Privacy notice

Written to Rule 3 of the DPDP Rules 2025, which is the standard we hold our clients to. Itemised, in plain words, and honest about the little we hold.

Last updated 8 September 2026. The Data Fiduciary is Infinitra Innovations, which operates dpdp-compliance.com. Write to us at help@theinfinitra.com.

What we hold, and why

Rule 3(b) says a notice must itemise the personal data and give the purpose for each item. Here is ours, in full. The first row is the important one: the Score Check itself sends us nothing.

What Why On what footing How long

Your answers to the Score Check To compute your exposure and show it to you. These never reach us. The check runs in your browser and the answers are held in that tab's session storage until you close it. Not processed by us at all. Until you close the tab. Nothing is sent to any server.

Your email address To send you the one-page summary you asked for, and occasional notes when the law changes. Your consent, given by ticking the box on the result page. 24 months from your last interaction, or until you withdraw, whichever is first.

The numbers from your result, your answer to “has anyone asked you about DPDP”, and the campaign tag in the link you arrived on To put the summary together, and to know which of our own links bring people who find the check useful. Your consent, the same tick. 24 months, with the email address, and erased at the same time.

Your name, work email, organisation and preferred times when you ask for a call, and your Score Check result if you had one open To offer you times and to read your result before the call, so we do not spend the first ten minutes on questions you have already answered. Your consent, given by ticking the box on the form. 24 months after the call, unless you become a client and a contract governs it.

Anything you write to us at help@theinfinitra.com To answer you. Necessary to answer the message you sent. 24 months.

Web server access logs None — we do not keep any. Access logging is switched off on the content delivery network that serves this site, so no record of your visit, your IP address or the pages you read exists anywhere. Not collected. Not applicable.

Who writes to you, and from where

Mail from this site is sent by hello@dpdp-compliance.com, which is the address AWS Simple Email Service has verified and signs for. Replies to it reach help@theinfinitra.com, which is where a person reads them.

What we do not do

We set no cookies. There is no cookie banner because there is nothing to consent to.
We keep no access logs. The only thing our host reports to us is an aggregate count of requests and errors, with nothing in it about a person.
There are no third-party scripts, no advertising pixels, no session recording and no chat widget. No page on this site makes a request to any other company's server, at any point.
Fonts are served from this site, not from a font network.
Analytics, if we turn any on, will be cookieless and aggregate — page counts, nothing about a person and nothing about an answer. This notice will say so before it happens.

Where it is

The site and everything we store are hosted in the AWS Asia Pacific (Mumbai) region. The calendar and the email service we use are named above; if either processes your data outside India we will say so here before it does.

Withdrawing your consent

Every email we send has a one-click unsubscribe, which withdraws your consent and erases your email and result together. You can also write to help@theinfinitra.com and ask us to erase what we hold; we do it within seven days and confirm. Withdrawing is as easy as consenting was, which is what section 6(6) of the Act requires.

Your rights

You can ask us what we hold about you, ask us to correct it, ask us to erase it, and nominate someone to exercise these rights if you cannot. Write to help@theinfinitra.com. We answer within 90 days, and usually within a week.

Complaining to the Board

Write to help@theinfinitra.com and we will treat it as a grievance. Rule 14(3) requires us to publish the period we answer within, and ours is ninety days, which is the longest the rule allows; in practice it is far sooner. We are not a Significant Data Fiduciary, so we are not required to appoint a Data Protection Officer — that address reaches the people who can actually act on the complaint, which is what section 8(9) of the Act asks for. If we do not answer, or the answer does not satisfy you, you can complain to the Data Protection Board of India; the Act expects you to raise it with us first and give us a chance to fix it.

Children

This site is not aimed at anyone under 18 and we do not knowingly collect a child's personal data. If you believe we hold any, write to us and we will erase it.

The obligations this notice is written to are in Rule 3, section 5 and section 6 of the Act. They are on this site verbatim, which is the point.