DPDP Act Compliance

1. Our role

Under the DPDP Act, SineBoot is a Data Fiduciary for the account, billing and support data you provide to us — meaning we determine the purpose and means of processing it. Where you run your own services on our infrastructure and decide how your end users’ data is handled, you are the Data Fiduciary and SineBoot acts as a Data Processor on your behalf, governed by our Data Processing Addendum.

2. Notice and consent

Where we rely on your consent, we ask for it through a clear notice that describes the personal data we collect and the purpose for which it will be processed. Your consent is limited to what is necessary for that purpose, and you may give or refuse it freely. You can review how we use data at any time in our Privacy Policy, which is also available in English.

3. Certain legitimate uses

In line with the DPDP Act, we may process certain personal data without separate consent for specified legitimate uses — for example, where you have voluntarily provided data for a purpose and not objected, to comply with a legal obligation, or to respond to a medical emergency or threat to safety.

4. Your rights as a Data Principal

• Right to information & access — obtain a summary of the personal data we process about you and the processing activities.
• Right to correction & erasure — have inaccurate or incomplete data corrected, updated or completed, and request erasure of data no longer needed for its purpose.
• Right to grievance redressal — raise a grievance with us and receive a response (see section 6).
• Right to nominate — nominate another individual to exercise your rights in the event of your death or incapacity.

5. Withdrawing consent

You may withdraw your consent at any time, and doing so is as easy as giving it. Withdrawal does not affect processing carried out before withdrawal, and some processing may continue where another legal ground applies. You can manage much of this from your client area.

6. Raising a grievance

You can raise any concern about how we handle your personal data by contacting us, and we will respond within the period prescribed under the Act. Please mark your message “DPDP Grievance”, and reach out to us first so we can resolve it directly before you escalate.

Email: [email protected]
Or use our contact page.

7. Children and persons with disabilities

Our services are intended for adults. You confirm you are 18 or older when you create an account, and we do not knowingly collect or process the personal data of anyone under 18. We do not carry out tracking, behavioural monitoring or targeted advertising directed at children. If we become aware that we have collected a child’s personal data without the verifiable consent of a parent or lawful guardian, we will delete it promptly. Equivalent protections apply to persons with disabilities who have a lawful guardian.

8. Security safeguards and breach notification

We maintain reasonable technical and organisational safeguards to protect personal data against unauthorised access, loss or disclosure, as described in our Security overview. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required by the Act.

9. Data retention

We keep personal data only for as long as necessary for the purpose it was collected, and thereafter as required to meet legal, tax and accounting obligations, after which it is deleted or anonymised.

10. Transfers outside India

SineBoot may process personal data using service providers located outside India. We do so in accordance with the DPDP Act, which permits such transfers except to any country or territory restricted by the Central Government, and we apply appropriate safeguards to protect your data in transit and at rest.

11. Complaints to the Data Protection Board

If you are not satisfied with our response to a grievance, you have the right to lodge a complaint with the Data Protection Board of India in accordance with the DPDP Act.