// legal
DPDPA Compliance Policy
This policy explains how CircuitNova complies with India’s Digital Personal Data Protection Act, 2023 (DPDPA) and outlines the rights of Data Principals (individuals whose data is processed).
1. Data Fiduciary
CircuitNova is the Data Fiduciary responsible for determining the purpose and means of processing personal data collected through this website and associated applications.
- Name: CircuitNova
- Contact: [hello@circuitnova.studio]
- Address: [Your Address, City, State, PIN – India]
2. Grievance Officer
Under Section 13 of the DPDPA, we have designated a Grievance Officer to address concerns related to personal data processing:
- Name: [Grievance Officer Name]
- Email: [grievance@circuitnova.studio]
- Address: [Your Address, City, State, PIN – India]
- Response time: We aim to acknowledge grievances within 48 hours and resolve them within 30 days
3. Personal Data We Process
| Category | Examples | Source |
|---|---|---|
| Contact information | Name, email address | Contact form |
| Communication content | Messages sent via contact form | Contact form |
| Device / usage data | Browser, anonymised IP, pages visited | Automatic (analytics) |
We process only the minimum data necessary for the stated purpose (data minimisation principle).
4. Purposes of Processing
- Responding to enquiries: Processing contact form submissions to answer questions about our services.
- Improving the website: Anonymised analytics to understand usage patterns.
- Legal compliance: Retaining records where required by applicable law.
We do not process personal data for automated decision-making or profiling.
5. Lawful Basis — Consent
Under the DPDPA, we process personal data on the basis of your free, specific, informed, and unambiguous consent obtained at the point of data collection (e.g., submitting the contact form).
You may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
6. Rights of Data Principals
As a Data Principal under the DPDPA, you have the following rights:
6.1 Right to Access Information
You may request details of the personal data we hold about you and how it is processed.
6.2 Right to Correction and Erasure
You may request correction of inaccurate or misleading personal data, or erasure of data no longer required for the original purpose.
6.3 Right to Grievance Redressal
You may file a grievance with our Grievance Officer (Section 4 above). If unsatisfied with the resolution, you may escalate to the Data Protection Board of India once it is constituted.
6.4 Right to Nominate
You may nominate another individual to exercise your rights in the event of your death or incapacity.
To exercise any right, contact our Grievance Officer at [grievance@circuitnova.studio].
7. Data Retention
| Data | Retention Period |
|---|---|
| Contact form data | Up to 12 months after last interaction |
| Analytics data | 30 days (anonymised) |
| Legal/compliance records | As required by law |
After the retention period, data is securely deleted or anonymised.
8. Cross-Border Data Transfers
Some of our service providers (e.g., Formspree for form processing, Vercel for hosting) may process data outside India. Such transfers occur only to countries notified by the Central Government under the DPDPA as providing adequate data protection, or subject to contractual safeguards.
9. Security Safeguards
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS) and access controls on data processors.
10. Children’s Personal Data
We do not knowingly collect personal data from children under 18 years of age. If a child’s data is submitted, we will process it only with verifiable parental or guardian consent as required under the DPDPA. If you believe a child has submitted data without appropriate consent, contact us immediately for erasure.
11. Consent Management
When you submit the contact form, you provide consent to the processing described in this policy. A consent notice is displayed at the point of collection. You may withdraw consent at any time by emailing [hello@circuitnova.studio].
12. Data Protection Officer (DPO)
CircuitNova is a small business and may not be required to appoint a DPO under the DPDPA. However, our Grievance Officer (Section 2) handles all data protection enquiries with equivalent responsibility.
13. Updates to This Policy
We will update this Policy to reflect changes in the DPDPA rules, government notifications, or our processing activities. Material changes will be notified via the website. The “Last Updated” date at the top reflects the most recent revision.
14. Filing a Complaint
If you believe your rights under the DPDPA have been violated and our Grievance Officer has not resolved your concern satisfactorily, you may file a complaint with the Data Protection Board of India (once operational) at the address/portal notified by the Ministry of Electronics and Information Technology (MeitY).