Data Protection Notice & Grievance Policy

1. Statutory Context & Purpose

This Data Protection Notice and Grievance Policy is published in strict compliance with the Digital Personal Data Protection Act (DPDPA), 2023, the Information Technology Act, 2000, and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

FinLex, operating through Ampli5x LLP, is committed to treating your personal and financial information with professional diligence, legal privilege standards, and comprehensive cybersecurity controls.

2. Data Fiduciary Designation

For the purposes of Indian data protection jurisprudence, Ampli5x LLP functions as the Data Fiduciary responsible for determining the purpose and means of processing personal data collected through www.finlexworld.com and our associated partner desks.

3. Core Data Processing Principles

In handling your digital personal data, FinLex adheres strictly to five statutory tenets:

• Lawfulness & Transparency: Data is collected only with informed consent obtained through explicit opt-in checkboxes on our forms.
• Purpose Limitation: Data provided for a specific inquiry (e.g. Spanish Golden Visa eligibility or UK study permit) is utilized exclusively for that stated advisory consultation.
• Data Minimization: We do not solicit unnecessary demographic, religious, or sensitive personal indicators at the preliminary enquiry stage.
• Integrity & Confidentiality: Data is protected against unlawful destruction, alteration, or unauthorized transmission.
• Storage Limitation: Personal data is purged once the operational or regulatory necessity expires.

4. Technical & Operational Security Measures

FinLex implements strict enterprise security protocols across all digital assets:

• SSL / TLS 1.3 Transport Encryption: All data transmissions between your browser and our servers are encrypted using modern cryptographic protocols.
• Role-Based Access Controls (RBAC): Access to client enquiry data is strictly restricted to partners Ramalingam L., Kavita Bhatia, and direct case caseworkers.
• Isolated Client Portals: When active casework begins, documents are exchanged via enterprise encrypted cloud drives with multi-factor authentication (MFA), rather than unencrypted email or public messaging apps.

5. Prevention of Unencrypted Identity Transmission

This safeguard is enforced to protect clients against interception over unencrypted public channels. A dedicated, end-to-end encrypted channel is created for each client upon formal onboarding.

6. Statutory Grievance Redressal Mechanism

In accordance with Section 13 of the Digital Personal Data Protection Act, 2023, FinLex has established a dedicated Grievance Redressal Desk to receive, investigate, and resolve complaints regarding data processing, consent withdrawal, or alleged privacy violations.

Grievance Resolution Timelines:

1. Acknowledgment: Every formal grievance filed via email or written letter will be acknowledged within 48 business hours with a unique tracking reference.
2. Investigation: The Grievance Officer will examine server access logs, consent records, and communication histories.
3. Determination: A reasoned written resolution or corrective action report will be issued to the complainant within 30 calendar days.

7. Right to Appeal (Data Protection Board of India)

If you are not satisfied with the resolution provided by our Grievance Redressal Officer, or if you do not receive a response within 30 days of filing your grievance, you hold the statutory right under the DPDPA 2023 to lodge a formal complaint with the Data Protection Board of India.