Privacy Notice (DPDP Act 2023 & DPDP Rules 2025)
Version 1.0 · Template — have it reviewed by your legal counsel before launch.
Data Fiduciary: Project Carbon Private Limited · Contact: privacy@projectcarbon.in
1. What we collect & why (purpose-limited)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, mobile, state | Account, communication | Consent | Until erasure + 1 year logs (Rule 8) |
| Photos, GPS of nature actions | Verify work, issue points, project MRV | Consent (separate) | Project crediting period (registry requirement) |
| Masked PAN, UPI/bank last 4 | Payouts, TDS, KYC | Legal obligation | As required by Income-tax law |
| GSTIN, invoices, orders | GST invoicing & returns | Legal obligation | 72 months (s.36 CGST Act) |
| Public profile (name, city, grade, work) | Nature Hero wall | Consent (optional) | Until you switch it off |
2. Your rights
Access a summary of your data, correct or erase it, nominate a person, withdraw any consent as easily as you gave it, and raise a grievance — all from My Profile → Privacy. We respond within the timelines prescribed under the DPDP Rules.
3. Children
Users under 18 are activated only after verifiable consent from a parent/guardian. We do not track, profile or show targeted advertising to children, and their profiles are never public.
4. Security
Encryption in transit (TLS), hashed passwords, masked identifiers, role-based access, access logs retained for at least one year, and breach intimation to the Data Protection Board and affected users within the prescribed time (72 hours for the detailed report).
5. Sharing
Only with processors under contract (payment aggregator, KYC, cloud hosting in India, GSP for e-invoicing), carbon registries/verifiers (project data, not personal contact details where avoidable), and authorities when legally required. We never sell personal data.
6. Grievance
Grievance Officer, Project Carbon (grievance@projectcarbon.in). If unresolved, you may approach the Data Protection Board of India.