9.1 Our role. In processing your personal data we act as a Data Fiduciaryunder India's Digital Personal Data Protection Act, 2023 (the DPDP Act). You are the Data Principal. We are accountable for complying with the DPDP Act in respect of the data we process about you, including data processed on our behalf by our processors.
9.2 What we process, and why. The categories of personal data we process, the purpose of each, the legal basis, how long we keep it, and the third parties involved are set out in our Privacy Notice, which forms part of these terms. We process personal data only for the purposes stated in that notice, and only to the extent necessary for them.
9.3 Consent. Where we rely on your consent, we obtain it by a clear affirmative action before processing begins, separately for each purpose, and we keep a record of it. You may withdraw any consent at any time, as easily as you gave it, using the data rights form. Withdrawal takes effect for future processing; it does not affect processing already lawfully carried out, and it may mean we can no longer provide part of the service.
9.4 Your rights. You have the right to obtain a summary of the personal data we hold about you and how it is processed (s.11); to have inaccurate or misleading data corrected, incomplete data completed and outdated data updated (s.12); to have your personal data erased, subject to any legal obligation on us to retain specific records (s.12); to nominate another person to exercise your rights if you die or become incapable (s.14); and to have your grievances addressed (s.13). We do not charge for exercising any of these rights. We will verify your identity before acting on a request, and if we refuse a request we will tell you why.
9.5 Your obligations.Under s.15 of the DPDP Act you must give us information that is authentic and complete, must not impersonate another person when providing personal data, and must not raise a grievance or complaint that you know to be false or frivolous. Where you supply another person's personal data to us — for example when nominating a representative — you confirm that you are entitled to do so.
9.6 Security.We maintain reasonable security safeguards as required by s.8(5), including encryption in transit, access controls that separate one customer's data from another's, private storage for purchased content, and redaction of credentials and identifiers in our logs. No system is perfectly secure, and you play a part: keep your password confidential and unique to this service.
9.7 Personal data breaches. If a personal data breach affects your personal data we will notify the Data Protection Board of India and inform you, in the manner and within the timeframes required by the DPDP Act and the rules made under it. Our internal procedure for this is documented and rehearsed.
9.8 Processors and transfers. We engage third parties to process personal data on our behalf only under contract and only on our instructions. Those providers are listed in the Privacy Notice. Where processing involves a transfer outside India, we do so in accordance with s.16 of the DPDP Act and any restrictions notified by the Central Government.
9.9 Retention and erasure. We retain personal data only for as long as the stated purpose requires, or for as long as a legal obligation requires, whichever is longer. When neither applies we erase it, and we instruct our processors to do the same.
9.10 Children.The service is not directed at children. We do not knowingly process the personal data of anyone under 18, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children. If you believe we hold a child's data, contact our Grievance Officer and we will delete it.
9.11 Grievances. Contact our Grievance Officer at grievance@dairydiaries.com about anything to do with your personal data. We aim to respond within 30 days. If you remain dissatisfied you may complain to the Data Protection Board of India, but you must give us the opportunity to resolve the matter first.
9.12 Precedence. If anything elsewhere in these terms conflicts with this clause or with the Privacy Notice in relation to personal data, this clause and the Privacy Notice prevail. Nothing in these terms limits any right you have under the DPDP Act, and any provision that purported to do so has no effect to that extent.