Privacy Policy

1. Introduction

This Privacy Policy explains how DPDP Scan Inc ("Company", "we", "us", or "our") collects, uses, stores, and protects personal data when you access or use the DPDP Scanner website and web application ("Service").

We are committed to protecting personal data in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), including future rules notified thereunder.

2. About the Company (Data Fiduciary)

3. Scope of This Privacy Policy

This policy applies to website visitors, registered users, and individuals or organizations submitting websites for DPDP compliance scanning.

4. Personal Data We Collect

5. Purpose of Processing

We process your personal data for:

• Providing DPDP compliance scanning
• Generating reports and remediation suggestions
• Account management and user support
• Security and fraud prevention
• Legal compliance

6. Lawful Basis & Consent

We obtain your consent via:

• Signup checkbox
• Cookie banner
• Separate marketing opt-in

You may withdraw consent at any time by contacting privacy@dpdpscan.com or using the "Manage Consent" option in the footer.

7. Cookies

We use only essential cookies necessary for the Service to function. A cookie notice is provided when you first visit the website.

8. Data Storage & Retention

All personal data is stored in India and retained only as long as necessary for the purposes stated in this Privacy Policy.

After the retention period, data is securely deleted or anonymized.

9. Data Sharing

We may share personal data with data processors under strict safeguards, including:

• AWS: Cloud hosting services
• Amazon SES: Email delivery
• AI Service Providers: For compliance analysis (OpenAI)

All data processors are bound by data processing agreements and security requirements.

10. Cross-Border Transfers

Currently, all data is stored in India. Any future cross-border data transfers will comply with the DPDP Act requirements and be disclosed in an updated Privacy Policy.

11. Security

We implement reasonable technical and organizational safeguards to protect your personal data from unauthorized access, disclosure, alteration, or destruction.

These safeguards include:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest (AES-256)
• Access controls and authentication
• Regular security monitoring and audits

12. Data Principal Rights

Under the DPDP Act, you have the following rights:

• Right to access: Request information about your personal data we hold
• Right to correction: Request correction of inaccurate personal data
• Right to erasure: Request deletion of your personal data
• Right to withdrawal of consent: Withdraw consent at any time
• Right to grievance redressal: File complaints about data processing

To exercise these rights, contact: privacy@dpdpscan.com

13. Grievance Redressal

For any complaints or concerns about how we process your personal data, please contact:

Email: privacy@dpdpscan.com

We are committed to resolving complaints promptly and fairly.

14. Children's Data

The Service is not intended for users under 18 years of age. We do not knowingly collect personal data from children without verifiable parental consent.

If you believe we have inadvertently collected personal data from a child under 18, please contact us immediately at privacy@dpdpscan.com, and we will delete the data promptly.

15. Policy Updates

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised "Last Updated" date.

Continued use of the Service after changes indicates acceptance of the updated Privacy Policy.