DPDP Act Compliance

Code Kumite is committed to full compliance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). This page explains how the DPDP Act applies to our handling of personal data and the rights available to you as a Data Principal.

1. Our Role

Where we collect and use personal data for our own purposes (e.g. website visitors, prospective clients, job applicants), we act as a Data Fiduciary under the DPDP Act. Where we process personal data on your behalf in the course of delivering a software or automation engagement (e.g. your customer records within a CRM we build for you), you are the Data Fiduciary and we act as a processor under your instructions, as set out in the applicable SOW.

2. Lawful Basis for Processing

We process personal data only where we have a valid lawful basis under the DPDP Act, including your explicit consent, performance of a contract with you, and other "certain legitimate uses" recognized under the Act (such as responding to a request you initiate, or complying with a legal obligation).

3. Consent

Where we rely on consent, we seek it through clear, specific, and informed notice describing the personal data to be collected and the purpose of processing, in accordance with Section 6 of the DPDP Act. You may withdraw consent at any time with the same ease with which it was given, by contacting us at info@codekumite.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4. Data Principal Rights

As a Data Principal under the DPDP Act, you have the right to:

• Access — obtain a summary of the personal data we hold about you and the processing activities carried out on it
• Correction and completion — request correction of inaccurate or incomplete personal data
• Erasure — request erasure of personal data that is no longer necessary for the purpose it was collected, subject to legal retention requirements
• Grievance redressal — raise a grievance regarding our handling of your personal data and receive a response within the timeframe prescribed by law
• Nominate — nominate another individual to exercise these rights on your behalf in the event of your death or incapacity

To exercise any of these rights, email info@codekumite.com with the subject line "DPDP Data Principal Request."

5. Data Fiduciary Obligations

As a Data Fiduciary, we:

• Process personal data only for the purpose for which it was collected, or a purpose you would reasonably expect
• Implement reasonable security safeguards to prevent personal data breaches, including encryption, access controls, and monitoring
• Notify affected Data Principals and the Data Protection Board of India of any personal data breach as required under the Act
• Maintain accurate and up-to-date personal data where it is used to make a decision affecting you or is disclosed to another Data Fiduciary
• Ensure any processor we engage to process personal data on our behalf does so under a valid contract and adequate safeguards

6. Cross-Border Data Transfers

Where personal data is transferred outside India (for example, to a cloud hosting provider), we take reasonable steps to ensure it continues to receive protection consistent with the DPDP Act, except where the Central Government has restricted transfer to a specific country or territory.

7. Data Retention and Erasure

We retain personal data only as long as necessary for the purpose it was collected or as required by applicable law, and we take reasonable steps to erase personal data once it is no longer necessary, unless retention is required for legal compliance.

8. Grievance Redressal

If you have a grievance regarding how we have handled your personal data, contact our Grievance Officer at info@codekumite.com. We will acknowledge your grievance and respond within the timeframe prescribed under the DPDP Act. If you are not satisfied with our response, you have the right to file a complaint with the Data Protection Board of India.

9. Related Policies

This page should be read together with our Privacy Policy and Terms of Service, which describe our broader data handling and contractual practices.