Data Protection: GDPR and India DPDP Act

This notice explains how Ekayan Consultancy Private Limited protects personal data under the European Union General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDP Act). It builds on our Privacy Policy and Cookie Policy and sets out the rights framework, lawful bases, and safeguards for these two regimes in one place, so you can see how we meet our obligations.

1. Who is responsible for your data

Ekayan Consultancy Private Limited is the data controller under GDPR and the Data Fiduciary under the DPDP Act, registered at Eva-I Complex, 201, Aatabhai Chowk, Hill Drive, Bhavnagar, Gujarat 364001, India. Our Grievance and Data Protection contact is Nirav Solanki, Grievance Officer, [email protected], and he is your first point of contact for any data question. Support runs 1:30 PM to 10:30 PM IST, Monday to Saturday, by email and live chat only.

2. Categories of data we process

We process account data (such as name and email), billing data, support communications, technical and usage data, and, where you enable it, data from a monitored device such as location and activity logs. The full detail of what we collect and why is in our Privacy Policy.

3. Lawful basis for processing

We process personal data only where we have a lawful basis: your consent; the performance of our contract with you; compliance with a legal obligation; or a legitimate interest that does not override your rights, such as keeping the service secure. Because location and device data can be sensitive, we rely on consent for that data unless the law provides another basis, and you can withdraw consent at any time.

4. Consent management

Where we rely on consent, we ask for it clearly and keep it separate from other terms, and we make withdrawing consent as easy as giving it. Withdrawing consent stops the related processing going forward but does not affect processing already carried out lawfully.

5. Your rights

6. How to exercise your rights

Contact Nirav Solanki, Grievance Officer, at [email protected] with your request. Support is available 1:30 PM to 10:30 PM IST, Monday to Saturday, by email and live chat only. We may need to verify your identity to protect your data. We respond within the timelines the law requires, and we complete verified deletion requests within 30 days. We will tell you if we need more time or cannot fully act on a request, with our reasons. Exercising your rights is free in normal cases.

7. Children's data

Where our product is used by a parent to monitor a minor, the parent, as the responsible adult, holds the account. We handle any data involved with care and in line with the law that protects children's data, and we do not use it for our own marketing.

8. Security measures

We apply technical and organisational measures designed to protect personal data, including encryption in transit, access controls, logging, and staff training. We review these measures over time and after any incident. No system is perfectly secure, but we work to reduce risk and to respond quickly if something goes wrong.

9. Sub-processors

We host and process data with a small number of named providers: DigitalOcean (website hosting), Amazon Web Services (app distribution and app hosting) and Hetzner (monitoring data storage). We use trusted service providers, such as hosting and payment processors, to help run the service. We put contracts in place that require them to protect your data and to process it only on our instructions. They are not permitted to use your data for their own purposes.

10. Data retention

We keep personal data only as long as needed for the purpose it was collected or as the law requires, then delete or anonymise it. Retention periods depend on the type of data and the legal duties that apply, for example longer for billing records than for support messages.

Data collected from a monitored device is held on a rolling window that depends on your plan: 30 days on the free plan and 90 days on Premium. Entries older than that window are removed automatically. Verified account and data deletion requests are completed within 30 days.

11. International transfers

Where we transfer data across borders, we use the safeguards required by GDPR and by Indian law, such as appropriate contractual protections, so your data stays protected wherever it is processed.

12. Automated decision making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without a lawful basis and appropriate safeguards.

13. Data breaches

If a personal data breach is likely to affect your rights, we will notify the relevant authority and, where required, you, within the timeframes the law sets, and we will act to limit any harm.

14. Complaints

Please contact our Grievance and Data Protection contact first: Nirav Solanki, Grievance Officer, [email protected], available 1:30 PM to 10:30 PM IST, Monday to Saturday, by email and live chat only. EU and EEA users may also complain to their local supervisory authority. Indian users may approach the Data Protection Board of India. We would always prefer the chance to resolve your concern directly first.