DPDP Notice

Scope

This notice covers digital personal data processed through the AnalyticsM website, our sales and support operations, and the Quallix Audit and Quallix Assist platforms.

It does not change the terms of any data processing agreement already signed with a customer, and it does not apply to data that has been irreversibly anonymised or aggregated so that no individual is identifiable.

Data Principal rights under the DPDP Act

Subject to the conditions in the Act, a Data Principal may:

• obtain a summary of the personal data being processed and the processing activities undertaken;
• obtain the identities of other Data Fiduciaries and processors with whom the data has been shared, and a description of what was shared;
• request correction, completion, updating or erasure of personal data;
• nominate another individual to exercise these rights in the event of death or incapacity;
• have a readily available means of grievance redressal, and escalate to the Data Protection Board of India if unresolved.

How we act as Data Fiduciary or Data Processor

We are a Data Fiduciary for the personal data we decide the purpose of: enquiry and demo requests, marketing contacts, our own employees and vendors, and website diagnostics.

We are a Data Processor when we handle conversation data on behalf of a customer. In that role the customer is the Data Fiduciary; they determine purpose, retention and consent, and we process only on their documented instructions. We assist them with Data Principal requests, security safeguards, breach notification and deletion on termination.

Consent and notice

Where we rely on consent as a Fiduciary, we ask for it in clear language, limited to the purpose stated, and it can be withdrawn as easily as it was given by writing to privacy@analyticsm.com.

For recorded calls, the notice and consent obligation sits with our customer, who controls the call. Quallix supports this with configurable disclosure prompts, consent capture fields, and redaction of sensitive identifiers before transcripts are stored. We process the personal data of children only where our customer confirms a lawful basis for doing so; the platform is not designed or marketed for that purpose.

Reasonable security safeguards

We maintain encryption in transit and at rest, tenant isolation, role-based access with multi-factor authentication, logging of access to conversation content, periodic access reviews, and vendor due diligence for every sub-processor.

Where a customer requires data to stay in India, we can host their tenant in an Indian region and record that commitment in the agreement.

Personal data breach handling

We maintain an incident response process covering detection, containment, assessment and notification. If a breach affects personal data we process for a customer, we notify that customer without undue delay with the facts known at the time, and support their obligations to the Data Protection Board and affected Data Principals.

Grievance redressal

Write to our grievance contact at privacy@analyticsm.com, or by post to the Grievance Officer, Aashiva Analytics Private Limited, E-42, 9th Floor, Tower - C, Logix Cyber Park, Noida 201301, UP, India.

We acknowledge grievances promptly and aim to resolve them within the period prescribed under the DPDP Act and its rules. If your data reached us through one of our customers, we will route your grievance to that Data Fiduciary and tell you we have done so. If you remain dissatisfied, you may approach the Data Protection Board of India.