Privacy notice

DPDP Done is an audit engine operated by Cyber Vigilance Group. For the personal data in your account we are the Data Fiduciary: we decide why it is processed and how.

For the records you upload about your own clients and their people, you are the Data Fiduciary and we are your Data Processor. We process that data only on your instructions, and we do not use it for our own purposes.

Account data: your name, email address, the organisation you belong to, your user identifier, and your authentication records.

Engagement records: the names of organisations you audit, the scope of the audit, the answers you record, the findings you raise, and the remediation you plan.

Evidence artefacts: the documents you choose to attach, and a SHA-256 hash of each. The hash lets anyone prove a document has not changed; it does not let anyone read the document.

Report records: the report identifier, the signature, the hashes and the registry status. The report body and your evidence are not held in the report registry.

Usage and billing data: how much of your plan you have used, and payment records.

Technical data: logs, device and network information used to keep the service secure.

Analytics: our own analytics, self-hosted on our own infrastructure, with no third party involved. It sets no cookies and stores no IP address or identifier. On the public pages only, we also record anonymous interaction data — clicks and scrolling — with form inputs and on-page text masked. We do not record this on your dashboard, the founders' console, the auditee portal or the sign-in pages.

To create and secure your account, and to give you the audit engine, the dashboard and the report registry.

To produce, sign and register a certified report when you ask us to, and to let anyone you share it with verify it.

To give you support, and to detect and prevent misuse, fraud and security incidents.

To meter your plan, to invoice you and to collect payment.

To meet our legal and tax obligations.

We ask for your consent with a clear affirmative action. We do not use pre-ticked boxes, and we do not treat silence or a continued use of a page as consent.

You may withdraw your consent at any time, in the same way you gave it and just as easily, using the withdraw consent link at the top of this notice, or by writing to privacy@dpdpdone.com. Withdrawal is not conditioned on anything else.

If you withdraw consent, we stop the processing that relied on it. A certified report that has already been issued stays verifiable, because verification is what the recipient relies on; the report registry holds only hashes. You may ask us to stop issuing and to close the account.

Where we act as your Data Processor, you give us instructions for your clients' data. You must have your own lawful basis and your own notice for that data.

You have the right to access a summary of the personal data we hold about you and how we process it.

You have the right to correction, completion and updating of your personal data.

You have the right to erasure, subject to the law.

You have the right to grievance redressal, and you have the right to nominate another person to exercise your rights if you die or become incapable.

To exercise any of these, write to privacy@dpdpdone.com or use the rights request form. We acknowledge within 72 hours and aim to resolve within 30 days. We do not charge for this.

If you are not satisfied, you may complain to the Data Protection Board of India.

We use a small number of processors to run the service: an authentication provider, a hosting provider, an email provider, and — once payments go live — a payment provider. Each is bound by contract to process personal data only on our instructions.

We never sell personal data, and we do not use your client evidence or report bodies for advertising or for training our own models.

We may disclose data where the law requires it, and we will tell you unless we are legally barred from doing so.

The service runs on servers we control. Data may be processed outside India; where it is, the processing is subject to the conditions the Central Government notifies under the Act. We will publish the current locations before paid service begins.

Account data: while your account is active, and for 12 months after it is closed.

Engagement records and evidence artefacts: for as long as you keep the engagement, and for 12 months after you close it, unless you delete them sooner.

Report registry records and signature hashes: kept for as long as we offer verification, so that a report you have shared stays provable. This record is a hash, not the report.

Billing and tax records: for the period Indian tax law requires, currently eight years.

Technical logs: 90 days.

The service is for professional use and is not directed at children. We do not knowingly process the personal data of a child. If you believe a child's data has reached us, write to privacy@dpdpdone.com and we will delete it.

Access is authenticated, each firm's data is isolated from every other firm's, reports are signed and their integrity is verifiable, and access to production systems is restricted. No system is perfectly secure, but we design so that a compromise is detectable and limited.

If we change how we process personal data, we will tell you before the change takes effect, and where the change needs your consent we will ask for it again. The date below tells you which version you are reading.

Write to our Data Protection Officer at privacy@dpdpdone.com, or use the rights request form. We acknowledge within 72 hours and aim to resolve within 30 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India. The Board's information and its complaint route are published by MeitY, the ministry that administers the Act, at meity.gov.in/content/data-protection-board-india.