DPDP Act, 2023 — Compliance Statement

1. Our role under the Act

When you sign up for our services, we act as a Data Fiduciary for the personal data you share with us directly. When you use our APIs to communicate with your own customers, we act as a Data Processor on your behalf — and you remain the Data Fiduciary for that data.

2. Lawful basis for processing

We process personal data only under one or more of these grounds:

• Your free, specific, informed and unambiguous consent.
• Performance of a contract you have entered into with us.
• Legitimate uses defined under Section 7 of the DPDP Act (e.g., employment, mergers, public-interest functions where applicable).
• Compliance with a legal obligation.

3. Notice & consent

Before collecting personal data from you, we provide a clear notice describing the data being collected, the purpose, and how you can withdraw consent. Consent records are auditable.

4. Your rights as a Data Principal

Under Sections 11–14 of the DPDP Act, you have the right to:

• Access a summary of personal data we process about you and the processing activities undertaken.
• Correction, completion, updating and erasure of your personal data.
• Grievance redressal through our designated contact.
• Nomination of another individual to exercise your rights in case of incapacity or death.
• Withdraw consent with the same ease with which it was given.

To exercise any of these rights, email [email protected] with the subject “DPDP Request”. We will respond within 7 working days.

5. Our obligations as a Data Fiduciary

• Process data only for lawful and stated purposes.
• Ensure accuracy and completeness of personal data.
• Implement reasonable security safeguards to prevent personal data breaches.
• Notify the Data Protection Board of India and affected Data Principals in case of a personal data breach.
• Delete personal data when the purpose is met or consent is withdrawn, unless retention is legally required.

6. Security safeguards

• Encryption-at-rest for all personal data stores.
• TLS 1.3 for data in transit.
• Role-based access control with mandatory two-factor authentication for staff.
• Audit logging of all administrative and access events.
• Annual third-party security assessments.
• Documented incident-response and breach-notification playbook.

7. Children’s data

Our services are not directed at individuals under 18. We do not knowingly process personal data of children or persons with disabilities without their lawful guardian’s verifiable consent.

8. Cross-border transfers

All Digisetu customer personal data is hosted within India. Where we use sub-processors outside India for limited operational purposes (e.g., analytics, monitoring), transfers are made only to jurisdictions not restricted by the Central Government, and under appropriate data-processing agreements.

9. Grievance redressal

Our Data Protection Officer is responsible for grievance redressal under Section 8(9) of the Act.

• Email: [email protected] (Subject: “DPDP Grievance”)
• Postal: Data Protection Officer, Digisetu Innovation Pvt. Ltd., 2nd Floor, SF-43-53, R-Tech Emporia, New Sanganer Road, Mansarovar, Jaipur (Rajasthan), India.
• Response time: 7 working days for acknowledgement, 30 days for resolution.

If your grievance is unresolved, you may approach the Data Protection Board of India.

10. Related documents

• Privacy Policy
• Terms of Service
• Refund Policy
• Communication, Media & Advertising Services Policy