This Data Protection Statement describes how Cehpoint handles personal data in line with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and its rules, as applicable. It complements our Privacy Policy.
1. Introduction
We are committed to protecting the personal data of our users, clients, testers and website visitors ("Data Principals"). "Personal data" means any data about an individual who is identifiable by or in relation to such data.
2. Cehpoint as Data Fiduciary
For the personal data we determine the purpose and means of processing, Cehpoint acts as a Data Fiduciary. Where we process data on behalf of a client (for example, data within a client's project or testing engagement), we act as a Data Processor for that client and process it under their instructions and our agreement.
3. Principles we follow
- Lawful, fair processing for specified, lawful purposes.
- Purpose limitation — data used only for the purposes notified or permitted by law.
- Data minimisation — we collect only what is necessary.
- Accuracy — reasonable steps to keep data correct and up to date.
- Storage limitation — retained only as long as needed or legally required.
- Security & accountability — reasonable safeguards and responsibility for compliance.
4. Consent and notice
Where we rely on consent, we ask for it through clear, specific requests, and we provide a notice describing the personal data collected and the purpose. You may withdraw consent at any time with effect for the future; withdrawal is as easy as giving consent. We also process data for certain "legitimate uses" recognised under the DPDP Act (for example, where you voluntarily provide data for a specified purpose, or to comply with law).
5. Purposes of processing
We process personal data to operate accounts, deliver the AI platform, services portal and testing marketplace, process payments (via PayU and other gateways), provide support, ensure security and prevent abuse, and meet legal, tax and accounting obligations. Full details are in our Privacy Policy.
6. Rights of Data Principals
Subject to the DPDP Act, you have the right to:
- Access — obtain a summary of the personal data we process and the processing activities.
- Correction and erasure — have inaccurate data corrected/updated and data erased when no longer required.
- Grievance redressal — have your complaint addressed by our grievance channel.
- Nomination — nominate an individual to exercise your rights in case of death or incapacity.
- Withdraw consent — as described above.
To exercise these rights, email grievance@cehpoint.co.in. We may verify your identity and will respond within the timelines required by law.
7. Security safeguards
We implement reasonable technical and organisational measures — encryption in transit, access controls, hashed credentials, logical tenant isolation, and monitoring — to protect personal data against unauthorised access, loss or disclosure. Our processors are bound by contractual security and confidentiality obligations.
8. Personal data breach notification
In the event of a personal data breach, we will take remedial action and notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act and applicable rules.
9. Retention and erasure
We retain personal data only for as long as necessary for the stated purposes or to meet legal obligations (e.g. tax/financial records). When the purpose is served and no legal requirement to retain remains, we erase or anonymise the data. You may request erasure as described above.
10. Cross-border processing
Some processors and infrastructure (including certain AI model providers, hosting and email services) may process data outside India. We do so consistent with the DPDP Act and any restrictions notified by the Government of India, and we require appropriate safeguards from such processors.
11. Children's data
We do not knowingly process the personal data of children (under 18) without verifiable parental/guardian consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, in line with the DPDP Act.
12. Grievance officer and the Data Protection Board
You can raise any data-protection grievance with our grievance channel at grievance@cehpoint.co.in. We will acknowledge and address your grievance within the statutory timeframe. If you are not satisfied, you may lodge a complaint with the Data Protection Board of India as provided under the DPDP Act.
Contact us
If you have any questions, requests or complaints about this document or how we handle your information, contact:
- Support / general: support@cehpoint.co.in
- Grievance / Data Protection queries: grievance@cehpoint.co.in
- Post: Cehpoint, West Bengal, India — full registered office address available on request.