India Privacy Policy
Introduction
DolRise is a global platform built on principles of dignity, trust, and responsible technology. This India Privacy Policy explains how DolRise collects, uses, stores, and protects personal data of users located in India, in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act).
DolRise recognises that personal data represents more than technical information. It reflects individual identity, behaviour, and personal context. For this reason, DolRise processes personal data with care, proportionality, and respect for user autonomy.
This India Privacy Policy operates alongside the DolRise Global Privacy Policy. Where additional obligations apply under Indian law, this policy provides region-specific disclosures and safeguards relevant to users in India.
Under the DPDP Act, DolRise acts as a Data Fiduciary, while users are recognised as Data Principals. This means DolRise processes personal data only for lawful purposes, with user consent where required, and with clear accountability.
DolRise may rely on global technical infrastructure to deliver its services, including systems used for security, payments, and operational reliability. Where personal data is processed outside India, appropriate safeguards are applied to ensure continued protection and compliance with applicable law.
Certain categories of data, such as identity verification information (KYC) and financial details, are processed only where necessary and are protected using strong security measures, including encryption and restricted access.
This policy represents DolRise’s commitment to transparency, user control, and lawful data handling for individuals located in India.
Scope and Applicability
This India Privacy Policy applies to individuals located in the Republic of India whose personal data is processed by DolRise, in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act).
This policy applies where DolRise collects, uses, stores, or otherwise processes personal data in connection with the provision of its services, including when users create an account, interact with content, complete identity verification (KYC), access monetisation features, or use platform functionality from within India.
This policy also applies where personal data relating to users in India is processed outside India as part of DolRise’s global infrastructure, provided that such processing is subject to appropriate safeguards and lawful transfer mechanisms.
This India Privacy Policy does not apply to anonymised data that cannot reasonably be linked to an identifiable individual, or to third-party services that are not operated or controlled by DolRise, even if such services are accessible through the platform.
In the event of any conflict between this India Privacy Policy and the DolRise Global Privacy Policy, this India Privacy Policy shall prevail to the extent required by applicable Indian law. Where no conflict exists, both policies operate together.
DolRise may update this policy from time to time to reflect changes in legal requirements, platform functionality, or data protection practices. Material updates will be communicated in a clear and reasonable manner.
Consent and Lawful Basis for Processing
Under the Digital Personal Data Protection Act, 2023 (DPDP Act), consent is the primary basis on which DolRise processes personal data. DolRise seeks clear and informed consent from users before collecting or processing personal data, except where processing is permitted or required by law.
DolRise requests consent at relevant points of interaction, including when users create an account, complete identity verification (KYC), access monetisation features, or use services that require personal data for proper functionality.
Consent provided to DolRise is specific, informed, and unambiguous. Users are informed of the purpose for which their personal data is collected and may withdraw consent at any time. Where consent is withdrawn, DolRise will stop processing the relevant personal data unless retention is required by applicable law.
In certain circumstances, DolRise may process personal data without explicit consent where such processing is permitted under the DPDP Act. This includes processing necessary to comply with legal obligations, protect the security of the platform and its users, prevent fraud or misuse, or perform a lawful contract with the user.
Regardless of the lawful basis relied upon, DolRise limits the processing of personal data to what is necessary and proportionate for the stated purpose. Personal data is not processed for unrelated or excessive purposes.
Users located in India retain the right to manage their consent preferences and exercise control over their personal data, in accordance with applicable law.
Children’s Data
DolRise takes the protection of children’s personal data as a matter of heightened legal and ethical responsibility. This section applies to the processing of personal data relating to children in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act).
For the purposes of this policy, a child is an individual who has not attained the age specified under applicable Indian law. DolRise does not knowingly collect or process personal data relating to children unless such processing is strictly necessary and permitted by law.
Where the processing of a child’s personal data is required, DolRise ensures that verifiable consent is obtained from a parent or lawful guardian before such processing takes place. Personal data relating to children is collected only for limited and clearly defined purposes.
DolRise does not use children’s personal data for targeted advertising, behavioural profiling, or any form of automated decision-making that could reasonably result in harm to a child’s well-being, safety, or development.
Additional safeguards are applied to the processing of children’s data, including enhanced security controls, restricted access, and stricter data minimisation practices.
Parents or lawful guardians may exercise their rights on behalf of a child, including the right to request access to personal data, seek correction or erasure, withdraw consent, or request restriction of processing, in accordance with applicable law.
DolRise’s approach to children’s data is guided by the principle of prioritising the best interests of the child and ensuring a safe and respectful digital environment.
Rights of the Data Principal
In accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), individuals located in India whose personal data is processed by DolRise are recognised as Data Principals and are entitled to exercise specific rights in relation to their personal data.
Data Principals have the right to obtain confirmation regarding whether DolRise processes their personal data, and to receive information about the nature of such data, the purposes for which it is processed, and the categories of recipients with whom it may be shared.
Where personal data is inaccurate, incomplete, or outdated, Data Principals have the right to request correction or updating of such data. DolRise will take reasonable steps to ensure that personal data is accurate and up to date.
Data Principals may request the erasure of their personal data where such data is no longer necessary for the purpose for which it was collected, where consent has been withdrawn, or where processing is otherwise not permitted under applicable law. DolRise may retain certain data where retention is required to comply with legal obligations or to protect its legitimate interests.
Data Principals have the right to withdraw consent previously provided for the processing of personal data. Withdrawal of consent will not affect the lawfulness of processing carried out prior to such withdrawal.
Data Principals may submit grievances or complaints regarding the processing of their personal data. DolRise encourages users to raise concerns directly so that they may be addressed in a timely and transparent manner.
The exercise of these rights may be subject to reasonable verification and to limitations prescribed by applicable law, including where necessary for security, legal compliance, or the protection of the rights of others.
Data Retention and Storage
DolRise retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required to comply with applicable legal, regulatory, or contractual obligations under the Digital Personal Data Protection Act, 2023 (DPDP Act).
Personal data is not retained indefinitely. Where the purpose for processing has been fulfilled, where consent has been withdrawn, or where an account is closed, DolRise initiates deletion, anonymisation, or de-identification processes unless retention is required by law.
Different categories of personal data may be subject to different retention periods. For example, account-related data is retained while an account remains active, while identity verification (KYC) and financial records may be retained for longer periods where required by financial, anti-fraud, or regulatory obligations.
DolRise also retains certain security and system log data for limited periods to protect the platform, detect misuse, investigate incidents, and maintain service integrity. Such data is retained only for as long as reasonably necessary for these purposes.
Personal data is stored using technical and organisational safeguards designed to protect against unauthorised access, loss, alteration, or disclosure. These safeguards include encryption, access controls, and regular security reviews.
Where third-party service providers are engaged to store or process personal data, DolRise ensures that such providers are bound by contractual obligations to protect personal data and comply with applicable data protection laws.
Upon expiry of applicable retention periods, personal data is securely deleted or irreversibly anonymised in accordance with DolRise’s internal data governance policies.
Data Security Measures
DolRise implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure, in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act).
Technical safeguards include the use of encryption for data at rest and in transit, access control mechanisms to limit data access to authorised personnel and systems, and continuous monitoring of infrastructure to detect and respond to security risks.
Organisational safeguards include internal policies governing data handling, staff training on privacy and security obligations, and role-based access restrictions to ensure that personal data is accessed only where necessary.
Personal data considered sensitive, including identity verification (KYC) information, financial details, and account security data, is subject to enhanced protection measures and stricter access controls.
Where third-party service providers are engaged to process or store personal data, DolRise ensures that such providers are contractually required to implement appropriate data security measures and to comply with applicable data protection laws.
In the event of a personal data breach, DolRise will take prompt steps to mitigate potential harm, investigate the incident, and comply with any notification obligations required under applicable law.
While no system can guarantee absolute security, DolRise continuously reviews and improves its security practices to reduce risks and protect user data.
Cross-Border Data Transfers
DolRise operates as a global platform and may process certain categories of personal data using technical infrastructure located outside India. Such transfers are undertaken only where necessary to provide secure, reliable, and consistent services.
Any transfer of personal data outside India is carried out in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act), and subject to applicable legal requirements and government directions relating to cross-border data transfers.
DolRise ensures that appropriate safeguards are in place to protect personal data transferred outside India. These safeguards may include contractual obligations, organisational controls, and technical security measures designed to maintain a level of protection consistent with this India Privacy Policy.
Personal data may be transferred to third-party service providers located outside India for purposes such as data hosting, payment processing, fraud prevention, and platform security. Such providers are selected based on their ability to meet applicable data protection and security standards.
DolRise does not permit international data transfers for purposes unrelated to the delivery, protection, or lawful operation of its services. Transfers are limited to what is necessary and proportionate.
Regardless of where personal data is processed, users located in India continue to benefit from the protections described in this policy and retain their rights under applicable law.
Grievance Redressal and Contact Information
DolRise is committed to addressing questions, concerns, and grievances relating to the processing of personal data in a fair, timely, and transparent manner, in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act).
Users located in India who have concerns regarding the collection, use, storage, or protection of their personal data may submit a grievance to DolRise using the contact details provided below. DolRise encourages users to contact the platform directly as a first step to enable prompt resolution.
DolRise will acknowledge receipt of grievances and make reasonable efforts to respond and resolve concerns within a reasonable timeframe, taking into account the nature and complexity of the request.
Where a grievance relates to the exercise of rights under the DPDP Act, DolRise may require reasonable verification of the identity of the requester before processing the request, in order to protect personal data and prevent unauthorised access.
If a user is not satisfied with the response provided by DolRise, they may have the right to escalate the matter to the appropriate authority, in accordance with applicable Indian law.
Contact for India Privacy Matters:
Email: [email protected]