About Us
ConsentLedger (a product of Manoj Bhagat & Associates) (“ConsentLedger,” “we,” “us,” or “our”) operates consentledger.in — an India-focused, all-in-one consent management platform (CMP) that helps businesses collect, manage, record, and audit user consent in a manner aligned with India's Digital Personal Data Protection Act, 2023 (the “DPDPA”).
This Privacy Policy explains what personal data we collect about our website visitors, registered users, and customers (collectively “Data Principals,” “you,” or “your”), why we collect it, how it is used, with whom it is shared, and the rights you hold under the DPDPA.
Data Fiduciary vs. Data Processor: ConsentLedger acts as a Data Fiduciary for personal data processed on our own platform and website. Where our customers use ConsentLedger on their own websites to collect consent from their end users, those customers are independent Data Fiduciaries for their end users, and ConsentLedger acts as a Data Processor on their behalf under the relevant service agreement.
1. Personal Data We Collect
We collect only the personal data necessary for the specific purposes described in this policy.
| Category | Data Attributes | How Collected |
|---|---|---|
| Identity & Account | Full name, username or display name | Provided at registration or profile setup |
| Contact | Email address, business phone number (optional) | Provided during registration, onboarding, or support |
| Business & Organisation | Company name, website URL(s), business type, industry, GST number (for invoicing) | Provided during account setup or subscription |
| Billing & Payment | Billing address, transaction reference IDs. Card/bank details are processed by our payment gateway and are not stored by ConsentLedger. | Provided at subscription checkout |
| Usage & Technical | IP address, browser type, operating system, device identifiers, pages visited, features accessed, session duration, cookie preferences, consent-log metadata | Collected automatically via cookies and platform logs |
| Consent & Preference Records | Records of consent given or withdrawn on our website (e.g., cookie-banner choices), with timestamps | Captured when you interact with our own cookie banner |
Sensitive Personal Data: We do not knowingly collect sensitive personal data through the normal operation of our platform.
Children: Our platform is not directed at individuals under 18, and we do not knowingly collect data from children; if we learn we have, we delete it promptly. Where a child's personal data is processed under the DPDPA, the Act requires verifiable consent of a parent or lawful guardian and prohibits tracking, behavioural monitoring, and advertising targeted at children.
2. Purposes of Processing
We process your personal data only for specific, clear, and lawful purposes. We rely primarily on your consent, and in limited cases on the legitimate uses permitted under Section 7 of the DPDPA.
| Purpose | Lawful Basis | Retention |
|---|---|---|
| Account & Platform Access | Consent | Duration of account; deleted within 30 days of closure |
| Subscription & Billing | Consent / Legitimate Use (legal & tax) | 7 years (GST & accounting law) |
| Support & Grievance Redressal | Consent / Legitimate Use | 3 years from closure of the request |
| Service Communications | Legitimate Use | Duration of account |
| Marketing (optional) | Consent (opt-in) | Until withdrawal or opt-out |
| Website Analytics & Performance | Consent (via cookie banner) | 13 months; aggregated data may be kept longer |
| Security & Fraud Prevention | Legitimate Use | 1 year from detection; extended if legally required |
| Legal & Regulatory Compliance | Legitimate Use | As mandated by law or order |
3. Consent and Grounds of Processing
Consent (Section 6, DPDPA): For most processing, we rely on your freely given, specific, informed, and unambiguous consent. We present a clear notice before collection, you may withdraw consent at any time (without affecting prior lawful processing), and we do not bundle consent for services that do not require it.
Legitimate Uses (Section 7, DPDPA): In limited cases we process data as a legitimate use — e.g., where you voluntarily provided data for a specified purpose, to comply with law or orders of courts and tribunals, or for employment-related obligations.
4. Sharing of Personal Data
We do not sell your personal data. We share it only with the service providers (sub-processors) needed to operate the platform:
| Recipient | Data Shared | Location |
|---|---|---|
| Cloud hosting & database | Account, platform & consent data, logs | India (Mumbai) |
| Payment gateway | Billing name & address, transaction amount | India |
| Transactional email | Name, email, message content (OTPs, alerts, invoices) | Outside India |
| SMS / OTP delivery | Phone number | Outside India |
| Error monitoring (Sentry) | Technical diagnostics (PII scrubbed) | EU (Frankfurt) |
| Web analytics (Google Analytics) | Usage & device data (loaded only after consent) | Outside India |
| Legal authorities | Only where compelled by a lawful order | As required by law |
5. Where Your Data Is Stored & Cross-Border Transfers
Data residency: Your personal data is stored and processed in India — our database and application compute are both hosted in Mumbai (ap-south-1 / bom1). Any transfer to sub-processors outside India is carried out in compliance with the DPDPA and only to countries not restricted under the DPDPA.
6. Data Retention and Deletion
- Account data: Duration of your account; deleted or anonymised within 30 days of closure.
- Billing & transaction records: 7 years, as required under the GST Act and Indian accounting rules.
- Consent & audit logs: 3 years from the consent event, to enable audit and verification.
- Support, grievance & rights-request records: 3 years from closure of the interaction.
- Analytics data: Raw data for 13 months; aggregated insights may be kept longer.
7. Your Rights as a Data Principal
- Right to Access Information: Obtain a summary of the personal data we process about you, the purposes, and third parties it has been shared with.
- Right to Correction & Erasure: Have inaccurate or incomplete data corrected, and request erasure where data is no longer needed.
- Right to Withdraw Consent: Withdraw consent at any time.
- Right to Grievance Redressal: Raise a grievance about our handling of your data or rights (resolved within 30 days).
- Right of Nomination: Nominate another individual to exercise your data rights in the event of your death or incapacity.
8. How to Submit a Request
To exercise any right or raise a privacy grievance, email our Data Protection Officer at our Contact Page (or our Grievance Officer at grievance@consently.in).
9. Cookies and Tracking Technologies
Our cookies fall into Essential, Analytics, Functional, and Marketing categories. You can change your choices at any time through our Cookie Settings banner or read our Cookie Policy.
10. Security of Personal Data
We apply TLS/HSTS encryption in transit, AES-256 encryption at rest, field-level email encryption (AES-256-GCM matched via SHA-256 hash), role-based access control, tamper-resistant audit logging, and Indian data residency in Mumbai.
11–14. Contact & Data Protection Officer
The Data Fiduciary responsible for your personal data is ConsentLedger, operated by Manoj Bhagat & Associates.
- Data Protection Officer: Sushant Aggarwal (our Contact Page)
- Grievance Officer: grievance@consently.in
- Registered Office: Manoj Bhagat & Associates, Greater Kailash (GK), Delhi, India