Privacy Policy
How the Expat Business Council collects, uses and protects your personal information.
Last updated 27 October 2026
Version 2.0 | Last updated: 11 October 2026
1. About this Policy
1.1 Expat Business Council (“EBC”, “we”, “us”), a not-for-profit company licensed under Section 8 of the Companies Act, 2013 (CIN U70200KA2025NPL211785), registered office: 2nd Floor, No. 25, S V Arcade, South End Main Road, Jayanagar 9th Block, Bengaluru, Karnataka 560041, India, is the Data Fiduciary for the personal data described in this Policy.
1.2 This Policy applies to everyone whose personal data we process: members and applicants, representatives of Corporate Members, and non-members such as website visitors, enquirers, subscribers, event participants, speakers, sponsors’ and partners’ contact persons, Advisory Board members and volunteers.
1.3 At the point where we collect your data, we also show you a Privacy Notice that lists each item of data and its purpose.
1.4 This Policy follows the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”). It also follows the Information Technology Act, 2000 and the rules made under it, which apply until then.
2. What we collect
| Who | Personal data |
|---|---|
| Website visitors | IP address, device and browser data, pages visited, cookie identifiers |
| Enquirers | Name, email, phone, company, message |
| Subscribers | Name, email, preferences |
| Membership applicants and members | Name, email, phone, date of birth, gender (optional), nationality, profession, designation, company, industry, expertise, LinkedIn and website, identity proof, proof of residency status, where applicable, proof of professional role, photograph, application answers, login credentials, membership and attendance history |
| Corporate Member representatives | Name, designation, email, phone; company documents |
| Event participants | Name, email, phone, company, designation, dietary preference, attendance; photographs and video taken at events |
| Speakers, Advisory Board members, sponsor and partner contacts, volunteers | Name, designation, organisation, contact details, biography and photograph, where relevant |
| Payers | Name, transaction ID, amount, date, status. Card, UPI and bank details |
We do not ask for health, biometric, religious, caste or political data. Aadhaar is not required; if you choose to give it, please mask the first eight digits.
3. Why we use it
A. With your consent, given by ticking a box and which you may withdraw at any time:
- newsletters and event invitations for non-members;
- your profile in the Member Directory;
- EBC WhatsApp groups;
- publishing photographs and video of you, and the profiles of speakers and Advisory Board members;
- non-essential cookies.
Any other use, such as introducing you to a partner or featuring your business in the EBC Global Magazine, happens only after we ask you at the time.
B. For legitimate uses under Section 7 of the DPDP Act, without separate consent:
- to do what you asked when you voluntarily gave us the data: answer your enquiry, process your application, register you for an event, provide membership, take payment and issue receipts;
- to comply with law, including company, tax, accounting and audit requirements;
- to deal with a medical emergency or a threat to safety at an EBC event.
We also use data to keep the Platform secure, prevent misuse, and enforce our Terms of Use, Membership Terms and Code of Conduct.
4. How consent is given and recorded
4.1 Consent is given online by ticking a box and clicking a button. Each optional purpose has its own box. Your membership, registration or subscription never depends on an optional consent.
4.2 Before you tick, you are shown the relevant Privacy Notice and the documents you are agreeing to, by link.
4.3 For each consent we record the purpose, the version of the text you agreed to, and the date, time and IP address. We keep this record for as long as the consent is valid, and for one year after it is withdrawn.
4.4 You can see and change your choices at any time under “My Data” in the Members Portal, through the “unsubscribe” link in any email, through “Cookie Settings” in the website footer, or by email.
5. Who we share it with
5.1 We do not sell personal data.
5.2 We share personal data only as needed with:
- service providers who process it on our behalf under contract: website and member-platform hosting, email and cloud storage, payment processing, video-conferencing, event venues, photographers and printers;
- our chartered accountants, auditors and legal advisers;
- authorities, where the law or a court requires it; and
- with your consent only: other members, partners, sponsors, WhatsApp.
5.3 Some providers store data outside India. Transfers are made only as permitted by Section 16 of the DPDP Act and never to a country restricted by the Central Government.
5.4 On request, we will name each person with whom your data has been shared.
6. How long we keep it
| Data | Retention |
|---|---|
| Security and access logs | At least one year |
| Enquiries | One year after closure |
| Unsuccessful applications and documents | One year after the decision |
| Member profile and records | During membership and three years after it ends |
| Identity and residency documents | During membership and one year after it ends |
| Invoices, receipts and payment records | Eight years from the end of the financial year (Section 128(5), Companies Act, 2013) |
| Event registrations | One year after the event |
| Newsletter subscriptions | Until you unsubscribe |
| Photographs and video | Until consent is withdrawn |
7. Security
We use HTTPS encryption, hashed passwords, role-based access, access logging, backups, and contracts with our service providers requiring security and confidentiality. If a personal data breach occurs, we will inform affected persons without delay and report it to the Data Protection Board of India within 72 hours (“Rule 7, DPDP Rules”).
8. Cookies
8.1 Strictly necessary cookies (login, security, cookie choice, payment) are always on. Functional, analytics and social media cookies are used only if you allow them.
8.2 On your first visit, a banner gives three options of equal prominence: Accept all, Reject non-essential and Manage preferences. You can change your choice at any time through “Cookie Settings” in the footer.
8.3 A current list of cookies is shown in the “Manage preferences” panel.
9. Your rights
You have the right to:
- obtain a summary of your personal data and how it is processed, and the identities of those it has been shared with;
- have your data corrected, completed, updated or erased;
- withdraw consent, as easily as you gave it;
- have your grievance redressed; and
- nominate a person to exercise your rights in case of death or incapacity.
How to exercise them: use the “My Data” section of the Members Portal or the online Data Rights Request form at www.expatbusinesscouncil.org/privacy/my-rights. If you cannot use the form, email expatbusinesscouncil@gmail.com with the subject “Data Rights Request”. We confirm your identity by a code sent to your registered email or mobile number. Requests are free. We reply within 30 days, and in any case within the 90 days allowed by Rule 14 of the DPDP Rules.
When you exercise your rights, you must give accurate information and must not impersonate anyone or file false complaints (“Section 15, DPDP Act”).
10. Grievance Officer and complaints
Ms. Gayathri G
Grievance Officer,
Expat Business Council, 2nd Floor, No. 25, S V Arcade, South End Main Road, Jayanagar 9th Block, Bengaluru, Karnataka 560041 ·
expatbusinesscouncil@gmail.com
+91 99015 92144
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
11. Children and persons with disability
EBC membership and online registration are for adults (18+). A person under 18 may attend an EBC event only if a parent or lawful guardian registers them through their own verified account and gives consent online. We do not track, profile or target advertising at children. For adults with a lawful guardian, consent is taken from the guardian after their appointment is verified.
12. Language and changes
This Policy is in English. On request, we will provide it in any language listed in the Eighth Schedule to the Constitution of India. We will publish any update here with its date, and email members about material changes. Where a change needs fresh consent, we will ask for it.