Privacy notice

• About your organisation, before the questions: sector, size band, and whether you process children's data or may be a Significant Data Fiduciary.
• Your answers to the assessment questions, and the scores calculated from them.
• To show your score: your full name, work email and company name. A phone number is optional.
• Your two choices on the form: whether you want DPDPA compliance updates by email, and, if you give a phone number, whether you are open to a phone consultation about your results.
• How you reached us, only if the link you followed carried a source tag.
• If you buy the full report: the Razorpay order and payment identifiers and the amount. Card, UPI and bank details go to Razorpay, not to us. To pre-fill the payment window we pass your name, work email and, if you gave one, your phone number to Razorpay, along with your company name and assessment ID.

• To calculate your readiness score and show it to you, and to place it against an indicative range for your sector.
• To email you your score summary and, if you buy it, the full readiness report.
• If your sector, size and score put you in our callback group, we email an alert to our team with your name, company, work email, score and, if you gave one, your phone number, so that we can follow up. We call only if you gave a number and ticked the box saying you are open to a phone consultation.
• If you ticked the box for DPDPA compliance updates, we may email them to your work email.

Our own code sets no cookies, and the site loads no advertising scripts. Page analytics use Plausible, set up without cookies. We send it page views and a few anonymous events, such as the sector you choose and whether a score is calculated. Your IP address is used to limit repeated requests. It is held in server memory and is not written to our database.

• Supabase: database hosting for your answers, contact details and order records.
• Vercel: website hosting.
• Resend: sending your score summary and report by email, and the alert to our team described above.
• Razorpay: taking payment for the full report, if you buy it. The Razorpay account is held by Delta Growth Partners Private Limited, a related party of ours, which collects the payment on our behalf and can see the details Razorpay holds about your payment.
• Plausible: page analytics, set up without cookies.

Supabase, Vercel and Resend process it for us under their terms with us. Razorpay handles your payment under its own terms and privacy policy. We do not sell your personal data.

We keep your answers and contact details for as long as we need them to give you your score, your report and any follow-up you asked for. Ask us to erase them and we will, unless a law requires us to keep them or we still need them for the purpose you gave them for.

These requests follow Sections 6(4) and 11 to 14 of the Act. The Act's substantive provisions take effect on 13 May 2027; we handle requests under this notice from today. You can ask us to:

• give you a summary of the personal data we hold about you and the processing we do with it, and tell you which other organisations it has been shared with;
• correct, complete or update it, or erase it;
• withdraw your consent at any time, including your choice to receive email updates and your openness to a phone consultation;
• name another person to exercise your rights if you die or become incapacitated;
• raise a grievance about how we have handled your data or a request you made.

Write to hello@deltadatalabs.com from the email address you gave us, and say what you want us to do. The Act expects you to raise a grievance with us first. Complaints to the Data Protection Board of India can be made once the Act's provisions on grievances and complaints take effect on 13 May 2027.

This site is for organisations assessing their own readiness. It is not meant for anyone under 18. If you think a person under 18 has given us personal data, write to us and we will erase it.

If we change how we use your data, we will update this page and its date and, where the Act requires it, ask for your consent again. The current version is always here.