Privacy Policy

Last updated: 1 August 2026

1. Who We Are

DPDPA CMS (dpdpacms.com) is a self-hosted compliance software product operated by DPDPA CMS [Entity Name]. We exist to help organisations comply with India's Digital Personal Data Protection Act, 2023 ("DPDPA 2023") and we take privacy seriously in our own operations.

For any privacy matter, contact us at hello@dpdpacms.com.

2. What Personal Data We Collect

We collect only what we need.

From our contact form:

  • Your name
  • Your work email address
  • Your organisation name
  • A message describing your compliance situation (optional)

From website analytics (Google Analytics 4):

  • Pages visited and time spent on each page
  • Browser type and approximate device category
  • Approximate geographic location (country and region only)
  • Referring website or search term

We do not collect financial information, sensitive personal data, or any data beyond what is described above.

3. Why We Collect It

Contact form data is collected solely to respond to your preview or trial request and to communicate with you about setting up DPDPA CMS in your environment.

Analytics data is collected to understand how visitors use our site and to improve content and user experience. We do not use analytics data to profile individual visitors.

4. Legal Basis for Processing

Under the DPDPA 2023, we process personal data on the following bases:

  • Consent: Contact form submissions are processed on the basis of your consent given when you submit the form.
  • Legitimate interests: Website analytics are processed on the basis of our legitimate interest in understanding and improving site usage.

You may withdraw consent at any time by emailing hello@dpdpacms.com. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. Third-Party Processors

We share data with the following processors. We do not sell, rent, or trade personal data.

ProcessorPurposePrivacy policy
Web3Forms Receives and forwards contact form submissions to our inbox web3forms.com/privacy
Google Analytics 4 Website usage analytics policies.google.com/privacy
Cloudflare Pages Website hosting and content delivery cloudflare.com/privacypolicy

6. Cookies

Google Analytics sets cookies in your browser to distinguish returning visitors and measure usage patterns. We do not set advertising, tracking, or session cookies of our own.

You can opt out of Google Analytics at any time by adjusting your browser cookie settings or using Google's opt-out browser add-on.

7. How Long We Keep Your Data

  • Contact form submissions are retained for up to 24 months from the date of submission, or until you request deletion, whichever comes first.
  • Analytics data is subject to Google's retention settings (default: 14 months).

8. Your Rights Under the DPDPA 2023

As a Data Principal under the DPDPA 2023, you have the following rights:

  • Right to access: Request a summary of the personal data we hold about you and the purposes for which it is processed.
  • Right to correction: Ask us to correct inaccurate or incomplete personal data.
  • Right to erasure: Ask us to erase your personal data, subject to any legal obligation that requires us to retain it.
  • Right to withdraw consent: Withdraw consent at any time without affecting prior processing.
  • Right to grievance redressal: Raise a complaint about how we handle your data (see Section 12 below).
  • Right of nomination: Nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, email hello@dpdpacms.com with the subject line "DPDPA Data Request". We will acknowledge your request promptly and respond within the timeframes required by the DPDPA 2023 and associated rules.

9. Cross-Border Data Transfers

Contact form data is processed by Web3Forms, which may store or process data outside India. Analytics data is processed by Google on its global infrastructure. We take reasonable steps to ensure these processors maintain appropriate security and privacy standards. Where the DPDPA 2023 rules on cross-border transfers apply, we will comply with them.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. Our website is served over HTTPS via Cloudflare Pages. Contact form data is transmitted securely to Web3Forms. We review our security practices periodically.

11. Minors

Our website and services are directed at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

12. Grievance Officer

For privacy complaints or grievance escalation under the DPDPA 2023, contact our Grievance Officer:

Email: hello@dpdpacms.com
Subject: "DPDPA Privacy Grievance"

We will acknowledge your grievance within a reasonable time and aim to resolve it promptly. If you are not satisfied with our response, you may approach the Data Protection Board of India once it is constituted and operational.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. For material changes, we will notify active users and customers by email. Continued use of the site after the effective date constitutes acceptance of the revised Policy.