Prospect Privacy Notice

1. Purpose

Section 5(1) of the Digital Personal Data Protection Act, 2023 requires that every request for consent be accompanied or preceded by a notice. Where we ask a person outside our own team for their personal data and rely on consent, this is that notice.

It exists separately from IQWORKS-PIMS-NOTICE-01-Internal-Privacy-Notice, which covers our own team and our directors, and relies on the legitimate uses at section 7 rather than on consent. Candidates are covered by IQWORKS-PIMS-NOTICE-04-Candidate-Privacy-Notice. Rule 3(a) of the Digital Personal Data Protection Rules, 2025 requires a notice to be understandable on its own, so the two are not merged.

2. Status of this notice

This notice is part of the version 2.0 set approved on 2026-10-11. It states what we tell a prospect.

Prospect data is captured through the routes at section 4 and held in the systems recorded in IQWORKS-PIMS-REGISTER-01-Sub-processor-Register. IQWORKS-PIMS-POLICY-01 clause 2.iii names prospect data as data we control, so this notice is written and held.

3. Who we are

IQWorks Technologies Private Limited.

For the personal data described here we are the Data Fiduciary. We are the sole Data Fiduciary for it. No other organisation determines why or how it is processed.

4. What personal data we ask for

Name, email address, company name and the message you write to us, through the contact and demo request form; email address alone through the newsletter sign-up; email address alone through the early-access list; and, through a gated report or guide download, your email address and, if you choose, your company name.

We do not ask a prospect for personal data beyond what the purpose at section 5 needs, and we do not ask for special category data.

5. What we use it for

To respond to your demo or contact request and arrange the conversation you asked for; to provide a report or guide you requested; if you signed up, to send you the newsletter and product updates; and to send early-access updates if you joined the early-access list.

We do not use prospect personal data for any purpose beyond the one stated when it was collected. A new purpose requires fresh consent under section 6.

6. Our ground for processing

Every purpose in this notice rests on your consent under section 6 of the Act: responding to an enquiry or demo request, providing a report or guide you requested, sending the newsletter and product updates, and sending early-access updates if you joined the early-access list. You give consent by ticking the checkbox on the form for that purpose, which is never ticked in advance. Consent is asked for separately for each purpose and from any other term, is limited to that purpose, and is recorded on IQWORKS-PIMS-FORM-07.1-Consent-Record with what was consented to, when, by what means, and against which version of this notice.

Where you decline one consent, we do not process your personal data for that purpose, and declining does not affect any other purpose.

6A. Recipients, retention and location

Your details are held with our customer relationship and email service providers, in India and in the European Union. Each transfer to the European Union is made under section 16 of the Digital Personal Data Protection Act, 2023. We keep your details for three years from the last time you engaged with us, and the record of your consent for three years after it ends, after which both are erased.

7. Client data is not covered here

Personal data we process inside our products on behalf of a client is not covered by this notice. For that data the client is the Data Fiduciary and we are the Data Processor, and the client's own notice governs. IQWORKS-PIMS-POLICY-02-PII-Processing sets out that position.

8. Rights, and how to use them

Withdrawing consent does not make our earlier processing unlawful. It stops further processing, and we cause anyone acting for us to stop as well, under section 6(6).

IQWORKS-PIMS-PROCEDURE-04-Data-Principal-Rights and IQWORKS-PIMS-PROCEDURE-07-Consent-and-Objection set out how we handle each of these.

9. Complaining to the Data Protection Board

Section 13(3) of the Act requires a Data Principal to exhaust our own grievance route before approaching the Data Protection Board of India. When that route has been exhausted, a complaint may be made to the Board.

Complaints to the Board are made through the channel the Board publishes; the Information Security Officer checks for it at each annual notice review.

10. Contact

The Information Security Officer (also acting as Privacy Officer) is the point of contact for anything in this notice, and is the role IQWORKS-ISMS-REGISTER-06-Roles-Assignment records as receiving and deciding rights requests and grievances for Data Principals. The role is held by Gurtegh Singh Mangat and is reached at infosec.privacy@iqworks.ai.

The published route for a request or grievance under this notice is infosec.privacy@iqworks.ai.

11. Publication

This notice, the rights-request route and the grievance period are published on iqworks.ai, and this notice and the consent line are published on every capture surface (objective O-7 in IQWORKS-ISMS-REGISTER-08-Information-Security-Objectives). The consent line links to the Privacy Policy, which gives the withdrawal route at section 8.

12. Language

This notice is issued in English. A Data Principal may ask for it in any language of the Eighth Schedule to the Constitution, as section 5(3) allows, and it is provided within 30 days of the request.

13. References

• IQWORKS-PIMS-POLICY-01-Privacy-Management
• IQWORKS-PIMS-POLICY-04-Data-Principal-Rights
• IQWORKS-PIMS-POLICY-07-Consent-and-Objection
• IQWORKS-PIMS-PROCEDURE-04-Data-Principal-Rights
• IQWORKS-PIMS-PROCEDURE-07-Consent-and-Objection
• IQWORKS-PIMS-NOTICE-01-Internal-Privacy-Notice
• IQWORKS-PIMS-FORM-07.1-Consent-Record
• IQWORKS-ISMS-REGISTER-06-Roles-Assignment

Change history