Privacy Policy.

2. Lawful Grounds & Purposes of Processing

In accordance with the DPDP Act 2023, data is processed under clear lawful grounds, including specific consent and legitimate uses:

• Client Engagement: Evaluating briefs, preparing commercial proposals, executing creative production sprints, and coordinating milestone delivery.
• Recruitment Evaluation: Reviewing applicant qualifications, verifying portfolios, and scheduling technical interviews.
• Security & Fraud Prevention: Protecting web infrastructure, preventing denial-of-service attempts, and ensuring server uptime.

Lucie Creatives never sells, rents, monetizes, or trades your personal information with external brokers or advertisers.

3. Data Retention Schedule

We retain personal data only for as long as necessary to fulfill the specific purposes for which it was gathered:

• Client Inquiries & Discovery Data: Retained for up to twelve (12) months from submission or for the duration of the active client partnership plus any statutory tax limitation period.
• Job Application & Resume Data: Retained for six (6) months following the closing of the relevant recruitment cycle, after which files and records are securely purged.
• Technical Access Logs: Retained for a maximum of thirty (30) days for security audits and diagnostic monitoring.

4. Rights of Data Principals

As a Data Principal under the DPDP Act 2023, you hold enforceable rights regarding your digital personal data:

• Right to Access & Summary: You may request a summary of the personal data we hold about you and the processing activities undertaken.
• Right to Correction & Completion: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data when the specified purpose is fulfilled and retention is no longer mandated by law.
• Right to Grievance Redressal: You may seek redressal for any concerns or non-compliance regarding your personal data.
• Right to Nominate: You have the right to nominate another individual to exercise your rights in the event of death or incapacity.

5. Data Security & Technical Safeguards

We implement robust reasonable security safeguards to prevent personal data breaches, including TLS 1.3 cryptographic protocols for data in transit, strict principle-of-least-privilege access controls, isolated production database environments, and secure, non-indexed storage for candidate resume documents.

6. Grievance Officer & Regulatory Redressal

In compliance with the Digital Personal Data Protection Act 2023, any privacy inquiries, requests to exercise Data Principal rights, or grievances may be directed to our designated Data Grievance Officer:

All requests received by the Grievance Officer will be acknowledged within forty-eight (48) hours and addressed within thirty (30) calendar days as stipulated under the DPDP Act 2023.