DPDP disclosure

The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) is India’s data protection statute. It governs digital personal data processed in India, and personal data processed outside India in connection with offering goods or services to people in India.

Read it from the source rather than from us:

• MeitY — Digital Personal Data Protection Act, 2023(opens meity.gov.in in a new tab) — the Ministry of Electronics and Information Technology’s own page for the Act.
• The Act as published (PDF, meity.gov.in)(opens meity.gov.in in a new tab) — the full text, as enacted.
• India Code — Act No. 22 of 2023(opens indiacode.nic.in in a new tab) — the Government of India statute repository entry.

The Act puts the obligations on the Data Fiduciary — whoever decides why and how personal data is processed. On this platform that is usually not us.

Your survey responses

The organisation running the survey is the Data Fiduciary. It decides what to ask and what to do with the answers. We are its Data Processor and act only on its instructions.

ATFS accounts

We are the Data Fiduciary for the accounts of people who sign in to ATFS, and we answer for that data directly.

Significant Data Fiduciary

A classification the Central Government may notify under § 10 based on volume and sensitivity. If we or a customer are ever notified as one, the additional duties — a Data Protection Officer, independent audit, and impact assessment — apply and we will say so here.

Section 5 requires that a request for consent be accompanied by a notice, in clear and plain language, saying what personal data is being collected, for what purpose, how to withdraw consent, how to exercise rights, and how to complain to the Board.

The platform enforces this at two points:

• At registration, where the consent statement links to this page, the Privacy Policy and the Terms, and the account cannot be created without an explicit affirmative tick. The API rejects a registration whose consent flag is not true — it is not a client-side check.
• At the start of every survey, where the respondent sees the collecting organisation's notice and must answer it before the first question. The answer is stored as a consent record against that response.

Section 5(3) gives every Data Principal the right to that notice in English or in any language in the Eighth Schedule. Survey notices and questions can be translated per question, and the respondent’s chosen language follows their link.

Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Proving that later means keeping evidence of the moment it was given.

When

A UTC timestamp of the affirmative action.

From where

A one-way SHA-256 hash of the IP address. The raw address is never written to the database — the hash evidences the event without retaining the identifier.

On what

The browser user-agent string, and for survey responses the survey and question version the notice was shown with.

To what

The specific purpose consented to. Consent for one purpose is not treated as consent for another.

Section 6(4) makes withdrawal as easy as giving consent. Withdrawal does not invalidate processing that already lawfully happened, and we say which part of the service stops working before you confirm.

§ 11 — Access

A summary of the personal data held, the processing undertaken, and the identities of other Data Fiduciaries it has been shared with.

§ 12 — Correction and erasure

Correction of inaccurate data, completion of incomplete data, and erasure where consent is withdrawn or the purpose is spent — unless retention is required by law.

§ 13 — Grievance redressal

A readily available means of complaint, answered within a defined period. This route must be used before approaching the Board.

§ 14 — Nomination

The right to nominate another individual to exercise these rights in the event of death or incapacity.

Administrators of a tenant can act on a request about a respondent from inside the app: exporting everything held for one respondent session as a JSON file, or erasing it. Erasure of a respondent session hard-deletes the responses and the consent record. Erasure of a user strips every identifying field from the row and deactivates the account, keeping only the non-identifying skeleton the audit trail needs. Both actions are themselves written to the audit log.

Requests reach us at privacy@snsurveys.com and are answered within 30 days.

Section 9 requires verifiable parental consent before processing the personal data of anyone under 18, and prohibits tracking, behavioural monitoring and targeted advertising directed at children — with no consent-based exception.

ATFS carries no advertising, no behavioural tracking and no third-party analytics, so the prohibition is satisfied by the absence of the capability. Where a customer surveys children, obtaining verifiable parental consent is their obligation, and our Terms say so.

• Tenant isolation enforced in PostgreSQL with row-level security, so a query that omits its tenant filter returns nothing rather than another organisation's rows.
• Encryption in transit with TLS, and encryption at rest in the storage layer.
• Passwords stored as salted bcrypt hashes; sessions carried in signed, HttpOnly, SameSite=Strict cookies with anti-forgery tokens on state-changing requests.
• Identifiers redacted from any text sent to an external analysis provider — email addresses, phone numbers, Aadhaar, PAN, passport numbers and UPI handles.
• An append-only audit log of administrative actions, exportable by your own administrators.
• Rate limiting on authentication, and automatic deactivation of accounts dormant for 12 months.

The Act requires personal data to be erased once consent is withdrawn or the purpose is no longer served, whichever is earlier, unless retention is required by law.

A nightly job enforces this rather than leaving it to memory. It applies each tenant’s retention window to survey responses, hard-deletes soft-deleted rows once the 90-day recovery grace period expires, deactivates dormant accounts, and clears orphaned export files. Retention windows are configurable per tenant and default to 24 months.

In the event of a personal data breach we will notify the Data Protection Board of India and every affected Data Principal, in the form and manner prescribed, without waiting to complete our own investigation. Customers whose Customer Data is affected are told directly, with what we know at the time and what we do not yet know.

Account data, survey definitions, responses and backups are stored in India, in the AWS Asia Pacific (Mumbai) region.

Section 16 permits transfer outside India except to a country the Central Government restricts by notification. Two categories of data do leave India, and they are listed in full in the Privacy Policy: technical metadata sent to our error-monitoring and rate-limiting providers, and redacted survey text sent to the AI analysis provider at the moment an analysis feature is used. AI analysis can be disabled for a tenant on request.

Under § 13 our Grievance Officer is reachable at grievance@snsurveys.com. Please describe the issue and identify the account or survey involved so we can find it.

We acknowledge within 7 days and answer within 30. If you are not satisfied, you may complain to the Data Protection Board of India — the Act requires you to have used this route first.