Back to Trust Center
Ref 5b
India DPDPA Compliance Notice
Indus AI Pvt. Ltd. is incorporated in India and is a Data Fiduciary under the Digital Personal Data Protection Act, 2023. This notice sets out how we approach notice, consent, individual rights, and children’s data. It is distinct from the Gulf PDPL notice: the DPDPA uses different terminology, a different age threshold, and a different regulator.
Purpose
State how IndusLabs meets its obligations as a Data Fiduciary under India’s Digital Personal Data Protection Act, 2023.
Scope
- Personal data of Data Principals in India processed through our website, platform, APIs, and voice workflows.
- Our role as Data Fiduciary for account, billing and website data, and as a processor acting on customer instructions for call content.
- Public notice and consent mechanisms published on induslabs.io.
Published Commitments
- Notice under s.5 is given before or at the point of collection, in plain language, itemising the personal data collected and the purpose. The enquiry form carries its own notice at the point of collection rather than relying only on the Privacy Policy.
- Consent is free, specific, informed, unconditional and unambiguous, with a clear affirmative action. Analytics consent is requested separately from any other purpose, and declining it does not affect access to the site.
- Withdrawal of consent is as easy as giving it — the same footer control both grants and withdraws — and withdrawing analytics consent also removes the analytics identifiers already stored on the device.
- Enquiry data is bound to answering the enquiry. Marketing would require separate consent for that stated purpose.
- Rights under s.11 to s.14 — access, correction, erasure, grievance redressal, and nomination of another person to act on a Data Principal’s behalf — are described in the Privacy Policy with a contact route.
- A Grievance Officer is published under s.13 and reachable at hello@induslabs.io.
- A child under the DPDPA is anyone under 18. We do not knowingly process children’s personal data without verifiable parental or guardian consent, and we do not carry out behavioural monitoring or targeted advertising directed at children, which s.9 prohibits outright.
- Cross-border transfer is permitted under s.16 except to countries the Central Government restricts by notification. We track those notifications and our subprocessor locations against them.