Data Protection Policy — DPDP Act, 2023

Last updated: 25 September 2026

This policy describes how Vivaha discharges its duties as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 and the rules made thereunder.

1. Lawful Basis & Consent

Personal data is processed only for legitimate purposes with free, specific and informed consent, captured at sign-up and renewed on material purpose changes. Consent can be withdrawn as easily as it was given; withdrawal does not affect prior lawful processing.

2. Purpose Limitation & Data Minimisation

We collect only data needed for matchmaking, safety and billing. Sensitive categories (religion, community, finances) are provided voluntarily by the member for the express purpose of matchmaking.

3. Data Principal Rights & Grievance Redressal

We give effect to the rights of Data Principals: access, correction, erasure, grievance filing and nomination. Grievance Officer: support@vivaha.app — complaints acknowledged within 48 hours and resolved within the period prescribed under the DPDP Rules.

4. Security Safeguards

• TLS encryption in transit; industry-standard hashing for credentials.
• Role-based admin access (Super Admin / Admin / Moderator / Support) with full audit logging.
• Periodic access reviews and automated breach-monitoring on the database layer.

5. Processors & Cross-Border Transfers

Service providers (payment gateway, email, hosting) act as Data Processors under written contracts with confidentiality and security obligations. Transfers outside India occur only where permitted by the Central Government notification under the DPDP Act.

6. Breach Notification

On any personal-data breach we will (a) report to the Data Protection Board of India and affected Data Principals without undue delay as prescribed, and (b) take containment and remediation steps.

7. Retention & Erasure

Data is retained only for the stated purpose. Account deletion triggers erasure within 30 days except statutory records. Requests: App → Profile Settings → Delete Account, or write to the Grievance Officer.

8. Accountability

A senior team member owns DPDP compliance, maintains the processing inventory, and reviews this policy at least annually or upon rule changes.