Privacy Policy & Data Principal Notice

1. Statutory Notice & Itemised Data Collection (Section 5, DPDP Act)

In accordance with Section 5 of the DPDP Act, this Notice informs you of the specific categories of digital personal data collected, the specific purposes of processing, and your rights as a Data Principal:

2. Consent Mechanism & Right of Withdrawal (Section 6, DPDP Act)

Under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional, and unambiguous with clear affirmative action:

• When you submit an email, inquiry form, or sign a service proposal, you provide explicit, affirmative consent for DGson to process your details for that specified business purpose.
• Ease of Withdrawal: You have the absolute statutory right to withdraw your consent at any time. As required by Section 6(4), the ease of withdrawing consent is comparable to the ease with which it was given.
• To withdraw consent, simply email our Grievance Officer at digital.pranav@yahoo.com or message WhatsApp at +91 73502 54181 with the subject "Withdrawal of Consent".
• Upon receipt, DGson and any authorized third-party processors will immediately cease processing your personal data, unless continued retention is required under statutory Indian tax or corporate laws.

3. Cookies & Preference Management

We deploy transparent cookie controls on digitalsoan.com:

• Essential Cookies: Strictly necessary for website navigation, load balancing, and anti-abuse security. These do not require non-essential tracking consent.
• Analytics & Performance Cookies: Used to understand site performance, bounce rates, and calculator engagement (e.g. Vercel Analytics). These are activated only in accordance with your consent preferences.
• You can update your cookie preferences at any time using our on-page cookie banner or through your browser settings.

4. Data Processors & Third-Party Transfers

DGson does NOT sell, rent, trade, or monetize your personal data to any data brokers or advertisers.

We only share necessary data with trusted Data Processors operating under strict confidentiality and DPDP-compliant data processing agreements:

• Hosting & Cloud Infrastructure: Vercel Inc., Amazon Web Services (AWS).
• Advertising & Growth Networks: Meta Business Suite, Google Cloud, LinkedIn Marketing Solutions (strictly for client-approved campaigns).
• Communication Gateways: WhatsApp Cloud API / Kapso / Interakt for client messaging.
• Payment Processors: Razorpay / Cashfree Payments for secure, PCI-DSS compliant transactions.

5. Cross-Border Data Transfers (Section 16, DPDP Act)

DGson processes and stores data on secure servers. Any transfer of digital personal data outside India is conducted strictly in accordance with Section 16 of the DPDP Act, ensuring that data is never transferred to any foreign country or territory restricted by the Central Government of India through official notification.

6. Protection of Children's Personal Data (Section 9, DPDP Act)

In strict adherence to Section 9 of the DPDP Act:

• DGson's digital marketing, e-commerce, and software services are exclusively intended for commercial enterprises, business professionals, and individuals aged 18 and older.
• We do not knowingly solicit or collect personal data from children under the age of 18 without verifiable parental/guardian consent.
• We strictly prohibit tracking, behavioral monitoring, or targeted advertising directed at children.

7. Security Safeguards & Breach Protocol (Section 8, DPDP Act)

DGson implements reasonable security safeguards to prevent personal data breaches:

• Encryption: Industry-standard TLS 1.3 encryption in transit for all web interactions and AES-256 encryption at rest.
• Access Control: Strict least-privilege role-based access controls for client ad accounts and databases.
• Breach Notification: In the unlikely event of a personal data breach affecting your information, DGson will promptly notify the Data Protection Board of India (DPBI) and each affected Data Principal in such form and manner as prescribed under Section 8(6) of the DPDP Act.

8. Rights of the Data Principal (Sections 11–14, DPDP Act)

As a Data Principal in India, you are vested with the following statutory rights:

9. Data Retention & Mandatory Statutory Records

Personal data is erased once the specified purpose of collection is fulfilled or upon consent withdrawal. However, under Section 8(7) of the DPDP Act, retention is legally maintained for:

• GST tax invoices, payment records, and contract agreements are retained for 5 to 7 years strictly in compliance with Section 44AA of the Indian Income-tax Act, 1961 and Section 36 of the CGST Act, 2017.
• Marketing inquiries without active contracts are permanently purged after 12 months.