Privacy Notice (English - source of truth)(हिन्दी)

1. Who we are

DPDP Bridge ("we", "us", "the Company") operates the dpdp-bridge.com website and the DPDP Bridge SaaS product, an India-DPDP-Act-2023 self-serve compliance middleware for global SaaS. Registered support email: hi@dpdp-bridge.com. Postal correspondence: c/o the Indian grievance officer at the address printed on every individual notice (see §12).

2. Roles under the DPDP Act 2023

The DPDP Act recognises three roles. We hold two of them simultaneously, and the boundary is non-trivial:

• Data Fiduciary [Section 2(i)] — for tenant account data (the personal data of the people who sign up for and administer a DPDP Bridge tenant). We determine the purpose and means of processing this data ourselves, so we are the Data Fiduciary, with all Section 8 obligations.
• Data Processor [Section 2(k)] — for Data Principal data routed through our APIs and SDK by a customer (consent grants, withdrawals, erasure requests, breach records, grievance tickets, audit log entries). We process this data only on the documented instructions of the customer Data Fiduciary, set out in the Data Processing Agreement (DPA).
• Consent Manager [Section 6(7), Rule 4] — we are not a registered Consent Manager. Rule 4 requires Indian incorporation and a Rs 2 crore minimum net worth that DPDP Bridge does not meet. We expose Section 6(7) hooks for tenants to plug a registered Consent Manager when one is appointed.

Where this notice describes our processing of tenant data we act as Data Fiduciary. Where it describes processing of Data Principal data routed by a customer we act as Data Processor — the Data Principal must direct rights requests to that customer, who is the Data Fiduciary for that data.

3. Itemised notice (Section 5 + Rule 3)

Section 5(1) requires that, before or at the time of consent collection, the Data Principal receives an itemised notice describing the personal data, the purpose, and the means of exercising rights. Rule 3 further specifies that the notice be in the English language or one of the languages set out in the Eighth Schedule to the Constitution of India, presented separately from any other information, and clear, plain and understandable.

For tenant account data the items collected, the purposes, and the consequences of refusal are:

For Data Principal data routed by a customer the customer Data Fiduciary issues its own Section 5 notice via the DPDP Bridge consent SDK; we are the Data Processor for that data and do not issue an independent notice.

4. Consent (Section 6) and grant via dpToken

Section 6(1) defines consent as free, specific, informed, unconditional, and unambiguous, given by a clear affirmative action. Section 6(4)–(5) requires that withdrawal be as easy as the granting was. We collect consent for tenant account data through the standard sign-up flow with explicit per-purpose checkboxes (no pre-ticked options, no bundled consent). For analytics or non-essential cookies, see the cookie banner described in §9.

Data Principals exercise rights against the Data Fiduciary (the customer) via the customer's user interface; that interface mints a short-lived dpToken on the Data Principal's behalf and submits the request to DPDP Bridge with a server-to-server API key plus the dpToken. The dpToken binds the request to the currently logged-in Data Principal so a stolen API key alone cannot forge a request.

5. Data Fiduciary obligations (Section 8)

For tenant account data we comply with the obligations of Section 8:

• 8(1) Accountability. A documented compliance programme is maintained and audit-ready.
• 8(3) Accuracy and completeness. Tenants can correct their own profile via the dashboard.
• 8(5) Reasonable security safeguards. TLS 1.2+, AES-256 at rest, HMAC-SHA256 signed JWTs, per-tenant API keys, principle of least privilege, quarterly access review, Sentry-based incident monitoring.
• 8(6) Breach notification within 72 hours. See §10 of this notice and the dedicated breach module of the product.
• 8(7) Erasure on purpose-end. Tenant data is erased on account closure subject to a 30-day grace and 7-year compliance-record retention.
• 8(9) Grievance officer publication. See §12.
• 8(10) Contact disclosure. See §1.

6. Children (Section 9 + Rule 10)

Section 9(1) requires verifiable parental consent before processing the personal data of children (under 18). Section 9(3) prohibits behavioural tracking and targeted advertising directed at children. Rule 10 details the methods for verifying parental consent (government ID, virtual ID via DigiLocker, or an alternative published by the Board).

DPDP Bridge is a B2B SaaS not intended for use by children. We do not knowingly collect personal data of children. If a tenant administrator confirms they are under 18, we will refuse the registration and erase any data already submitted. Customer Data Fiduciaries that process children's data must use the children-specific configuration of the consent SDK, which enforces a parental-consent gate and disables targeted advertising purposes.

7. Data Principal rights (Sections 11 to 14)

We facilitate the following rights for tenants (Data Fiduciary mode) and provide processor-side tooling for our customers to honour the same rights for their Data Principals:

• Right to access [Section 11] — export tenant data on request; for routed Data Principal data, contact the customer.
• Right to correction and erasure [Section 12] — tenants edit their profile and may delete their account via DELETE /tenant/account; Data Principals submit erasure via the customer's UI which calls POST /erasure/request with a dpToken.
• Right of grievance redressal [Section 13] — see §12. We respond within 30 days as required by Rule 14.
• Right to nominate [Section 14] — tenants may nominate a successor for the account by emailing the grievance officer; for Data Principal data, the customer Data Fiduciary handles nominations.

8. Cross-border transfer (Section 16)

Section 16 permits cross-border transfer of personal data outside India unless the Central Government, by notification, restricts transfer to a particular country or territory. As of the effective date of this notice, no country has been restricted; we will update this section within 5 business days of any restriction notification.

Storage region: cloud customers' data is stored in our default cloud region (currently AWS Mumbai — ap-south-1). Self-hosted customers control their own region entirely. We will give 30 days' notice of any material change in storage region.

9. Retention & compliance ledger (Rule 13)

Rule 13 ties retention to defined retention periods, and the Third Schedule of the Rules sets specific retention rules for e-commerce, social-media intermediary and online-gaming Data Fiduciaries with more than 2 crore users. Our retention is:

• Tenant account data — for the duration of the contract plus 36 months after closure (statute of limitations buffer).
• Server logs — 30 days, then automatically purged.
• Data Principal data routed by customers — per the customer's configured retention policy; default 7 days for erasure SLA.
• Compliance records (audit ledger, consent log, breach record) — 7 years. The DPDP Act does not specify a duration for compliance evidence; 7 years aligns with general statutory record-keeping practice in India and is the highest among adjacent regulators (RBI, IT Act intermediary rules).

The audit ledger is append-only, signed at row level, and surfaces in /tenant/audit-log. Cookie banner consent tokens are written to the audit ledger on grant and on withdrawal so an investigation can reconstruct user choice without leaving the platform.

10. Sub-processors and breach notification

The current list of sub-processors is published in our DPA (/dpa.html) and reproduced here for convenience: AWS Mumbai (compute and storage, ap-south-1), Stripe (billing), Resend (email delivery), Sentry (error monitoring). We notify customers of any new sub-processor at least 30 days before engagement, with a right to terminate in lieu of consent.

If a personal data breach occurs we notify affected customer Data Fiduciaries without undue delay so they can satisfy Section 8(6) and Rule 7 within the 72-hour window. Where DPDP Bridge itself is the breached Data Fiduciary (tenant account data) we notify the Data Protection Board within 72 hours and the affected Data Principals as soon as is practicable.

11. Right to complain to the Data Protection Board

Section 27 establishes the Data Protection Board of India ("DPB") as the adjudicatory body. After exhausting our grievance mechanism (§12) you may file a complaint with the Board at dpb.gov.in. The DPB acknowledges receipt and is required to resolve the matter within the timelines set by Rule 15.

12. Grievance officer (Section 8(9))

Email hi@dpdp-bridge.com with the subject line "Grievance". Response within 30 days as required by Rule 14. If you do not receive a satisfactory response you may escalate to the Data Protection Board (§11).

13. Changes

We post material changes at this URL with a revised effective date and email tenant administrators 30 days before the new version takes effect.