Privacy Policy

Last updated: September 15, 2026

This policy explains how Aaroh Marketing and COmmunications Private Limited, operating as Aaroh Consulting (“Aaroh”, “we”, “us”) collects, uses and protects personal data through our website at www.aaroh.com and in the course of our advisory work.

We are based in India and work with clients in India and internationally. This policy is written to meet the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (India), and the UK and EU General Data Protection Regulation where it applies to people in those regions.

1. What we collect

Information you give us. Name, business email, phone number, company name, job title and anything else you enter in a contact form, a Discovery enquiry or a document you share with us during an engagement.

Business contact information we obtain from other sources. For our own business development, we collect publicly available and commercially licensed business contact details – name, job title, company, business email, business phone and company profile – from professional networking sites, company websites, public registries and licensed data providers.

Information collected automatically. IP address, browser and device type, pages viewed, time on page, referring source and similar data collected through cookies and analytics tools when you visit our website.

We do not knowingly collect personal data from children, and our services are not directed at them.

2. Why we use it

• To respond to your enquiry and arrange a conversation or Discovery
• To deliver, manage and improve the services we provide to clients
• To send you relevant business communications about our services
• To keep records, raise invoices and meet legal, tax and audit requirements
• To secure and improve our website

3. Our legal basis

Where the DPDP Act applies, we process personal data on the basis of your consent, or for the legitimate uses the Act permits — including where you have voluntarily given us your information for a stated purpose.

Where UK or EU GDPR applies, we rely on:

• Consent – for marketing emails and non-essential cookies
• Contract – to deliver services you or your organisation have engaged us for
• Legitimate interests – to contact business people at organisations that fit our services, and to secure our systems. You can object to this at any time using the contact details below, and we will stop.

4. Who we share it with

We do not sell personal data.

We share it only with:

• Service providers who support our operations – email and cloud hosting, CRM and sales tools, analytics and advertising platforms, and accounting systems. These providers process data on our instructions under contract.
• Professional advisers – lawyers, auditors and accountants, where needed.
• Authorities – where we are required to disclose by law.

5. Where it is stored

We operate from India and use service providers whose systems may be located outside India, including in the United States and the European Union. Where we transfer personal data out of the UK or EEA, we do so under appropriate safeguards such as Standard Contractual Clauses.

6. How long we keep it

Enquiry data: up to 3 years from your last contact with us, unless you ask us to delete it sooner. Client engagement records: for the duration of the engagement and up to 8 years afterwards, to meet contractual, tax and audit obligations. Website analytics: up to 26 months.

7. Your rights

You can ask us to:

• Access the personal data we hold about you
• Correct, complete or update it
• Erase it, where we have no continuing legal or contractual reason to hold it
• Stop sending you marketing communications
• Nominate another person to exercise your rights on your behalf, in the event of your death or incapacity (DPDP Act)

If UK or EU GDPR applies to you, you also have rights to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority — the Information Commissioner’s Office in the UK, or your national authority in the EU.

To exercise any of these, email reachus@aaroh.com. We respond within 30 days.

8. Security

We use access controls, encrypted transmission, reputable cloud providers and confidentiality obligations in our contracts to protect personal data. No system is entirely secure, but we take reasonable steps to prevent unauthorised access, loss or misuse, and we will notify you and the relevant authority of a personal data breach where the law requires it.

9. Cookies

Our website uses essential cookies to function, and analytics and advertising cookies to understand how the site is used and to measure our campaigns. You can accept or decline non-essential cookies through the banner on our site, and you can clear or block cookies in your browser settings at any time.

10. Changes

We may update this policy. The current version is always on this page, with the date it was last updated at the top.

11. Contact and grievances

Grievance Officer: Shelly Simon Email: reachus@aaroh.com Phone: +91 9871917197 Address: 1522, Astralis, Sector 94, Noida, Uttar Pradesh, India

If you are not satisfied with our response, you may complain to the Data Protection Board of India, or to your local supervisory authority if you are in the UK or EU.