Our alignment with India's data-protection law.

iSyph is built and operated in India, for Indian businesses. This statement describes how we align our platform and practices with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and its rules as they come into force.

1. Our role under the DPDP Act

In most engagements, your company is the Data Fiduciary — you determine the purpose and means of processing the personal data of your employees and contacts. iSyph acts as a Data Processor, processing that data only on your documented instructions, under a Data Processing Agreement.

Where iSyph collects limited personal data directly (for example, a prospect's details submitted through our website), iSyph acts as a Data Fiduciary for that limited purpose, as described in our Privacy Policy.

2. Principles we follow

• Lawful purpose & consent — personal data is processed for clear, lawful purposes, on a valid legal basis.
• Data minimisation — we process only what is necessary. See our Data Retention & Minimisation Policy.
• Purpose limitation — data is not used beyond the purpose for which it was provided.
• Storage in India — your data is hosted on Indian infrastructure under your control.
• Security safeguards — reasonable technical and organisational measures protect the data.
• Accountability — we maintain a grievance-redressal mechanism and a point of contact (see Grievance & DPO).

3. Rights of Data Principals

Individuals whose personal data is processed ("Data Principals") have rights under the DPDP Act, including the right to access information about processing, to seek correction and erasure, to grievance redressal, and to nominate another person to exercise their rights. Where your company is the Data Fiduciary, such requests are directed to your company; iSyph assists you in fulfilling them.

4. Cross-border transfers

iSyph's default posture is to keep your data within India. We do not transfer your conversation data outside India in the ordinary course of providing the service.

5. Data breach response

In the event of a personal-data breach, iSyph will notify the affected Data Fiduciary and, where applicable, support notification to the Data Protection Board of India and affected Data Principals, in the manner and timelines required by law.

6. Contact

For questions about this statement or our DPDP practices, contact our Data Protection Officer / Grievance Officer at Mr. Arpit Patel, iSyph, grievance@icomm.co.in or legal@icomm.co.in, Pune, Maharashtra, India. See Grievance Redressal & DPO.

This statement is provided for transparency and does not constitute legal advice. It will evolve as the DPDP Rules are notified and as our practices mature.