Overview
The Digital Personal Data Protection Act, 2023 and the rules under it (the "DPDP Act") set out how personal data must be handled in India. Nootus OS is designed to support organizations in meeting their obligations under it. This statement explains how.
Using Nootus does not by itself make an organization compliant. Each organization remains responsible for its own notices, consents and decisions as a data fiduciary.
Who is responsible for what
For the personal data an organization keeps about its employees, customers, vendors and other people it deals with, the organization is the data fiduciary and Nootus is its data processor.
For visitors to this website, people who submit our forms, and the account details of the people who sign in to Nootus, Nootus is the data fiduciary.
What we do as a processor
For an organization's data, Nootus:
- processes it only on the organization's instructions and to provide the Service;
- never uses it to train or fine-tune any AI model;
- keeps each organization's data apart, encrypted in transit and at rest, with an extra layer for PAN, bank details and portal passwords;
- limits its own staff to read-only support access, one record at a time, tied to a ticket and recorded;
- keeps an activity log of who did what, including every AI agent and the person it reports to;
- helps the organization answer requests from data principals to access, correct or erase their data;
- uses only the sub-processors listed on our sub-processors page, and tells organizations before adding one;
- returns or deletes the data when the organization leaves, except what the organization or the law requires us to keep.
What organizations do as fiduciaries
An organization gives its employees, customers, vendors and others the notice the DPDP Act requires, obtains consent where consent is the basis for processing, and decides how long records are kept. Nootus gives organizations the tools to do this: roles and approve permissions, the activity log, the password vault's view log, data export and deletion.
Before messaging its people or vendors on WhatsApp or email through Nootus, an organization must have their opt-in.
Rights of data principals
People whose data is in Nootus can ask for a summary of it, correct it, have it erased when it is no longer needed, withdraw consent, nominate someone, and have grievances addressed. Where an organization is the fiduciary, requests go to the organization and we help it respond. Where Nootus is the fiduciary, write to our Grievance Officer.
Breach notice
If we become aware of a personal data breach affecting an organization's data, we will notify the organization without undue delay and in any case within 72 hours, with what we know, what we are doing and what the organization may need to do. We will help the organization notify the Data Protection Board of India and affected people.
Where Nootus is the fiduciary, we notify the Board and affected people ourselves. Cyber security incidents are also reported to CERT-In within the time its directions require.
Statutory records
Nootus does not file returns on its own. Returns are filed by the organization, after a person in the organization approves them. Books of account, returns and related records are kept for the statutory period on the organization's instruction, and erasure requests for them are handled by the organization with that in mind.
Children's data
Organizations may hold data about minors, for example employees' dependants and nominees in payroll. The organization obtains a parent's or guardian's consent where required. Nootus does not track children or use their data for advertising.
Transfers outside India
Nootus OS is hosted in India. Some services process data outside India, such as WhatsApp (Meta), Google services, Cloudflare Turnstile and an AI provider an organization chooses. We transfer data only as the DPDP Act permits and never to a country the Government of India has restricted.
Grievance Officer
Write to our Grievance Officer at privacy@nootus.ai. We respond within 7 days. If you are not satisfied, you may complain to the Data Protection Board of India.