Privacy Policy

Introduction

At Dopove Private Limited ("Dopove", "we", "us", or "our"), we are committed to protecting your privacy and ensuring the security of your data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (the "Site").

This Policy applies solely to the public website (dopove.com). Data processed through Dopove's enterprise software products (e.g., Indexless Context Engine (ICE), Cortex) is governed exclusively by separate Data Processing Agreements (DPA) and Master Service Agreements (MSA) executed with our enterprise clients.

1. Lawful Basis for Processing (GDPR Article 6)

We process your personal data only where we have a valid lawful basis under applicable data protection laws (including GDPR Article 6):

• Legitimate Interest (Art. 6(1)(f)): Operating and improving the Site, security, fraud prevention, analytics, and responding to inquiries.
• Consent (Art. 6(1)(a)): Marketing communications (newsletter, product updates) where you have opted in.
• Contract Performance (Art. 6(1)(b)): Processing waitlist sign-ups and responding to your inquiries.
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws, court orders, or regulatory requirements.

You may withdraw consent for marketing at any time by clicking "unsubscribe" in emails or contacting us at [email protected].

2. Information We Collect

3. How We Use Your Data

We use the information we collect for the following purposes:

• Provide, maintain, and improve the Site and our services
• Respond to your inquiries and provide support
• Send technical notices, updates, and security alerts
• Communicate about products and services (only with your consent / opt-in)
• Analyze Site performance and user behavior to improve experience
• Security, fraud prevention, and abuse detection
• Comply with legal obligations and protect our rights

Dopove does not sell, rent, or trade your personal data to third parties for marketing purposes.

5. Data Sharing & Disclosure

We do not sell your personal data. We may share your information only as follows:

• Service Providers: Trusted third parties who process data on our behalf (hosting, analytics, email) under strict Data Processing Agreements.
• Legal Requirements: When required by law, court order, or regulatory authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice).
• Legal Defense: To protect our rights, property, or safety, or those of others.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. International Data Transfers

Dopove is headquartered in India. Your information may be transferred to and processed in countries outside your jurisdiction (including India, the United States, and the European Union). We ensure such transfers comply with applicable data protection laws through:

• Adequacy Decisions: Transfers to countries with EU adequacy decisions.
• Standard Contractual Clauses (SCCs): EU Commission-approved clauses for transfers to third countries.
• Binding Corporate Rules (BCRs): Where applicable for intra-group transfers.
• Derogations: Your explicit consent or contract necessity (Art. 49 GDPR).

A copy of the safeguards used for international transfers is available upon request to [email protected].

For personal data covered by the DPDP Act, transfers outside India are permitted except to countries the Central Government restricts by notification under Section 16 of the DPDP Act. We will comply with any such notification.

7. Data Security

We implement industry-standard technical and organizational measures to secure your information:

• Encryption: TLS 1.2+ for data in transit; AES-256 for data at rest.
• Access Controls: Role-based access, MFA, least privilege, and regular audits.
• Monitoring: Intrusion detection, vulnerability scanning, and incident response.
• Retention: Data retained only as long as necessary (see Retention below).

While we implement strong safeguards, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this Policy:

• Waitlist / Contact Form Data: 2 years from last interaction, or until you request deletion.
• Support Tickets / Correspondence: 3 years after resolution.
• Analytics / Usage Data: Aggregated/anonymized after 13 months; raw logs deleted after 30 days.
• Marketing Data: Until you unsubscribe or 2 years of inactivity.
• Legal / Compliance: As required by applicable law (up to 7 years).

You may request deletion at any time (see Your Rights). Anonymized/aggregated data may be retained indefinitely.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access (Art. 15 GDPR): Receive a copy of your data and processing details.
• Rectification (Art. 16 GDPR): Correct inaccurate or incomplete data.
• Erasure / "Right to be Forgotten" (Art. 17 GDPR): Request deletion of your data.
• Restriction (Art. 18 GDPR): Limit how we process your data.
• Objection (Art. 21 GDPR): Object to processing based on legitimate interest or direct marketing.
• Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format.
• Withdraw Consent: Where processing is based on consent, withdraw at any time.
• CCPA/CPRA Rights (California): Know, delete, opt-out of sale/share, non-discrimination, limit sensitive data use.

To exercise any right, contact our Data Protection Officer at [email protected] with "Privacy Rights Request" in the subject. We will confirm we have received your request within 10 business days and respond within 45 days of receiving it (or sooner where the law requires, for example 30 days under the GDPR). If a request is complex or we receive many, we may extend that period by up to 60 days, and we will tell you why before the first period ends.

We may verify your identity before fulfilling requests. No fee is charged unless requests are manifestly unfounded or excessive. If we decline all or part of a request, we will tell you the reason.

You also have the right to lodge a complaint with a data protection supervisory authority, in the country where you live or work or where you believe your rights were infringed. In the UK this is the Information Commissioner's Office. You do not have to contact us first, although we would like the chance to put things right.

10. Automated Decision-Making & Profiling

We do not engage in fully automated decision-making (including profiling) that produces legal effects or similarly significantly affects you, as defined by GDPR Article 22. Analytics and security scoring are used only for operational purposes and are subject to human review.

11. Children's Privacy

The Site is not directed to children. Under the Digital Personal Data Protection Act, 2023 (DPDP Act) a child is anyone under 18. We do not knowingly process personal data of children under 18, and processing a child's personal data requires the verifiable consent of a parent or lawful guardian (Section 9 of the DPDP Act). If we learn we have collected data from a child without that consent, we will delete it promptly. If you believe we have collected information from a child, contact us at [email protected].

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information is collected, used, shared, or sold.
• Delete your personal information (with exceptions).
• Correct inaccurate personal information.
• Opt-out of the sale or sharing of your personal information.
• Non-discrimination for exercising your rights.
• Limit the use and disclosure of sensitive personal information.

Dopove does not sell or share personal information as defined by the CCPA. To submit a request, email [email protected] with "CCPA Request" in the subject.

13. Digital Personal Data Protection Act, 2023 (India)

Dopove Private Limited is incorporated in India. For personal data of individuals in India, we process it in line with the Digital Personal Data Protection Act, 2023: we ask for consent where it is the basis for processing, we collect only what each purpose needs, and we keep it only as long as that purpose requires.

Under that Act you may ask us for a summary of the personal data we process about you, and to correct, complete, update or erase it, and you may nominate another person to exercise these rights if you die or become unable to. You may also use our grievance contact below; if we do not resolve your complaint, you may complain to the Data Protection Board of India. We acknowledge grievances within a reasonable time and seek to resolve them promptly, in accordance with the DPDP Act and applicable Rules.

Dopove Private Limited has not been notified as a Significant Data Fiduciary under Section 10 of the DPDP Act.

Subprocessors

We use the following subprocessors to operate this website. Each processes personal data only on our instructions and under a data processing agreement or equivalent terms.

• Amazon Web Services (United States, us-east-1): user sign-in (Amazon Cognito), the waitlist and account API (API Gateway, Lambda, DynamoDB) and transactional email (Amazon SES).
• Formspree: receives contact form submissions (name, email address and message) and relays them to us.
• Google Cloud: hosts this website.
• Zoho (India data centre): live chat (Zoho SalesIQ), if you allow it, and our CRM, where contact form and waitlist enquiries are stored as leads.

We will update this list when we add or change a subprocessor. To ask about a subprocessor, contact us at [email protected].

Personal Data Breach Notification

If we become aware of a personal data breach affecting data that we control, we will notify the Data Protection Board of India and each affected Data Principal as required by Section 8(6) of the DPDP Act and its Rules. Where the GDPR applies, we will also notify the competent supervisory authority without undue delay and the breach is likely to result in a risk to the rights and freedoms of individuals, within 72 hours of becoming aware of it.

Where a breach is likely to result in a high risk to you, we will also notify you directly without undue delay, describing what happened, the likely consequences and the steps we are taking.