Privacy Policy

This Privacy Policy (“Policy”) covers the personal data that Confirmita, its parent entity Nexvias Solution LLP, and any of our affiliates (“Confirmita”, “we”, “our”, or “us”) collect, store, use, disclose and otherwise process about you through confirmita.com, including the Founding 100 Program application, the free DPDP scanner, and our contact form, as well as the rights available to you when Confirmita acts as the Data Fiduciary (the DPDP Act's term for the entity that decides why and how your personal data is processed, equivalent to a “data controller” under other privacy laws) for that personal data.

This Policy does not apply where Confirmita processes personal data as a Data Processor (also known as a service provider) in the course of providing our product and platform (the “Services”) to our paying customers (“Customers”), solely for their benefit. In that case, any personal data a Customer uploads into the Services (for example, their own employees' or data subjects' records entered into a DPIA or an assessment) is “Customer Content” and is processed strictly on that Customer's written instructions, under our service agreement with them, including any order form and data processing addendum. If your personal data has been uploaded into the Services by one of our Customers, you should direct any privacy request to that Customer directly. See “Your rights as a Data Principal” below for how we support that.

Confirmita.com may contain links to other websites (“Linked Sites”). We are not responsible for, and this Policy does not apply to, the privacy practices of any Linked Site or of any company we do not own or control. Linked Sites may collect information in addition to what we collect here. We encourage you to read each Linked Site's own privacy policy.

Confirmita.com runs our own cookie-consent product to manage your cookie preferences on this site. We do not use the consent records or identifiers that product collects through confirmita.com for any purpose other than managing your consent preferences. In particular, we do not use that data to track you or your device across other, unrelated services.

We write this policy to satisfy the obligations placed on every Data Fiduciary by Section 5(1) of the DPDP Act and Rule 3 of the DPDP Rules: to tell you, in clear language, exactly what personal data we collect, why, and how you can exercise your rights over it or complain to us or to the Data Protection Board of India.

For the personal data described in this policy, the Data Fiduciary (the entity that decides why and how your personal data is processed, as defined in Section 2(i) of the DPDP Act) is:

Under Section 8(9) of the DPDP Act we must also publish the contact details of someone who can answer your questions about how your personal data is processed. That person is named in the “Contact us” section below.

In every case above, you give us your personal data by voluntarily filling in a form and ticking a consent checkbox. That checkbox is the free, specific, informed and unambiguous affirmative action Section 6(1) of the DPDP Act requires before we may rely on your consent, and it is never bundled with any other purpose or pre-ticked on your behalf.

• Founding 100 application details: to assess and respond to your application, contact you about your selected plan and founding-rate eligibility, and send the next steps to complete your subscription if you proceed.
• Scanner lead details: to send you the scan report you requested, to follow up if you've asked for the paid advanced review, and to improve our scanning checks.
• Enquiry form details: solely to respond to the question or request you've sent us.
• Account email/password: to authenticate you and operate the product you or your employer has subscribed to, which is processing necessary to perform our contract with your organisation.

You can withdraw consent at any time. See “Your rights as a Data Principal” below. Withdrawing consent does not affect the lawfulness of anything we did with your data before you withdrew it, and will not stop us processing data we are independently required to keep for legal or accounting reasons.

This site uses the same cookie-consent banner we build for our customers, set to the most privacy-protective defaults by default:

In plain terms: as of the date at the top of this policy, Google Analytics and Microsoft Clarity run on confirmita.com only if you opt into the Analytics / performance category above; we do not run any advertising or social-media tracking script. This site also loads fonts from Google Fonts (to load our typeface), which causes your browser to contact Google's servers directly and necessarily exposes your IP address to Google for that request; no cookie is set by this font request. If we ever turn on advertising or social-media cookies, the banner above, not this policy, is where you'll be asked to opt in first, and this policy will be updated to describe exactly what was added.

You can change your cookie choices at any time from the cookie preferences control on this site.

We do not sell your personal data. We share it only with:

• Our infrastructure providers: the cloud hosting and storage that runs this site and holds the data described above, acting strictly on our instructions as our Data Processor under Section 8(2) of the DPDP Act.
• Our email-sending provider: to deliver Founding 100 application confirmations, scan reports, and replies to your enquiry.
• Google Analytics and Microsoft Clarity: to understand how visitors use this site (page views, traffic sources, and on-page behaviour) so we can improve it. These only run if you opt into the Analytics / performance cookie category; see “Cookies & similar technologies” above.
• Regulators, courts or law enforcement: only where we are legally required to disclose information, and only to the extent that requirement compels.

We do not have, and have never used, a payment processor or SMS/OTP provider on this site as of the date of this policy.

We do not delete the personal data described in this policy on a fixed schedule. We retain it indefinitely, for as long as it continues to serve a purpose connected to our relationship with you, consistent with Section 8(7) of the DPDP Act.

A Founding 100 application, a scan report, or an enquiry can turn into a business relationship months or years after you first reach out, so we keep a consistent record of it rather than deleting it on a timer. That same record lets us detect repeat misuse of our free tools, show you or a regulator exactly what notice and consent we gave you if we're ever asked, and keep our own compliance and audit history accurate and complete, which matters for a compliance company more than most.

You can ask us to erase your data sooner. See “Your rights as a Data Principal”.

In line with Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules, we apply reasonable technical and organisational safeguards to the personal data described in this policy, including encryption in transit, encryption at rest for personal data that directly identifies you (for example, your name, email address, and phone number), access limited to staff who need it to do their jobs, and salted cryptographic hashing of any password we store. We never store your password in plain text and we never ask you for it by email or phone.

No system is completely secure. If a breach affecting your personal data occurs, we will notify the Data Protection Board of India and affected individuals as required under Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules.

The personal data described in this policy is stored and processed on infrastructure located in India. The DPDP Act (Section 16) and Rule 15 of the DPDP Rules permit a Data Fiduciary to transfer personal data outside India except where the Central Government specifically restricts a transfer. Two things leave India as part of running this site: the request your browser makes directly to Google's font-serving infrastructure, and, only if you opt into the Analytics / performance cookie category, usage data sent to Google Analytics and Microsoft Clarity, both of which process data outside India. We are not currently relying on this permission for any other purpose in this policy. If that changes, we will update this policy and, where consent is our basis for processing your data, ask for it again before doing so.

confirmita.com is a business-to-business site and is not directed at, or intended for, individuals under 18 (a “child” as defined in Section 2(f) of the DPDP Act). We do not knowingly collect personal data from children. If you believe a child has given us personal data, please contact us using the details below and we will delete it.

Under Sections 11 to 14 of the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how we're processing it (Section 11).
• Correct, complete or update your personal data if it's inaccurate or out of date (Section 12(2)).
• Erase your personal data once it's no longer needed for the purpose it was collected for (Section 12(3)).
• Withdraw consent at any time, as easily as you gave it (Section 6(4)).
• Nominate another individual to exercise these rights on your behalf if you die or become incapacitated (Section 14).

To exercise any of these, email [email protected] telling us which right you want to exercise and enough detail to identify your record (typically the email address you used with us). We may ask you to verify your identity before acting on a request, proportionate to the sensitivity of the data involved.

If you're unhappy with how we've handled your personal data or a rights request, you have a right under Section 13 of the DPDP Act to raise it with us first. Write to our Grievance Officer at the address in “Contact us” below. We aim to acknowledge your grievance within 7 days and resolve it within 30 days; Rule 14(3) of the DPDP Rules sets 90 days as the outer limit a Data Fiduciary's published grievance system may take.

If you remain unsatisfied after raising it with us, Section 13(3) of the DPDP Act requires you to exhaust this process with us before you may escalate your complaint to the Data Protection Board of India.

We may update this policy as our site, product or the DPDP Rules change. If a change is material (for example, if we start sharing data with a new category of recipient, or start transferring it outside India), we will update the effective date above and, where you've given us an email address, let you know directly before the change takes effect where consent is our basis for processing. We encourage you to check back here occasionally.