Privacy Policy

1. Who We Are — Data Fiduciary Identity

This Privacy Policy is published by Adynta Consulting ("Adynta", "Data Fiduciary", "we", "us") in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), which together form the primary framework governing personal data processing in India. The Information Technology Act, 2000 ("IT Act") and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules") are additionally referenced as a supplementary security baseline to the extent they remain applicable. The Information Technology (Intermediaries Guidelines and Digital Media Ethics Code) Rules, 2021 apply to the extent applicable to Adynta's platform operations.

Adynta Consulting is a regulatory intelligence and research platform operating adynta.com from Ahmedabad, Gujarat, India. Under the DPDP Act, Adynta is the Data Fiduciary responsible for determining the purposes and means of processing personal data of Data Principals ("you", "your") who access the Platform, subscribe to services, or contact Adynta.

This Policy applies to: website visitors; Platform subscribers; newsletter recipients; event registrants; and persons who contact Adynta by any means. For privacy matters: privacy@adynta.com. For grievances: grievance@adynta.com.

2. Consent Notice — How We Collect & Why

Before providing your personal data, please read this notice carefully. Under the DPDP Act and DPDP Rules, Adynta is required to provide you with a clear and itemised notice before or at the time of collecting your personal data, specifying:

• (a) Data Collected: Name, email address, mobile number, company, designation, physical address, account credentials (hashed), session tokens, usage behaviour, IP address, device identifiers, and any information voluntarily provided in contact forms or communications;
• (b) Purposes of Processing: Operating and delivering Platform services; account authentication and security; sending subscribed regulatory alerts and digests; responding to enquiries; improving Platform features; sending marketing communications (consent-based); and complying with legal obligations;
• (c) Your Rights: Right to access your data; right to correction and erasure; right to nominate a person to exercise your rights; right to grievance redressal; right to withdraw consent; and right to lodge a complaint with the Data Protection Board of India;
• (d) Withdrawal of Consent: You may withdraw consent at any time by contacting privacy@adynta.com. Withdrawal does not affect the lawfulness of processing before withdrawal but may affect Adynta's ability to provide certain services; and
• (e) How to Exercise Rights: Email privacy@adynta.com with subject "Data Rights Request" stating the right you wish to exercise and providing verification of your identity.

3. Personal Data We Process

We process the following categories of personal data:

We do not actively collect Sensitive Personal Data or Information (SPDI) as defined under the SPDI Rules through ordinary Platform use. Passwords are stored only as hashed values and are never stored in plaintext.

4. Lawful Basis for Processing

4.1 Consent: For newsletter subscriptions; marketing communications; and any processing for purposes beyond service delivery. Consent is obtained via clear affirmative action (opt-in checkbox or account creation confirmation). Consent is free, specific, informed, and unconditional as required under the DPDP Act. You may withdraw consent at any time via privacy@adynta.com or unsubscribe@adynta.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4.2 Certain Legitimate Uses (under DPDP Act 2023, Section 7): In addition to consent, Adynta processes personal data for the following specific grounds permitted under Section 7 of the DPDP Act, without requiring separate consent: (a) performance of a contract or subscription agreement to which the Data Principal is a party, or steps taken at the request of the Data Principal before entering into a contract; (b) compliance with any legal obligation to which Adynta is subject under Indian law; (c) responding to a medical emergency threatening the life of the Data Principal or another individual; and (d) for purposes of employment or professional engagement where the Data Principal is an employee, contractor, or applicant of Adynta. These are the specific statutory grounds under the DPDP Act and do not constitute a broad public-interest or balancing exception.

4.3 State Functions: Where Adynta processes personal data to assist governmental or regulatory bodies in the performance of their functions, processing may be authorised by applicable law as notified from time to time.

5. How We Use Your Personal Data

We use your personal data for the following purposes only:

• To create, operate, and maintain your Platform account and subscription;
• To authenticate your identity and maintain Platform security;
• To deliver regulatory intelligence, alerts, digests, and briefings you subscribe to;
• To respond to enquiries and provide customer support;
• To analyse and improve Platform performance, features, and user experience;
• To send marketing communications about Adynta's services (consent-based only; unsubscribe anytime via unsubscribe@adynta.com);
• To comply with applicable laws, regulations, court orders, and lawful government requests; and
• To detect, prevent, and investigate fraud, security incidents, and Platform misuse.

We do not use your personal data to: train AI or machine learning models without explicit consent; sell or rent data to third parties; share data with other subscribers; build advertising profiles; or allow third-party processors to use your data for their own model improvement or analytics beyond what is necessary to provide their contracted service to Adynta.

6. Data Sharing & Sub-Processors

Adynta does not sell personal data. We share personal data only with the following third-party service providers, each engaged under a written Data Processing Agreement (DPA) that restricts their use of your data to the service they provide to Adynta:

We may also disclose data: when required by applicable law, court order, or competent regulatory authority; in connection with a business transfer (with equivalent privacy protections); or to protect the rights, safety, or property of Adynta, our users, or the public.

7. Cross-Border Data Transfers

7.1 Adynta's primary data infrastructure is located in India (Supabase — Mumbai, AWS ap-south-1). Limited cross-border transfers occur via third-party sub-processors (Resend, Sentry, Twilio, Cloudflare, Google Analytics) whose infrastructure is located outside India.

7.2 All cross-border transfers of personal data are carried out in compliance with the DPDP Act, the DPDP Rules, and any restrictions or conditions notified by the Government of India from time to time. Where the Government of India restricts transfers to specific countries or territories, Adynta will comply with those restrictions. Adynta implements appropriate contractual and technical safeguards with sub-processors to protect personal data transferred outside India, and will update those safeguards as required when government notifications or rules change.

7.3 Cross-border transfers occur as part of Adynta's service delivery and are subject to the lawful basis described in Section 4. Where your consent is the lawful basis for the underlying processing, that consent extends to the transfer necessary to fulfil that purpose. Adynta does not rely on standalone transfer consent as a substitute for valid notice, purpose limitation, and processor controls.

8. Data Retention

We retain your personal data only for as long as necessary for the purpose for which it was collected, and no longer than required by applicable law. Records are retained only for the minimum period required by the purpose and applicable legal, tax, audit, or security obligations, and are securely deleted or anonymised after that period:

• Account data: duration of subscription + 12 months post-termination;
• Usage logs: 90 days, then aggregated and anonymised;
• Contact form submissions: 24 months;
• Newsletter records: until unsubscription + 30 days;
• Payment records: 7 years (Income Tax Act, 1961);
• Security and login logs: 12 months; and
• Data required for legal proceedings: until proceedings conclude and any applicable limitation period expires.

After the applicable retention period, personal data is securely deleted or anonymised in a manner that no longer identifies you. Adynta reviews retention practices periodically to ensure alignment with the DPDP Act and DPDP Rules as they are implemented.

9. Rights of Data Principals

Under the DPDP Act 2023 and applicable Indian law, you have the following rights:

• Right to Access: Request confirmation of whether we process your personal data, a summary of processing activities, and access to the data held about you;
• Right to Correction & Erasure: Request correction of inaccurate or incomplete data, or erasure of data that is no longer necessary or where consent has been withdrawn;
• Right to Grievance Redressal: Raise a grievance regarding Adynta's data processing practices with our Grievance Officer (Section 14);
• Right to Nominate: Nominate another person to exercise your rights in the event of your death or incapacity;
• Right to Withdraw Consent: Withdraw consent to processing at any time, subject to the consequences described in Section 2(d); and
• Right to Complain: Lodge a complaint with the Data Protection Board of India where you believe your rights have been violated.

Note on GDPR rights: Certain GDPR-specific rights (right to restriction, right to portability, right to object to legitimate interests) are not standalone rights under the DPDP Act 2023. Adynta will honour reasonable requests consistent with Indian law as it applies and evolves.

To exercise rights: email privacy@adynta.com with subject "Data Rights Request", including your full name and account email. We will respond within 30 days. Identity verification may be required.

10. Children's Personal Data

10.1 The Platform is a professional B2B regulatory intelligence service intended solely for business and professional users aged 18 years and above. The Platform is not directed at children (persons under 18 years of age as defined under the DPDP Act 2023) and Adynta does not knowingly collect personal data from children.

10.2 If Adynta discovers that personal data of a child has been collected — whether through incidental access or otherwise — Adynta will promptly delete such data without notice to or action from the child or parent. Parents or guardians who believe a child's data has been collected may contact privacy@adynta.com to request immediate deletion.

10.3 Adynta does not conduct behavioural profiling, targeted advertising, or marketing directed at children, and does not build any data profile of any person identified or reasonably identifiable as being under 18 years of age.

11. Security Safeguards

Adynta implements reasonable technical and organisational security measures proportionate to the risk of processing, as required under the DPDP Act, the IT Act, and the SPDI Rules. These measures include:

• TLS/SSL encryption for all data in transit; encryption at rest for sensitive database fields;
• Bcrypt password hashing (minimum cost factor 12); no plaintext storage of passwords or credentials;
• Role-based access controls with multi-factor authentication for administrative access;
• Short-lived JWT access tokens (15-minute expiry) with rotating refresh tokens and a Redis-backed token blocklist;
• Web Application Firewall and DDoS protection via Cloudflare;
• Security monitoring, anomaly detection, and SIEM event logging; and
• Periodic security reviews and penetration testing.

No system is 100% secure, and Adynta does not guarantee absolute security. In the event of a personal data breach, Adynta will: (a) take immediate steps to contain and assess the breach; (b) notify affected Data Principals and the Data Protection Board of India in accordance with applicable law, the DPDP Rules, and any government directions in force at the time of the incident; and (c) provide timely updates on remediation measures. The internal escalation contact for security incidents is security@adynta.com.

12. Cookies & Tracking Technologies

Adynta uses cookies and similar tracking technologies to operate the Platform securely and to understand usage patterns. Please review our Cookie Policy at adynta.com/cookie-policy for full details on cookie categories, purposes, duration, third-party cookies, and how to manage your preferences.

Essential cookies (session management, security, disclaimer acceptance) are strictly necessary and cannot be disabled without impairing Platform functionality. Non-essential cookies (analytics, functional, marketing) are set only with your affirmative consent, in line with Adynta's privacy best practices and applicable legal requirements as they develop.

13. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of India. Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts at Ahmedabad, Gujarat, India, without prejudice to any mandatory statutory remedies available to Data Principals under the DPDP Act, the DPDP Rules, or other applicable Indian law.

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or government notifications. Material changes will be notified via email or a prominent Platform notice at least 14 days before taking effect. Where a material change affects the basis on which we process your personal data and requires fresh consent or notice under the DPDP Act or DPDP Rules, we will obtain that consent or provide that notice separately — your continued use of the Platform will indicate acknowledgement of other changes to the extent permitted by applicable law.

14. Grievance Officer

In accordance with the DPDP Act 2023, the DPDP Rules 2025, and the Information Technology (Intermediaries Guidelines and Digital Media Ethics Code) Rules, 2021 to the extent applicable, the details of our Grievance Officer are:

The Grievance Officer handles complaints relating to personal data processing, data rights requests, and privacy concerns. For separate privacy enquiries not constituting formal grievances, contact privacy@adynta.com.

15. Contact

Privacy enquiries and data rights requests: privacy@adynta.com

Grievances under the DPDP Act, DPDP Rules, and IT Intermediary Rules (to the extent applicable): grievance@adynta.com

Marketing opt-out: unsubscribe@adynta.com

Security incidents: security@adynta.com

Adynta Consulting, Ahmedabad, Gujarat, India.