Legal
Privacy policy
Effective 22 August 2026. Written to the standard we hold our customers to.
- Who we are and what this covers
- Categories of personal data we collect
- Why we process it, and on what lawful basis
- Consent, and how to withdraw it
- Your rights as a Data Principal
- Grievance redressal
- How long we keep personal data
- Disclosure, processors and sub-processors
- Customer data held in the platform
- Security safeguards
- Personal data breaches
- Children and persons with disability
- Cookies and analytics
- Automated processing and AI
- Transfers outside India
- Changes to this policy
1. Who we are and what this covers
This policy is issued by DPDP Vault (“we”, “us”, “our”). It sets out how personal data is collected, processed, stored, disclosed, retained and erased when any person accesses or uses the website at https://dpdpvault.com (the “Site”) or the DPDP Vault platform (the “Platform”).
- Data Fiduciary
- DPDP Vault
- Registered office
- Aspen Core A, Adinath Shanthiniketan, Ramakrishna Road, Chennai - 600 048, Tamil Nadu, India
- Contact for privacy
- hello@dpdpvault.in
We are the Data Fiduciary for personal data we collect about visitors to the Site, prospects, and the individual users of our customers’ accounts. Section 9 below explains our different and narrower role for personal data our customers put into the Platform.
Using this Site is not consent. Browsing does not signify agreement to anything. Where we rely on consent we ask for it separately, by an unticked box, for a stated purpose, and you can decline without losing access to the Site.
2. Categories of personal data we collect
2.1 Information you give us
When you request a demo or contact us: your name, work email address, organisation, job title, sector, and - only if you choose to give them - a phone number and a message. The demo form itemises each field and what it is used for at the point of collection.
2.2 Information from your account
If your organisation is a customer: your name, work email address, role, and a record of actions you take in the Platform, kept as an audit trail so your organisation can evidence its own compliance.
2.3 Technical information
Server logs record the requested URL, timestamp, HTTP status, a truncated IP address and a user-agent string. These are used for security and fault diagnosis only and are retained for the period stated in section 7.
2.4 Information we do not collect
We do not buy contact lists, we do not enrich your details from data brokers, and we do not build behavioural advertising profiles. None of these has a lawful basis available to us under the Act, and a broker’s assurance does not create one.
3. Why we process it, and on what lawful basis
| Purpose | Basis or exemption |
|---|---|
| Arranging and running a demo you asked for | Consent - s.6 |
| Product updates and regulatory briefings by email | Separate consent - s.6, declinable |
| Providing the Platform to a customer organisation | Performance of our contract with that organisation |
| Keeping the Site and Platform secure | Voluntarily provided for that purpose - s.7(a) |
| Meeting a legal obligation to disclose information to the State | s.7(d), and the specific law that requires the disclosure |
| Retaining records a law requires us to keep | Not a separate basis - the retention exception in s.8(7) |
| Establishing or defending a legal claim | Exemption, not a basis - s.17(1)(a) |
We do not process personal data for a purpose outside this table. If a new purpose arises we give you a fresh notice and ask for fresh consent - we do not reuse consent you gave for something else.
4. Consent, and how to withdraw it
Where consent is our basis, it is sought by a clear affirmative action for a specific purpose. Boxes are never pre-ticked, consents are never bundled together, and declining one does not withhold something unrelated.
To withdraw: email hello@dpdpvault.in quoting the consent reference we gave you, or simply say what you want stopped. That is one step - no more than it took to give consent, as section 6(4) requires. We stop the relevant processing within seven working days and instruct our processors to do the same.
Withdrawal is not retrospective: it does not undo processing that was lawful when it happened. Where withdrawal means we can no longer provide something, we tell you before you confirm.
5. Your rights as a Data Principal
- Access - a summary of the personal data we process about you and what we do with it, plus the identities of every other Data Fiduciary and Data Processor we have shared it with (s.11).
- Correction, completion and updating - of anything inaccurate, incomplete or out of date (s.12(1)–(2)).
- Erasure - unless we are required by law to keep it, in which case we tell you which law and for how long (s.12(3)).
- Nomination - you may nominate another individual to exercise these rights for you in the event of your death or incapacity (s.14).
- Grievance - see section 6.
- Complaint to the Board - you may complain to the Data Protection Board of India, and you do not have to come to us first.
How to exercise them: email hello@dpdpvault.in from the address we hold for you, or quote your consent reference. We verify you using an identifier we already issued - we will not ask you to send identity documents we never collected (Rule 14(5)).
6. Grievance redressal
- Officer
- Ram Gopal R, Grievance Officer
- hello@dpdpvault.in
- Response
- Acknowledged within 3 working days; resolved within 90 days of receipt
This is the contact published under section 8(9). If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India.
7. How long we keep personal data
| Data | Retention | Then |
|---|---|---|
| Demo and enquiry records | 24 months | Erased automatically, counted from your last interaction |
| Marketing consent records | 24 months | Erased, or immediately on withdrawal |
| Customer account records | Term + 12 months | Erased unless a statutory hold applies |
| Security and access logs | 12 months | Erased. Retained as required by Rule 6 |
| Invoices and tax records | 8 years | Retained under the Companies Act 2013 and tax law |
| Consent artefacts | Life of consent + 3 years | Kept to discharge our burden of proof under s.6(10) |
Where a law requires us to keep something longer than our own schedule, the erasure is deferred rather than silently skipped, and we record which law requires it. We do not describe retention as “as long as necessary” - that is not a period.
8. Disclosure, processors and sub-processors
We do not sell or rent personal data. We disclose it only to:
- service providers who process on our documented instruction under a written contract meeting section 8(2);
- professional advisers under a duty of confidence;
- a court, tribunal or authority where a law in force in India requires it - each such disclosure is logged with its legal authority.
A current list of our sub-processors, with what each one does and where it operates, is available from hello@dpdpvault.in on request. We give customers notice before adding a sub-processor that handles their data.
9. Customer data held in the platform
For personal data our customers load into the Platform, the customer is the Data Fiduciary and we are a Data Processor. We process it only on their documented instruction and never for a purpose of our own.
Specifically, we do not:
- use customer data to train models or improve our classifiers;
- aggregate it across customers to produce benchmarks;
- process it for analytics beyond operating the service for that customer.
Each of those would make us a Data Fiduciary for that processing, and we have chosen not to be. If you are an individual whose data sits in a customer’s account and you want to exercise a right over it, contact that organisation. If you contact us instead, we will pass your request on and tell you we have.
Where a customer deploys the Platform on their own infrastructure and operates it themselves, we ordinarily process none of their personal data at all. See deployment models.
10. Security safeguards
We implement technical and organisational measures under section 8(5) and Rule 6: encryption in transit and at rest, role-based access on a need-to-know basis, multi-factor authentication for administrative access, logging and monitoring with the retention stated above, vulnerability management, and periodic review.
No system is perfectly secure. Where we say a control exists, it exists and can be evidenced; we do not describe aspirations as safeguards.
11. Personal data breaches
If a personal data breach affects your personal data, we will intimate you and the Data Protection Board of India in the form and manner prescribed under section 8(6) and Rule 7. There is no materiality threshold: the obligation does not depend on our view of how serious it was.
Where we act as a processor for a customer, we escalate to that customer within the hours committed in their agreement - sized so that both their 72-hour Rule 7 clock and their 6-hour CERT-In clock remain achievable from the moment we become aware.
12. Children and persons with disability
The Site and the Platform are intended for use by adults acting in a professional capacity. We do not knowingly collect the personal data of anyone under 18 through this Site, and we do not direct it at children.
We do not undertake tracking, behavioural monitoring or targeted advertising directed at children in any circumstances, which section 9(3) prohibits outright. If you believe a child’s personal data has reached us, write to hello@dpdpvault.in and we will erase it.
Where a Data Principal is a child, the Act treats the parent or lawful guardian as the Data Principal; where a Data Principal has a lawful guardian, that guardian acts on her behalf. Requests from a guardian are handled on that footing.
13. Cookies and analytics
This Site sets only cookies strictly necessary to serve the pages you request. We do not run advertising or cross-site tracking cookies, and we do not embed third-party advertising pixels.
If we later introduce analytics, non-essential cookies will be off by default and will fire only after a clear affirmative action - never before the choice is made.
14. Automated processing and AI
The Platform uses automated analysis to classify data and to draft findings. Outputs are advisory. They do not constitute legal advice and are not a substitute for your own judgement or that of your counsel; your organisation remains responsible for its own compliance decisions.
We do not make decisions producing legal effects about you by automated means through this Site, and we do not use personal data submitted here to train models.
15. Transfers outside India
Personal data collected through this Site is stored and processed in India. Where any processing outside India becomes necessary, we will do so only in a manner consistent with section 16 and with any restriction notified by the Central Government, and we will update this policy and the sub-processor list before it happens.
Where a sectoral regulator imposes a stricter localisation requirement on you than section 16 does, that stricter rule governs - section 16(2) preserves it.
16. Changes to this policy
We version this policy and keep prior versions. Where a change materially affects a purpose you consented to, we give you a fresh notice and ask again - continued use is not treated as acceptance of a new purpose.
Version 22 August 2026 · See also our terms and conditions.