Data Protection and DPDP Act (India)

The law in short

India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it set duties for those who handle digital personal data. The obligations phase in through 2027, so some provisions apply later than others. We will update this page as they take effect. We do not state commencement dates here, so please check official government sources.

Roles: fiduciary and processor

For our own account, billing and website data, ConvoBox decides the purpose and acts as a fiduciary. That is covered in the Privacy Policy.

What business customers must do

Because the business is the data fiduciary, it is responsible for:

• Having a lawful basis, such as clear consent, before it messages anyone
• Giving a clear notice about what data it collects and why, including the business name and purpose
• Recording opt-ins and honouring opt-outs and consent withdrawal quickly
• Collecting only the data it needs and keeping it accurate
• Answering requests from its own customers
• Telling affected people and the authorities where the law requires it

See the Acceptable Use and WhatsApp Messaging Policy for opt-in rules.

Rights of data principals

Under the DPDP Act, a data principal has the right to:

• Access information about their personal data and how it is processed
• Correct, complete or update their data
• Ask for erasure of data that is no longer needed or consent was withdrawn
• Have a grievance redressed
• Nominate another person to exercise rights in case of death or incapacity

Withdrawing consent should be as easy as giving it.

How to exercise your rights

1. If your data is in a business's ConvoBox account, first contact that business. It is the data fiduciary.
2. You can also write to info@convobox.in with your name, the phone number or email involved, and what you want. We may ask you to verify your identity.
3. Where ConvoBox is the processor, we pass the request to the business and assist it as set out in the Data Processing Terms.
4. For our own account data, we respond directly.
5. For complaints, see Grievance Redressal.

Retention and deletion

We keep data only as long as needed for the service, for legal obligations and for billing. When a business account ends, customer contact data is returned or deleted as described in the Data Processing Terms and the Privacy Policy, unless the law requires us to keep it.

Personal data breaches

If we become aware of a personal data breach affecting data we process for a business, we will tell that business without undue delay, and work with it on the steps that applicable law requires. For our own data, we will notify affected people and authorities as applicable law requires.

Where data is processed

ConvoBox uses cloud hosting and other service providers, and WhatsApp messages travel through Meta's infrastructure. Hosting and processor locations are available on request at info@convobox.in.

Children

ConvoBox is for businesses and is not meant for people under 18. The DPDP Act has extra duties for the data of children. Businesses must not use ConvoBox to message children without meeting those duties.

Important note

This page is general information about how ConvoBox approaches data protection. It is not legal advice, and it does not replace advice for your own business. Business customers should take their own advice on their DPDP duties.