Privacy Notice

This notice applies to everyone who visits Notepoint, opens an account, contacts us, submits a technical brief or buys an engagement. It is written against the Digital Personal Data Protection Act, 2023 (the DPDP Act) and the reasonable-security practices required under the Information Technology Act, 2000.

Two terms from the Act appear throughout. You are the Data Principal: the person the data is about. We are the Data Fiduciary: the organisation that decides why and how your data is processed, and that is accountable for looking after it.

It does not cover websites we link to, third-party platforms you sign into separately, or systems that belong to you and that we work inside during an engagement. Section 6 explains that last case.

The Data Fiduciary is NOTEPOINT TECHNOLOGY PRIVATE LIMITED, C-25, OLD PLOT NO-14, GALI NO-5, Guru Nanak Pura, Lakshmi Nagar, New Delhi, East Delhi, Delhi, 110092..

Formal requests and complaints go to the Grievance Officer described in section 16. Each request is owned by a named person from the moment it arrives until it is closed.

Five categories, and nothing beyond what a professional services business needs.

• Account data: name, email address, mobile number, business name where you give one, and a one-way hash of your password. Passwords are never held in readable form, so nobody can read yours back from our database, including us.
• Billing data: billing name, address, city, state, PIN code and, where you supply it, your GSTIN. We need these to raise a compliant tax invoice.
• Order data: the engagements bought, amounts, order numbers, payment status, gateway transaction references, invoices and refund records.
• Technical brief content: what you write into the brief so the work can be done, such as repository and environment names, architecture notes, the problem being solved, access instructions and any files you attach. This is mostly commercial information, though it often contains names and work email addresses.
• Site and device data: IP address, browser and device type, pages viewed, referring source and approximate location, collected through server logs and, where enabled, analytics.

We do not collect or store card numbers, CVV codes, UPI PINs or net-banking credentials. We do not ask for identifiers such as Aadhaar or PAN unless a specific legal requirement makes it unavoidable, and we would tell you why at the time.

Each purpose below is specific. Data gathered for one purpose is not quietly reused for another; that is what purpose limitation means in practice.

We do not build advertising profiles, run behavioural retargeting, or sell, rent or trade personal data to anyone.

We rely on two grounds under the DPDP Act.

• Consent: free, specific, informed and unambiguous, taken when you submit a form, open an account, complete a brief or tick a subscription box. Each request tells you what the data is for before you give it.
• Legitimate uses: processing needed to perform the engagement you paid for, and processing required by law, such as tax record-keeping.

You may withdraw consent at any time, and doing so is as easy as giving it. Withdrawal does not undo processing already carried out lawfully, and it does not release either of us from records the law requires us to keep, but it stops further processing that relied on consent. If withdrawal would make it impossible to continue an engagement you have paid for, we will say so plainly before acting.

Marketing consent is separate from everything else. Refusing it never affects an order, and every marketing email carries an unsubscribe link that we honour.

We can be in one of two roles, and it matters which.

• Your data, held by us. Account, billing, order and brief data sits in our systems, and we are the Data Fiduciary for it. The rest of this notice describes that.
• Data about your users, held in your systems. When an engagement takes us inside your repositories, databases or cloud accounts, you remain the Data Fiduciary and we act only on your documented instructions. Where that work involves personal data, we agree a data processing agreement with you before it starts, covering purpose limitation, security, sub-processing, breach notification and deletion at the end.

Our working preference is not to handle your production personal data at all. We ask for anonymised, masked or synthetic data by default. Where live access is genuinely unavoidable, it should be named, least-privilege, time-limited and revoked at handover.

Personal data goes to processors who help us run the business, only for the stated purpose, and only under contracts that oblige them to protect it. We list them by category rather than by brand, because a supplier can change while the category and the safeguards stay the same.

Beyond those categories, data reaches the people working on your engagement, limited to the brief and the access the work needs; our accountants and auditors, for statutory filings; and a government body, court or law-enforcement agency where a valid legal process requires it. In that last case we ask for the demand in writing, disclose only what is compelled, and tell you unless we are legally barred from doing so.

No processor may use your data for its own purposes.

Some of our processors, particularly for hosting, email delivery and analytics, may run infrastructure outside India, so a limited amount of personal data may be processed abroad.

Where that happens, we transfer data only to countries not restricted by the Central Government under section 16 of the DPDP Act, keep the transfer to what the purpose needs, and require the processor to protect the data to the standard this notice describes. If a restriction is introduced, we move the processing.

Data is kept only as long as its purpose needs or the law requires, and is then deleted or irreversibly anonymised.

If you ask for erasure, we delete everything we are not legally required to keep, and tell you what had to stay and under which obligation.

We describe what we actually do, rather than point to badges.

• The site is served over HTTPS, so data in transit is encrypted.
• Passwords are stored as salted one-way hashes and cannot be recovered, including by us.
• Forms are protected against cross-site request forgery.
• Payment credentials never touch our servers, so there is nothing of that kind to take.
• Access to customer data is limited to the people who need it for the work, and is reviewed when their role changes.
• Client credentials are not accepted over chat or email.
• Everyone working on client material is bound by confidentiality obligations.

No system is perfectly secure. If you find a weakness in this site, tell us and we will investigate and fix it, and credit you if you would like the credit.

We use a small number of cookies and similar browser storage, in two groups.

• Strictly necessary: session and security cookies that keep you signed in, keep your selection between pages and protect forms. The site does not work without them, so they do not require consent.
• Analytics: used only where analytics is enabled, to count page views and find broken journeys. They are pseudonymous and, where consent is required, run only after you give it.

Your selection of engagements is held in your own browser storage rather than on our servers, so clearing site data removes it. You can block or clear cookies in your browser at any time.

Under the DPDP Act you can ask us for the following.

• Access: a summary of the personal data we hold about you, what we do with it, and which categories of processor have received it.
• Correction: fix anything inaccurate, complete anything incomplete and update anything out of date.
• Erasure: delete data no longer needed for the purpose it was collected for, subject to the legal retention described in section 9.
• Withdrawal of consent: for any processing that relies on consent.
• Nomination: name another person to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal: a readily available way to complain to us before going anywhere else.

The Act also sets duties for Data Principals: provide authentic information, do not impersonate anyone, and do not file false or frivolous complaints.

How to exercise a right. Write to Rahul and Sabhajit, our Grievance Officer, at care@noteepoiint.com from the email address on your account and say which right you want to exercise. We may ask a question or two to confirm your identity before acting. We respond within the period the Act and its rules prescribe, and if a request needs longer we tell you why and when to expect an answer.

Exercising these rights is free.

Our engagements are sold to businesses, and this site is not directed at children. We do not knowingly collect personal data from anyone under 18, and we do not track, profile or target advertising at children.

If a child has given us data, tell us and we will delete it. Where an account has to be operated on behalf of a child, or of a person with a disability who has a lawful guardian, verifiable consent from the parent or guardian is required first, as the DPDP Act sets out.

If a personal data breach occurs, we investigate and contain it, and notify the Data Protection Board of India and each affected Data Principal in the form and within the time the DPDP Act and its rules require.

Our notice to you will explain, in plain language, what happened, which data was involved, the likely consequences, what we have done and what we suggest you do.

We update this notice when our processing or the law changes. The date at the top always reflects the current version, material changes are flagged on this page, and where a change needs fresh consent we ask for it rather than assume it. Earlier versions are available on request.

For any privacy question, data request or complaint:

• Grievance Officer, Rahul and Sabhajit: care@noteepoiint.com · 9599184870
• General support: care@noteepoiint.com
• By post: C-25, OLD PLOT NO-14, GALI NO-5, Guru Nanak Pura, Lakshmi Nagar, New Delhi, East Delhi, Delhi, 110092.

Complaints are handled within the timelines set out on the grievance redressal page, which also lists the external bodies you can approach.

If our answer does not resolve your complaint, you may approach the Data Protection Board of India once you have raised the matter with our Grievance Officer. This notice is governed by the laws of India.