Privacy Policy & Statutory Data Protection Notice
This notice is issued by Kavach Privacy in its capacity as a Data Fiduciary. In strict adherence to the DPDP Act 2023 statutory mandate of data minimization, we process only minimal corporate contact details strictly necessary to provide our privacy services: (1) your Work Email address when requesting an automated DPDPA diagnostic risk scorecard, and (2) your Name, Work Email, Company/Role, and Message when you submit an inquiry through our Contact Us portal. We do not collect residential addresses, financial payment credentials, or third-party tracking cookies.
01 Identity & Contact Details of the Data Fiduciary
For the purposes of the Digital Personal Data Protection Act, 2023 (hereinafter "DPDPA") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), the legal entity responsible for the collection and processing of your personal data is:
- Entity Name: Kavach Privacy Engineering & Advisory Squad
- Headquarters & Principal Operations: Chennai, Tamil Nadu, PIN 600001, Republic of India
- Official Web Portal: https://kavachprivacy.in
- Official Inquiries Email: support@kavachprivacy.in
- Dedicated Grievance Redressal Officer: grievance@kavachprivacy.in
02 Itemized Categories of Personal Data & Purpose Specification
In accordance with Section 5(1)(i) of the DPDPA and Rule 3(1) of the DPDP Rules 2025, the table below itemizes every personal data element processed, its explicit statutory purpose, and lawful processing basis.
| Category of Personal Data | Data Items Collected | Lawful Purpose & Processing Basis |
|---|---|---|
| Diagnostic Assessment Requests (assessment.html) | Corporate / Work Email Address exclusively. Zero collection of personal phone numbers, passwords, or home addresses. |
1. Transactional Report Delivery: Generating and emailing your personalized DPDPA Diagnostic Report, compliance score, and 11-step remediation roadmap (DPDPA Section 4(1)(a)). 2. Optional Compliance Updates: Sending occasional DPDPA engineering advisories only if explicitly opted in via unbundled consent (DPDPA Section 6(1)). |
| Direct Inquiries & Consultations (contact.html) | Full Name, Corporate / Work Email Address, Company / Organization, Professional Role, Topic Selection, and Technical Message description. |
1. Direct Scoping & Response: Reviewing architectural requirements, scoping compliance gap analyses, and replying to your consultation inquiry (DPDPA Section 4(1)(a) & Section 6). 2. Regulatory Updates: Optional technical regulatory newsletters only when affirmatively consented through an unbundled checkbox. |
| Diagnostic Self-Assessment Responses | Anonymous architectural selections: industry vertical, data scale tier, data sensitivity selection, and 15 technical control answers. | Computing statutory compliance score and indicative Schedule 1 penalty exposure estimates. Contains no identifiable personal data (DPDPA Section 6). |
| Technical Web Server Telemetry | Standard HTTP access logs (IP address, browser user-agent, request timestamp) automatically purged after 30 days. | Network security, DDoS mitigation, and rate-limiting automated abuse (Section 4 — Legitimate Security Baseline). |
03 Mechanism for Giving & Withdrawing Consent
In accordance with Section 6(4) of the DPDPA and Rule 3(2) of the DPDP Rules 2025:
- Giving Consent: Unbundled, specific consent is obtained through unambiguous affirmative action: (a) via the scorecard email request modal on
assessment.html, and (b) via mandatory inquiry and optional newsletter checkboxes oncontact.html. - Ease of Withdrawal: Under the DPDP Act, withdrawing consent must be as effortless as giving it. You may withdraw your consent at any time, with zero friction or fee, by sending an email with the subject line
"Consent Withdrawal"to grievance@kavachprivacy.in or support@kavachprivacy.in. - Effect of Withdrawal: Upon receiving your withdrawal request, we immediately cease processing and permanently delete your contact records from our communication ledgers within 48 hours.
04 Data Retention & Automated Erasure Lifecycle
Under Section 8(7) of the DPDPA and Rule 8 of the DPDP Rules 2025, personal data is permanently erased as soon as the specified purpose is fulfilled or consent is withdrawn:
- Work Email & Diagnostic Deliveries: Retained for a maximum period of 90 days from submission to facilitate report re-delivery and technical consultations upon request, after which records are automatically and permanently expunged.
- Formal Advisory Clients: Governed by dedicated Master Services Agreements (MSA) and bilateral Data Processing Addenda (DPA). Client system architecture documentation and audit artifacts are securely returned or destroyed upon conclusion of the engagement.
- Server Access Logs: Retained for a rolling period of 30 days strictly for threat detection and access auditing, after which logs are automatically overwritten.
05 Reasonable Security Safeguards (Section 8(5))
To prevent personal data breaches, unauthorized disclosure, or alteration, Kavach Privacy enforces technical security controls aligned with Section 8(5) of the Act:
- Transport Layer Security: All data transmitted to and from our domain is encrypted in transit using modern TLS 1.3 cryptographic protocols with HSTS preloading.
- Zero Third-Party Data Sharing: We do not embed Facebook Pixels, Google Analytics Remarketing trackers, heatmaps, or third-party behavioral telemetry that transmits your data to data brokers.
- Restricted Least-Privilege Access: Lead submissions and diagnostic inputs are accessible strictly to authorized senior privacy engineers bound by non-disclosure agreements.
- Breach Orchestration Protocol: In the unlikely event of a personal data breach impacting your information, we maintain internal incident response runbooks to notify the Data Protection Board of India (DPBI) and affected Data Principals within the statutory timelines prescribed under DPDP Rule 7.
06 Statutory Rights of the Data Principal
Under Chapter III (Sections 11 through 14) of the DPDPA 2023, you enjoy full statutory control over your personal data:
🔍 Right to Access (Sec 11)
Request a summary of personal data being processed, a list of identities of all Data Fiduciaries/Processors with whom it has been shared, and any other processing information.
✏️ Right to Correction (Sec 12)
Request correction of inaccurate or misleading personal data, completion of incomplete records, or updating of changing business information.
🗑️ Right to Erasure (Sec 12)
Request the complete deletion of your personal data when it is no longer necessary for the purpose for which it was collected or upon withdrawal of consent.
👥 Right to Nominate (Sec 14)
Nominate any individual who shall, in the event of death or incapacity of the Data Principal, exercise statutory rights on your behalf.
To exercise any of these rights, send an email to grievance@kavachprivacy.in. In accordance with DPDP Rule 13, all requests will be verified and processed free of charge.
07 Designated Grievance Redressal Officer (Section 8(9))
In accordance with Section 8(9) of the DPDPA and Rule 14 of the DPDP Rules 2025, Kavach Privacy has appointed a designated Grievance Redressal Officer to address all queries, rights requests, and data protection complaints:
🛡️ Office of the Data Protection & Grievance Officer
The designated officer handles all inquiries related to data processing, consent withdrawal, erasure requests, and statutory DPDPA compliance matters.
08 Right to Approach the Data Protection Board of India (DPBI)
In accordance with Section 13(3) of the Act, if you do not receive a resolution from our Grievance Redressal Officer within the statutory timeline (or if you are dissatisfied with the resolution provided), you have the unalienable statutory right to file a formal complaint before the Data Protection Board of India (DPBI):
Data Protection Board of India (DPBI)
Ministry of Electronics and Information Technology (MeitY), Government of India
New Delhi, Republic of India • Statutory Forum under Section 18, DPDPA 2023
09 Updates & Amendments to this Notice
As MeitY notifies further statutory guidelines, standard contractual clauses, or procedural schedules under the DPDP Rules 2025, we will update this notice accordingly. The revised notice will be published on this page with an updated "Effective Date". Material amendments impacting active advisory clients will be communicated directly via registered email.