GreenTIP Privacy Policy

Grass Roots Research and Creation India (P) Ltd (“GRC”)

Platform: www.grcgreentip.com | Effective Date: October 2026

This Privacy Policy (“Policy”) explains how Grass Roots Research and Creation India (P) Ltd (“GRC”, “we”, “us” or “our”) collects, uses, shares, stores, protects and erases personal data of individuals who visit, register on or submit queries through GreenTIP, available at www.grcgreentip.com (the “Platform”).

This Policy applies to GreenTIP only. It does not apply to GRC's corporate website (www.grc-india.com), Green ERP, GRC Green E-Com India Pvt Ltd, GRC's offline consultancy services, or any other GRC product or service. Each of those has its own privacy policy.

This Policy is published in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) (together, the “DPDP Law”), and the Information Technology Act, 2000 and the rules made under it, to the extent applicable. Reading this Policy is not the same as giving consent. Where we rely on your consent, we ask for it separately, through a clear notice and an affirmative action, and you may withdraw it at any time (Section 9).

Contents

1. About GreenTIP and who we are

GRC is an environmental consulting organisation providing Environmental Impact Assessment and Environmental Management Plan (EIA/EMP) reports, environmental data generation, laboratory services, sustainability reporting and related consultancy.

GreenTIP is GRC's knowledge and query platform. Visitors can access environmental and EIA-related information, and registered users can submit queries on environment, EIA, environmental laboratory matters and related professional subjects, which are answered by GRC's experts.

GRC is the Data Fiduciary for personal data processed through GreenTIP. This means GRC decides why and how your personal data is processed and is responsible for protecting it under the DPDP Law.

2. Key terms

3. Personal data we collect

We collect only the personal data that is necessary for the purposes in Section 5.

Your password is stored only in hashed form and is never visible to anyone at GRC. Optional fields can be left blank without affecting your use of the Platform.

Note: Please keep queries technical. Do not include identity documents, financial details, health information, passwords, or personal data of other individuals in a query or attachment unless it is strictly necessary for the query and you are authorised to share it. Where an attachment contains such data, please mask or remove it before uploading.

4. Data we do not collect

• We do not collect Aadhaar numbers, PAN, bank account, payment card or UPI details through GreenTIP.
• We do not collect your precise location or access your device's contacts, camera, microphone, call logs or SMS.
• We do not use advertising networks, advertising identifiers or third-party tracking tools, and we do not build profiles of users for advertising.

If we need any additional personal data in future, we will update this Policy before the change takes effect and, where required, give a fresh notice and seek your consent.

5. Why we use personal data and our legal basis

We do not sell personal data and do not use it for any purpose incompatible with those above. If we need to use it for a new purpose, we will tell you first and, where required, obtain your consent.

6. How your queries are handled

• Your query and attachments are visible only to GRC personnel assigned to review and answer it, and to Platform administrators where needed for support or security.
• Your query is not published or shared with other users. If GRC wishes to add a question and answer to GreenTIP's public knowledge base, it will first remove your name, contact details, organisation and any other information that could identify you.
• GRC's responses are professional guidance based on the information you provide.

7. Who we share data with

Personal data is disclosed only where necessary for the purposes in Section 5, and only to:

• Authorised GRC personnel who need it to answer queries, provide support or maintain the Platform, bound by confidentiality obligations.
• Data Processors engaged by GRC for hosting, cloud storage, email and SMS delivery, security and maintenance. They process data only on GRC's instructions under written contracts that require them to protect it and not to use it for their own purposes. A current list is available from the Grievance Officer on request.
• Government, regulatory, law-enforcement or judicial authorities where disclosure is required by law, or permitted by law to protect the rights, property or safety of GRC, users or others.
• A successor entity in the event of a merger, amalgamation, demerger, acquisition or transfer of GreenTIP, which will be required to protect the data in line with this Policy and the DPDP Law.

8. Cookies and similar technologies

GreenTIP uses only strictly necessary cookies, such as session and security cookies needed for login, protection against forged requests and basic functionality. They are not used for tracking or advertising, and blocking them will prevent you from logging in. If GRC introduces analytics or other non-essential cookies, it will update this Policy and ask for your consent through a cookie banner before setting them.

9. Consent and its withdrawal

• Where we rely on consent, we will show you a clear notice that lists the personal data collected and the specific purpose, and ask you to agree through an affirmative action, such as an unticked checkbox. Consent for optional purposes, such as newsletters, is never bundled with registration.
• You may withdraw consent at any time, as easily as you gave it, through Account Settings, the unsubscribe link, or by writing to the Grievance Officer. We will stop the processing concerned within a reasonable time and cause our Data Processors to do the same, unless another legal basis applies.
• Withdrawal does not affect processing carried out before it. Withdrawing consent needed to operate your account means you will no longer be able to submit queries.
• Where Consent Managers registered with the Board become available, you may also give, manage, review and withdraw consent through such a Consent Manager.

10. Where your data is stored

GreenTIP data is stored on servers operated by our hosting providers located in India. Personal data may be processed outside India only as permitted under Section 16 of the DPDP Act, and never in a country or territory to which the Central Government has restricted transfer. The protections in this Policy apply wherever the data is processed.

11. How we protect your data

We maintain reasonable security safeguards appropriate to the nature of the data, in line with Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules, including:

• encryption of data in transit using HTTPS (TLS) and encryption of stored data and backups;
• passwords stored only in hashed form, and account-security controls for user and administrator access;
• role-based, need-to-know access for authorised personnel, with periodic review of access permissions;
• logging and monitoring of access to personal data so that unauthorised access can be detected, investigated and remedied;
• backups and recovery measures so that data remains available if confidentiality, integrity or availability is compromised;
• retention of logs and related personal data for at least one year to detect and investigate incidents; and
• contractual security and confidentiality obligations on our Data Processors and personnel.

No internet-based system is completely secure. Please keep your password confidential, log out on shared devices, and tell us immediately if you suspect unauthorised access to your account.

12. Personal data breaches

If a personal data breach occurs, GRC will act in accordance with Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules:

• Affected users will be informed without delay, in plain language, by email or through the Platform, of the nature and extent of the breach, when it occurred, its likely consequences, the measures taken and being taken, the steps you can take to protect yourself, and whom to contact.
• The Data Protection Board will be informed without delay, and a detailed report will be submitted within 72 hours of GRC becoming aware of the breach, or within any longer period the Board allows.

13. How long we keep your data

We keep personal data only as long as it is needed for the purpose for which it was collected, or as required by law, and then erase it.

Data may be retained longer only where a law requires it. When data is no longer needed, we erase it or anonymise it so that it no longer identifies you, and we instruct our Data Processors to do the same.

14. Your rights

Subject to the DPDP Law, you have the right to:

• Access information (Section 11): a summary of your personal data and the processing activities undertaken with it, and the identities of all other Data Fiduciaries and Data Processors with whom it has been shared, with a description of the data shared;
• Correction, completion, updating and erasure (Section 12): have inaccurate or misleading data corrected, incomplete data completed, data updated, and data erased when it is no longer necessary for its purpose, unless retention is required by law. Many details can be updated directly from My Profile;
• Withdraw consent (Section 6): as described in Section 9;
• Grievance redressal (Section 13): have your grievance addressed by our Grievance Officer; and
• Nomination (Section 14): nominate another individual to exercise your rights in the event of your death or incapacity.

How to make a request:

• Write to the Grievance Officer (Section 20) from your registered email address, stating your name, username and the right you wish to exercise.
• We may ask for reasonable information to verify your identity before acting, and will not ask for more than is needed.
• We will acknowledge your request within 7 days and aim to resolve it within 30 days. In every case we will respond within the period prescribed under the DPDP Law, which for grievances does not exceed 90 days.
• If we cannot fully act on a request, for example because the law requires certain data to be retained, we will explain why.

15. Deleting your account

You may delete your account from Account Settings or by writing to the Grievance Officer. On deletion we will erase your account data and, unless you ask us to keep them, your queries and attachments, except where a law requires us to retain specific records. Security logs are retained for the minimum period stated in Section 13.

16. Your duties as a user - User Conduct and Prohibited Activities

Under Section 15 of the DPDP Act, you must not impersonate another person, suppress material information, provide false particulars, or file a false or frivolous grievance or complaint, and you must provide only verifiably authentic information when seeking correction or erasure. You are responsible for the accuracy of the information you submit and for keeping your login credentials secure. Users shall use GreenTIP only for lawful, legitimate and bona fide purposes relating to environmental, EIA, laboratory and allied knowledge or queries. A User shall not use the Platform to upload, submit reproduce, extract, copy, scrape, download, transmit, disclose, manipulate or otherwise misuse any personal data, confidential information, intellectual property, proprietary information or other information belonging to GRC, another User or any third party without lawful authority or permission.

Users shall not attempt to gain unauthorised access to GreenTIP, its server, database, accounts or administrative systems; interfere with the operation or security of the Platform; introduce malicious code or software; circumvent security controls; impersonate another person or organisation; or use information obtained through GreenTIP for any unlawful, fraudulent, commercial or harmful purpose.

GRC reserves the right to suspend, restrict or terminate a User's account and/or access to GreenTIP where GRC reasonably believes that the User has violated this Policy, the Terms of Use, applicable law, or has attempted to compromise the security, confidentiality or integrity of the Platform or its data. GRC may preserve relevant records and cooperate with law-enforcement, regulatory or judicial authorities where required or permitted by law.

17. Children and persons with disabilities

Registration on GreenTIP is open only to individuals aged 18 years or above, and you will be asked to confirm this at registration. GreenTIP is not directed at children and we do not knowingly process personal data of anyone under 18. If we learn that a child has registered, we will delete the account and its data promptly. If GRC ever offers a service intended for children, it will first obtain verifiable consent of the parent or lawful guardian as required by Section 9 of the DPDP Act and Rule 10 of the DPDP Rules.

Where a user is a person with a disability who has a lawful guardian, the guardian may give consent and exercise rights on the user's behalf after reasonable verification of guardianship, in line with Rule 11 of the DPDP Rules.

18. Third-party links

GreenTIP may link to external websites, including government portals and regulatory resources. We are not responsible for the privacy practices of those websites, which are governed by their own policies.

19. Changes to this Policy and language

• We may update this Policy to reflect changes in GreenTIP, our practices or the law. The updated Policy will be posted on the Platform with a new “Last updated” date and version number.
• For material changes, we will notify registered users by email or through the Platform before the change takes effect, and seek fresh consent where the law requires it.
• Users who registered before this version took effect will be notified of it by email or through the Platform.
• This Policy is available in English. On request to the Grievance Officer, we will provide it in Hindi or any other language specified in the Eighth Schedule to the Constitution of India.

20. Grievance Officer and contact

For questions about this Policy, to exercise your rights, to withdraw consent, or to raise a grievance about the processing of your personal data on GreenTIP, please contact:

You should first raise your grievance with the Grievance Officer. If you are not satisfied with the response, or do not receive one within the prescribed period, you may file a complaint with the Data Protection Board of India in the manner prescribed under the DPDP Law.

21. Governing law

This Policy is governed by the laws of India. Subject to the powers of the Data Protection Board of India and the Appellate Tribunal under the DPDP Act, the courts at New Delhi shall have exclusive jurisdiction over any dispute arising out of this Policy. Where this Policy conflicts with a mandatory requirement of law, the law prevails.

© 2026 Grass Roots Research and Creation India (P) Ltd. All rights reserved. This Privacy Policy applies exclusively to GreenTIP. Other GRC platforms and services have their own privacy policies.