DPDPA Compliance

Our role

Data Fiduciary for the business data you give us directly (your name, business details, brand assets).

Data Processor for the customer data you upload via the Customer Data Gateway — you remain the Data Fiduciary for your customers.

Consent architecture

We require explicit, granular, informed consent at every collection point. We don't assume consent from continued use or pre-checked boxes. Section 5 notices are built into every consent flow, with the specific purpose, data categories, and retention period stated clearly.

Your customer data — your responsibility

When you upload customer contact data to the Customer Data Gateway, you confirm you have explicit consent from each customer for the specific use (marketing messages, birthday wishes, win-backs). MMS doesn't pre-validate that consent — under DPDPA, that's the Data Fiduciary's obligation.

Data Principal rights

Your customers exercise their rights through you (their Data Fiduciary). We propagate erasure requests across our systems within 72 hours of your relayed request.

Breach notification

If we detect a personal-data breach affecting your data, we notify you within 72 hours and follow our runbook to inform the Data Protection Board of India as required.

Cross-border transfers

Our infrastructure runs primarily in Indian data regions. Some third-party APIs (fal.ai, Google, Meta) may process data outside India per their own published policies — these are listed in our Privacy Policy.

Sub-processors (named for transparency)

For service delivery and DPDPA transparency, our processors include: Google Business Profile API, Meta (WhatsApp Business API), GoHighLevel, fal.ai, Razorpay, Google Analytics (only after cookie consent), Cloudflare, and our database systems. Named deliberately — DPDPA transparency requires disclosure.

The Empowerment Principle

No third-party passwords stored. Ever. We act through official APIs only — so your accounts, and your customers' trust, stay yours.

Data Processing Agreement

A DPA template is available on request for customers who need formal execution.

Grievance officer

Shiva Shankar R is the appointed Grievance Officer under the DPDPA.

For any question, concern, or complaint about how personal data is handled — yours or your customers' — write to grievance@itsinfraindia.com. Every grievance is acknowledged and handled within the timelines the Act and its rules prescribe.

Pending counsel (binding text)

Final DPDPA-binding language — Data Protection Board engagement and consent-withdrawal mechanics — to be drafted by counsel.

Company details