Privacy Policy

1. Identity of the Data Fiduciary

Intricare Technologies
401-405 Lotus Elite, Gotri, Vadodara 390018, Gujarat, India
Grievance Officer: Arpan Shah
Email: [email protected]
Response time: Within 48 hours for acknowledgement; resolution within 30 days.

2. What Personal Data We Collect

We collect personal data in two capacities: as a Data Fiduciary for our own business operations, and as a Data Processor on behalf of businesses (our customers) that use SecureConsent to collect data from their end users (Data Principals).

2.1 Data we collect from business customers (Data Fiduciary capacity)

• Name, work email, phone number, company name
• Billing information (processed by our payment provider)
• Usage logs, API call metadata, and support communications

2.2 Data processed on behalf of our customers (Data Processor capacity)

When a business uses SecureConsent to manage consent for their end users, we process on the business's instructions:

• Name, phone number, email address of end users (Data Principals)
• Identity documents: Aadhaar numbers (masked), PAN copies, passport copies, address proofs
• Consent records: purposes granted or withdrawn, timestamps, IP addresses
• Documents uploaded by Data Principals to the SecureConsent vault

In this capacity, the business customer is the Data Fiduciary and SecureConsent acts as a Data Processor under a Data Processing Agreement.

3. Purposes and Legal Basis for Processing

Purpose	Legal basis under DPDP Act
Providing the SecureConsent service to business customers	Contract performance (Section 7(b))
Managing consent records for end users on behalf of businesses	Consent of the Data Principal (Section 7(a))
Sending transactional and product communications	Legitimate use (Section 7(f)) / Consent
Fraud prevention and security	Legitimate use (Section 7(f))
Legal compliance and responding to regulatory requests	Legal obligation (Section 7(e))
Analytics and service improvement (aggregated, non-identifiable)	Legitimate use (Section 7(f))

We do not sell personal data to any third party. We do not use personal data for advertising purposes.

4. Data Storage and Security

• All personal data is stored in India on AWS Mumbai region (ap-south-1), a MeitY-empanelled cloud service provider.
• Identity documents are encrypted at rest using AES-256. Consent records are cryptographically signed with SHA-256 proof hashes.
• Access to personal data is restricted to authorised personnel and subject to role-based access controls.
• We maintain audit logs of every access to personal data, including who accessed it, when, and for what purpose.
• In the event of a personal data breach, we will notify the Data Protection Board of India within 72 hours and affected Data Principals without undue delay, as required under DPDP Rules 2025.

5. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected:

• Consent records: retained for the duration of the business relationship plus 7 years (for audit purposes), unless a shorter period is mandated by applicable law.
• Identity documents: retained until the Data Principal withdraws consent or requests deletion, at which point a Certificate of Deletion is issued.
• Business customer data: retained for the duration of the contract plus 3 years.
• Log data: retained for 90 days.

6. Rights of Data Principals

Under the DPDP Act 2023, you have the following rights regarding your personal data:

• Right to Access (Section 11): Know what personal data we hold about you, the processing purposes, and whether it has been shared with other entities.
• Right to Correction and Erasure (Section 12): Correct inaccurate or incomplete personal data, and request erasure of data that is no longer necessary.
• Right to Grievance Redressal (Section 13): Lodge a complaint with our Grievance Officer. If unresolved within 30 days, you may escalate to the Data Protection Board of India.
• Right to Nominate (Section 14): Nominate another individual to exercise your rights in the event of your death or incapacity.
• Right to Withdraw Consent: Withdraw consent for any purpose at any time through the SecureConsent portal. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, contact our Grievance Officer: [email protected]

7. Sharing of Personal Data

We do not share personal data with third parties except as follows:

• Service providers: Cloud hosting (AWS), payment processing, and email delivery vendors under contractual data processing agreements.
• Business customers: When acting as a Data Processor, we share the data we hold on a business's behalf back to that business per their instructions.
• Legal requirements: When required by law, court order, or the Data Protection Board of India.

We do not transfer personal data outside India without explicit consent or a valid cross-border data transfer mechanism as specified under DPDP Rules.

8. Children's Data

SecureConsent is designed to help businesses comply with the DPDP Act's requirements for processing personal data of children (individuals under 18 years of age). We require business customers using our EdTech and Schools module to:

• Obtain verifiable parental consent before processing a child's data.
• Not undertake behavioural tracking of children.
• Not target children with advertising.
• Process only data that is necessary for the stated educational purpose.

We do not knowingly collect personal data from individuals under 18 in our own capacity as a Data Fiduciary.

9. Cookies and Tracking

Our website uses minimal, essential cookies only:

• Session cookies: To maintain your login state in the SecureConsent dashboard.
• Preference cookies: To remember your language and theme preferences.

We do not use advertising cookies, cross-site tracking, or third-party analytics that collect personally identifiable information.

10. Grievance Redressal Mechanism

If you have any complaint or concern regarding the processing of your personal data, contact:

If your grievance is not resolved within 30 days, you may escalate to the Data Protection Board of India once it is constituted and operational under the DPDP Rules 2025.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to registered business customers and by a notice on this page. The effective date at the top of this page will be updated. Continued use of SecureConsent after any changes constitutes acceptance of the revised policy.

12. Contact Us

For any questions about this Privacy Policy or our data practices:
Email: [email protected]
Post: Intricare Technologies, 401-405 Lotus Elite, Gotri, Vadodara 390018, Gujarat, India