, Uttar Pradesh, India
Email: reachus@lapras.in
Phone: +91 96433 49020

Please mention “Privacy Grievance” in the subject line.

We will respond within a reasonable period not exceeding 90 days or within such shorter period as may be required under applicable law.

A Data Principal must ordinarily exhaust our grievance-redressal process before making a complaint to the Data Protection Board of India.

23. Contact Us