1. Institutional Framework & Purpose

The Entrepreneurship Development Council of India (EDCI) is committed to protecting the privacy, confidentiality, and sovereign data rights of entrepreneurs, mentors, institutional partners, and general public visitors. This Privacy Policy outlines our transparent protocols for collecting, storing, processing, and safeguarding personal and enterprise information in strict compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the Information Technology Act, 2000.

2. Categories of Information Collected

EDCI collects data strictly necessary to deliver verified portal services:

• Account & Signatory Identity: Full Name, verified Email Address, 10-digit Indian Mobile Number, account credentials (cryptographically hashed), and administrative communication preferences.
• Enterprise & Compliance Records: Business / Trade Name, Legal Entity Type (Pvt Ltd, LLP, Partnership, Proprietorship, Section 8), Sector classification, Business Stage, and state/district of operation.
• Geographic Derivation Data: District and State inputs used exclusively by our backend deterministic mapping engine to assign your enterprise to India’s 6 Zones and 36 State Chapters.
• Billing & Transaction Audit Logs: WooCommerce Order IDs, transaction timestamps, payment method references, and membership validity dates (₹10,000/year). Note: EDCI never stores raw credit card numbers or UPI MPINs. All payment transactions are securely handled by PCI-DSS certified gateways (Razorpay).
• Technical & Security Metadata: Client IP addresses, browser user-agent strings, and session timestamps captured strictly for rate-limiting (5 requests/hr) and anti-spam verification.

3. Lawful Grounds for Processing

We process your data strictly under valid lawful grounds recognized under Section 4 of the DPDP Act 2023:

• Explicit Consent: Granted by you during account onboarding and business portfolio submission.
• Contractual Necessity: Required to fulfill our annual membership obligations, issue valid receipts, and manage your verified directory profile.
• Legal Compliance: Fulfilling statutory records retention under Indian tax, corporate, and cybersecurity laws.

4. Data Security Architecture & Server Perimeter

The EDCI portal operates an institutional-grade, multi-layered defensive perimeter:

• Transport Layer Security: Enforced HTTPS with 100% TLS 1.3 encryption and HTTP Strict Transport Security (HSTS).
• Server-Level Perimeter Hardening: Direct PHP execution in media uploads directories is blocked at the web server layer via root and upload .htaccess rules.
• Cache Isolation: Authenticated member sessions, checkout, and dashboard endpoints emit strict no-cache control headers (litespeed_control_set_nocache), preventing data leakage into public CDN or server caches.
• Atomic Webhook Concurrency Locks: Dedicated MariaDB locking table (wp_edci_webhook_locks) guarantees idempotency and eliminates race conditions during payment gateway callbacks.

5. Rights of Data Principals under DPDP Act 2023

As a registered entrepreneur or portal user, you possess fundamental statutory rights:

• Right of Access & Summary: You may request a complete summary of your personal data processed by EDCI.
• Right to Correction & Updating: You may update inaccurate or obsolete business information anytime via your Logged-in Dashboard.
• Right to Erasure & Account Closure: You may request account deactivation and data erasure, subject to mandatory statutory financial retention requirements.
• Right of Grievance Redressal: Direct access to the Council Grievance Officer with guaranteed resolution within 15 calendar days.

6. Data Retention Policy

Active member records are retained for the duration of membership plus 3 years of inactivity. Financial transaction logs and WooCommerce order histories are retained for 8 years in accordance with Section 128 of the Indian Companies Act and statutory GST compliance requirements. Unsuccessful registration drafts and temporary OTP transients are purged automatically within 10 minutes.

7. Data Protection Desk & Grievance Contact