DPDP Act — how SangamIQ complies
Draft v1 — pending legal review. The practices described are what the product does today; the counsel-reviewed version adds the formal notices and a designated grievance officer. Signup and lead forms already carry a purpose-limited DPDP notice.
Roles
For any personal data processed inside a customer’s tenant, the customer is the Data Fiduciary and SangamIQ is the Data Processor. We build the compliance mechanics into the product so those duties are practical, not paperwork.
Principles, implemented
| DPDP principle | Product mechanism |
|---|---|
| Purpose limitation | Data is processed for planning only. There is no punitive-analytics or profiling path in the architecture to misuse. |
| Notice & consent | A purpose-limited notice appears at signup and on every lead form; marketing analytics are cookieless and non-identifying, so there is nothing to consent to on the website. |
| Data minimisation | “No data without a contract” — only fields named in a mapping contract are stored; dropped columns are reported by name. We ask for supply-chain data, not people data. |
| Accuracy & correction | Every computed number shows its arithmetic and its rung badge; correction requests are first-class and treated as strong evidence. |
| Access & erasure | Full per-tenant export any time; erasure honored per the retention schedule and law. |
| Security safeguards | Physically isolated workspace per tenant, scrypt auth, and an append-only audit trail. See Security. |
Data residency
Customer data is stored and processed in India.
Grievance redressal
A grievance officer and response SLAs are designated in the counsel-reviewed version. Until then, contact us directly — pilot agreements carry interim commitments.