Privacy notice
What this site collects about you, why, who sees it, how long it is kept and how to use your rights under the Digital Personal Data Protection Act, 2023.
This notice has details still to be completed before launch. They are highlighted.
Who we are
This site is run by [PLACEHOLDER: legal name of the operating entity], [PLACEHOLDER: registered address]. For the personal data described here, we are the Data Fiduciary: we decide why and how it is used.
The assessment
Your answers are not sent to us unless you save them. The free readiness check runs in your browser. Your answers and business name are kept in this browser tab so that a page refresh does not lose them, and they are cleared when you close the tab or choose “Start again”. We receive them only if you choose to save the result to a workspace account, described next.
If you later ask for help and tick the box to include your result, we receive only your self-assessed score, the number of gaps at each severity and the gap reference numbers. Your answers and business name are not included.
Workspace accounts
If you create an account, your organisation uses the workspace and we hold the following on its behalf and ours.
| What we hold | Why |
|---|---|
| Your name, work email and a one-way code of your password (never the password itself) | To let you sign in and to identify who did what in the account |
| Organisation name and sector | To set up the assessment |
| Assessment answers, tasks, notes and evidence files your team adds | To provide the workspace |
| An activity record: who changed what, and when | So your team can see the history, and for security |
| Orders: the product, amount, billing name, GSTIN, address and the bank reference of your payment | To record what you bought and paid for, and to issue GST invoices |
| The time and version of the wording you agreed to | So that we can show you agreed, which the Act expects us to be able to prove |
Basis: your consent when you create the account, and for invoices, our legal duty to keep tax records.
Who sees it: members of your account; a reviewer, only if your account requests a verification, and only for that assessment, with every file they open recorded; the people at [PLACEHOLDER: legal name of the operating entity] who handle orders, invoices, support and evidence checks, who can open your assessments and evidence details, with every opening recorded; and our hosting provider. Evidence files are stored outside the public web folder.
How long we keep it: until the account is closed. An owner can close the account at any time from Settings; that erases assessments, tasks, evidence, reviews, activity and members at once. Orders and invoices are kept for the period tax law requires; orders not yet paid are cancelled.
Please do not upload your customers’ personal data as evidence. If you do, your organisation is the Data Fiduciary for it and we process it only to store it for you.
Contact, help and partner forms
| What we collect | Why |
|---|---|
| Name, email, mobile number, city and state | To reply to you and, if you ask, to call you |
| Organisation and message, where you give them | To understand what you are asking |
| Preferred call date, time and time zone, if you give them | To call at a time that suits you |
| Your sector, and your shared result if you choose to include it | To prepare for the conversation |
| A record of your consent: the time and the version of the wording | So that we can show you agreed, which the Act expects us to be able to prove |
Basis: your consent, given by ticking the box on the form. You can withdraw it at any time by writing to the grievance contact below; we then stop using your details and erase them.
Who sees it: only the people at [PLACEHOLDER: legal name of the operating entity] who answer requests, and our hosting provider, which stores the website and its database on our behalf. If you ask to be introduced to a partner, we share your details with that partner only after you agree.
How long we keep it: 24 months from when you send it, then we erase it. You can ask us to erase it sooner.
No marketing: we do not add you to a mailing list or send offers.
Technical data
- To limit automated abuse, the forms count submissions per connection for one hour. The connection address is stored only as a one-way code, not in readable form.
- Failed sign-in attempts are recorded with the email address and connection address, to stop password guessing. They are cleared after a successful sign-in.
- Our hosting provider keeps standard server logs for security and troubleshooting.
- This site uses no analytics, no advertising or tracking cookies and no third-party scripts or fonts. People who sign in to a workspace account, and staff who manage the site, receive a session cookie that ends when they sign out or close the browser. Visitors who do not sign in receive no cookie.
Your rights
Under the Act you can ask us for a summary of the personal data we hold about you and who we have shared it with; ask us to correct, complete, update or erase it; withdraw your consent; and nominate someone to act for you if you die or cannot act yourself. You can also complain to us, and if you are not satisfied with our answer, to the Data Protection Board of India once its complaint process is in operation (the right to complain to the Board applies from 13 May 2027).
Grievance contact
For any question or complaint about your personal data, write to [PLACEHOLDER: grievance officer name] at [PLACEHOLDER: grievance email]. We will acknowledge your message and answer within 30 days, and in any case within 90 days.