DPDP Act 2023 Compliance
India's Digital Personal Data Protection Act 2023 — how we comply
Decode Label is committed to full compliance with India's Digital Personal Data Protection (DPDP) Act 2023. This page explains our obligations as a Data Fiduciary and your rights as a Data Principal.
Overview of the DPDP Act 2023
India's DPDP Act 2023 governs the processing of digital personal data in India. It establishes rights for individuals (Data Principals) and obligations for organisations that process personal data (Data Fiduciaries). Ingranova Technologies Private Limited (which operates Decode Label) acts as a Data Fiduciary under this Act.
Our Obligations as Data Fiduciary
1. Lawful Purpose & Consent
We process personal data only for the specific purposes described in our Privacy Policy, and only with your consent. We obtain consent through:
- A clear, plain-language consent notice at account registration
- Separate, explicit consent before collecting sensitive personal data (health profiles)
- The ability to withdraw consent at any time from account settings
We do not use "dark patterns" or pre-ticked consent boxes. Consent for each category of processing is obtained separately.
2. Data Minimisation
We collect only the personal data necessary for each specific purpose. For example:
- We do not require a phone number unless you choose OTP-based login
- Health profile fields are all optional — you can use the basic service without providing any health data
- We do not collect precise location data
3. Accuracy
You can update your account information at any time via your profile settings. You may also request correction of any inaccurate data by emailing privacy@decodelabel.com.
4. Storage Limitation
We retain personal data only as long as necessary for the stated purpose. See our full retention schedule in the Privacy Policy.
5. Security Safeguards
- AES-256 encryption for sensitive personal data at rest
- TLS 1.3 for all data in transit
- Role-based access controls — staff access personal data only on a need-to-know basis
- Breach notification — we will notify affected users and CERT-In within 6 hours of becoming aware of a qualifying breach
6. Grievance Redressal
We have appointed a Data Protection Officer (DPO) responsible for handling privacy grievances:
Data Protection OfficerIngranova Technologies Private Limited
Email: privacy@decodelabel.com
Response time: 30 business days
Your Rights as Data Principal
Under the DPDP Act 2023, you have the following rights. To exercise them, email privacy@decodelabel.com with subject "DPDP Rights Request" and include your registered email address.
Right to Access
Request a complete summary of personal data we hold about you, including the categories, purpose of processing, and names of processors who have access.
Right to Correction & Erasure
Request correction of inaccurate data or erasure of data that is no longer necessary for the stated purpose. Erasure requests will be fulfilled within 30 days, subject to legal retention obligations.
Right to Grievance Redressal
File a complaint with our DPO. If unsatisfied with our response, you may escalate to the Data Protection Board of India once established by the government.
Right to Nominate
Nominate another individual to exercise your rights in the event of your death or incapacity, via a written nomination form available on request.
Right to Withdraw Consent
Withdraw consent for any category of processing at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Certain core service functions may become unavailable after withdrawal.
Sensitive Personal Data
Health conditions, allergies, and dietary preferences you provide in your health profile constitute sensitive personal data under the DPDP Act. We apply additional protections:
- Explicit opt-in consent collected separately before any sensitive data is gathered
- Encrypted at rest using AES-256
- Never shared with advertising networks, data brokers, or other third parties for profiling
- Shared with Decode Label processors (Google Gemini) only in an anonymised, non-identifiable form
- Deleted immediately on your request
Cross-Border Data Transfers
Our Decode Label analysis infrastructure (Google Gemini, Google Cloud Vision) operates on Google's global infrastructure, which may involve transfer of ingredient data outside India. We ensure such transfers are governed by appropriate contractual safeguards. We do not transfer personally identifiable data outside India without adequate safeguards.
Children's Data
We do not knowingly process personal data of children under 18. We do not display behavioural advertising and do not track children. If you become aware that a child has submitted personal data, please notify us at privacy@decodelabel.com immediately.
Contact the Data Protection Officer
Data Protection OfficerIngranova Technologies Private Limited
Email: privacy@decodelabel.com