Privacy Policy

1. Introduction

ConsentFirst ("we," "us," or "our") operates the ConsentFirst platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian laws.

2. Data We Collect

We may collect the following categories of personal data:

• Account Information: Name, email address, phone number, company name, and job title when you register for our Service.
• Usage Data: Information about how you interact with the platform, including pages visited, features used, and session duration.
• Consent Records: Data related to consent management activities performed through our platform on behalf of your organization.
• Communication Data: Messages you send through our contact forms, support channels, or emails.
• Technical Data: IP address, browser type, device information, and cookies as described in our Cookie Policy.

3. Purpose of Processing

We process your personal data for:

• Providing and maintaining the ConsentFirst platform
• Account creation and authentication
• Customer support and communication
• Analytics and service improvement
• Legal compliance, including DPDP Act obligations
• Billing and payment processing

4. Lawful Basis

Under the DPDP Act, we process your data based on: (a) your explicit consent, (b) contractual necessity for providing our Service, and (c) legitimate legal obligations including compliance with Indian regulatory requirements.

5. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy, or as required by law. Consent records managed through our platform are retained as per the data retention policies configured by the respective data fiduciary (your organization).

6. Your Rights Under DPDP Act

As a data principal, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your personal data
• Withdraw consent at any time
• Nominate a representative to exercise your rights
• File a grievance regarding data processing

7. Data Security

We implement industry-standard security measures including encryption at rest and in transit, access controls, regular security audits, and incident response procedures to protect your personal data against unauthorized access, alteration, or destruction.

8. Cross-border Data Transfers

We process data primarily within India. Where cross-border transfers are necessary, we ensure compliance with DPDP Act provisions and transfer data only to jurisdictions approved by the Central Government.

9. Grievance Officer

For any privacy-related concerns or to exercise your rights, contact our Grievance Officer:

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on our platform and updating the "Last updated" date above.