Privacy Policy.

IFWP 2026–27 · Effective from 1 April 2026

Introduction

India’s Finest Workplaces: People & Practices (“IFWP”), a proprietary programme owned and operated by GMO Media Private Limited (“we”, “us”, “our”), is committed to protecting the privacy and personal data of every individual who engages with our programme, research, editorial properties, and digital platform.

This Privacy Policy explains how we collect, use, share, retain, and protect personal data through indiasfinestworkplaces.com, IFWP portals, dashboards, surveys, editorial features, events, and any related communications (collectively, the “IFWP Platform”). It is drafted in accordance with the Digital Personal Data Protection Act, 2023 (“DPDPA”), the Information Technology Act, 2000, and other applicable Indian laws.

Please read this Policy alongside our Terms & Conditions, Cookie Policy, and Disclaimer. By using the IFWP Platform or submitting personal data to us, you confirm that you have read and understood this Policy.

Who We Are

The Data Fiduciary for personal data processed under this Policy is GMO Media Private Limited, the entity that owns and operates the IFWP programme. Correspondence regarding this Policy or the exercise of your rights should be addressed to our Data Protection Officer using the contact details in Section 14.

Data We Collect

We collect only the categories of personal data necessary to operate the IFWP programme and deliver the services you have requested. These typically include:

3.1 Organisational & Contact Data

Company name, sector, size, address, key contacts, designations, business email addresses, business phone numbers, and any accompanying declarations, approvals, or documentation submitted during certification.

3.2 Employee Survey Data

Responses to the IFWP People & Practices survey, including experience ratings, open-ended commentary, and voluntarily provided demographic attributes. Individual responses are held in confidence and are reported to the participating organisation only in aggregated, de-identified form.

3.3 Account & Usage Data

Login credentials, dashboard activity, IP address, device and browser identifiers, referral URLs, timestamps, and interaction logs generated while using the IFWP Platform.

3.4 Communications & Editorial Data

Enquiries, feedback, testimonials, event registrations, podcast participation, quotes, images, videos, and other content you voluntarily submit for editorial or promotional use.

3.5 Cookies & Similar Technologies

Data collected via cookies, pixels, local storage, and SDKs as described in our Cookie Policy.

How We Use Data

We use personal data for the following purposes:

To administer the certification process — evaluating eligibility, running surveys, generating scorecards, awarding recognition, and issuing badges;
To operate research programmes and produce aggregated, de-identified insights such as culture indices, heatmaps, benchmarks, and white papers;
To publish editorial features, listings, rankings, television integrations, and event coverage in accordance with your consent and the IFWP Terms & Conditions;
To provide dashboards, downloads, and related support services to participating organisations;
To communicate service updates, invoices, event invitations, and — where you have opted in — marketing communications from IFWP;
To ensure the security, integrity, and lawful operation of the IFWP Platform, including fraud prevention and abuse detection;
To comply with legal, regulatory, and audit obligations, and to respond to lawful requests from competent authorities.

Lawful Basis & Consent

Under the DPDPA, we process personal data on the following lawful bases: (a) the specific, informed, and unambiguous consent of the Data Principal; (b) the performance of a contract with the participating organisation; (c) compliance with a legal obligation; or (d) legitimate uses recognised under the DPDPA, such as maintaining service integrity and security.

Where processing is based on consent, that consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal or processing under a separate lawful basis.

Sharing & Disclosure

We do not sell personal data. We share it only in the following limited circumstances:

Participating organisations — aggregated, de-identified survey outputs are shared with the organisation that commissioned the assessment; individual responses are not disclosed;
Service providers & sub-processors — vetted vendors who host, secure, analyse, or deliver parts of the IFWP Platform under written data-processing agreements consistent with the DPDPA;
Media & broadcast partners — where you have expressly consented to inclusion in editorial features, television integrations, or public listings (for example, ET Now features);
Advisors & auditors — legal, financial, or accreditation advisors bound by professional confidentiality obligations;
Regulators & courts — where required by applicable law, judicial order, or other lawful process.

Data Localisation & Cross-Border Transfers

Personal data collected under this Policy is stored and processed within the territory of India by default. Where certain categories of data are transferred outside India, such transfers are made only to jurisdictions permitted by the Central Government under the DPDPA and are subject to appropriate contractual safeguards. We do not transfer personal data to any country in respect of which the Central Government has issued a restriction.

Security

We employ reasonable technical and organisational safeguards to protect personal data against unauthorised access, alteration, disclosure, or destruction, consistent with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”). These include encryption in transit, access controls, network segregation, logging and monitoring, staff training, and regular reviews of our security posture.

In the event of a personal-data breach, we will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDPA and applicable rules.

Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The typical retention periods are:

Data Category	Retention Period
Certification records & declarations	For the certification cycle and up to seven (7) years thereafter, in line with statutory record-keeping obligations.
Aggregated survey outputs	Retained indefinitely in de-identified form for benchmarking and longitudinal research.
Individual survey responses	De-identified within ninety (90) days of the close of the applicable survey wave.
Account & dashboard data	For the duration of the account plus up to twenty-four (24) months, unless required longer by law.
Marketing preferences	Until consent is withdrawn or the underlying relationship ends.

Your Rights as a Data Principal

Subject to the DPDPA and any applicable exemptions, you have the following rights in relation to your personal data:

Right to information — obtain confirmation of processing and a summary of the personal data we hold about you;
Right to correction & erasure — request correction of inaccurate data and erasure where processing is no longer necessary;
Right to grievance redressal — raise concerns with us through the process set out in Section 12;
Right to nominate — appoint another individual to exercise your rights in the event of your death or incapacity;
Right to withdraw consent — where processing relies on consent, withdraw that consent at any time.

To exercise any of these rights, please write to us at connect@indiasfinestworkplaces.com. We may verify your identity before responding, and will respond within the timelines prescribed under the DPDPA.

Children's Data

The IFWP Platform is intended for use by working professionals and organisations. We do not knowingly collect personal data of children (individuals under the age of eighteen) or of persons with disabilities requiring a lawful guardian, except with verifiable consent from a parent or lawful guardian as required by the DPDPA. If you believe such data has been provided to us inadvertently, please contact us and we will delete it promptly.

Grievance Redressal

If you have a complaint about how we handle personal data, please write to our Data Protection Officer at connect@indiasfinestworkplaces.com with the subject line “Privacy Grievance”. We will acknowledge your complaint promptly and endeavour to resolve it within the timelines prescribed under the DPDPA and the SPDI Rules.

If you are not satisfied with our response, you may escalate the matter to the Data Protection Board of India in accordance with the DPDPA.

Changes to This Policy

We may revise this Privacy Policy from time to time to reflect changes in the IFWP programme, our services, or applicable law. Material changes will be notified through the IFWP Platform or by direct communication where appropriate. The “Effective from” date at the top of this page indicates the version currently in force.

Contact

This Privacy Policy is governed by the laws of India and read together with the IFWP Terms & Conditions, Cookie Policy, and Disclaimer.