DPDP Act, 2023 Statutory Notice

Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023, India) • Itemised Notice • Data Principal Rights • Grievance Redressal

Preamble & Scope

This statutory notice is issued by AcadKits Technologies ("Data Fiduciary", "We", "Us") in compliance with Section 5 of the Digital Personal Data Protection Act, 2023 (DPDP Act). It governs the digital personal data of all registered users, creators, students, developers, and website visitors ("Data Principals") across acadkits.dev and tools.acadkits.dev.

1. Itemised Notice: Personal Data Collected & Purpose Specification (Section 5)

In accordance with Section 5(1), personal data is processed solely for specified, explicit, and lawful purposes:

Category of Personal Data	Specific Purpose of Processing	Legal Basis (DPDP)
Account & Authentication Full name, email address, password hashes, OAuth tokens	User identity verification, secure account access via Supabase Auth, and account security notices.	Consent (Sec. 6)
Billing & Transaction Identifiers Billing address, phone number, GSTIN, Razorpay subscription tokens	Tax invoicing, GST statutory compliance, recurring subscription fulfillment, and fraud prevention.	Legal Duty / Consent (Sec. 6 & 7)
Deployment & Compute Telemetry GitHub repository URLs, build error logs, container metrics, egress bandwidth	Building and hosting containerized web applications on AcadSites, enforcing tier quota safeguards, and host stability.	Service Delivery (Sec. 6)
Security & Network Logs IP addresses, browser user-agents, request timestamps	DDoS mitigation, web application firewall (Cloudflare) filtering, detecting unauthorized intrusions, and legal defense.	Legitimate Use (Sec. 7)
Student Developer Credentials College/University name, institutional email (.edu/.ac.in), Student ID card photo	Authenticating student enrollment eligibility for the ₹49/month Student Pass. ID cards are reviewed confidentially, never sold or shared, and purged upon review or upon student deletion request.	Explicit Consent (Sec. 6 & 9)

2. Consent Architecture & Right of Withdrawal (Section 6)

Consent given by the Data Principal is free, specific, informed, unconditional, and unambiguous with clear affirmative action.

Ease of Withdrawal (Section 6(4)): You have the statutory right to withdraw consent at any time as easily as it was given. You may withdraw consent through your Account Dashboard or by submitting a request to contact@acadkits.dev (Subject: Attn: DPDP Consent Withdrawal).
Effect of Withdrawal: Upon withdrawal of consent, AcadKits will cease processing your personal data unless retention is required by Indian law (e.g., tax records or IT Act logs).
Consent Managers: You may give, manage, review, or withdraw consent through any registered Consent Manager recognized by the Data Protection Board of India.

3. Special Protections for Children & Persons with Disabilities (Section 9)

Strict Statutory Compliance under Section 9 of the DPDP Act, 2023:

Definition of Child: Under Indian law (DPDP Act § 2(f)), a "child" means an individual who has not completed 18 years of age.
Verifiable Parental Consent (§ 9(1)): AcadKits does not knowingly process the personal data of any individual under 18 years of age without verifiable consent of their parent or lawful guardian.
Absolute Ban on Behavioral Tracking (§ 9(2)): AcadKits does not undertake tracking, behavioral monitoring, or profiling of children across any tools or hosted sites.
Absolute Ban on Targeted Advertising (§ 9(3)): AcadKits does not serve targeted advertisements directed at children.
Detrimental Well-being Prohibited: No data processing that is likely to cause any detrimental effect on the well-being of a child is permitted.

4. Data Principal Statutory Rights (Sections 11–14)

As a Data Principal, you are entitled to exercise the following statutory rights under the DPDP Act:

Right to Access Information (Sec. 11)

Request a summary of personal data being processed, processing activities, and identities of all other Data Fiduciaries / Processors with whom your data has been shared.

Right to Correction & Erasure (Sec. 12)

Request correction of inaccurate/misleading data, completion of incomplete records, updating, and permanent erasure of data when the specified purpose is complete.

Right of Grievance Redressal (Sec. 13)

Have your privacy grievances redressed by our Grievance Officer within a 30-day statutory window before escalating to the Data Protection Board.

Right to Nominate (Sec. 14)

Designate an authorized nominee who shall, in the event of your death or incapacity, exercise your data protection rights under the Act.

Self-Service Data Rights Request

Submit an instant statutory request to access, correct, or erase your account data.

Access Data in Dashboard →

5. Grievance Redressal Officer & Dispute Escalation (Section 13)

In compliance with Section 8(9) and Section 13 of the DPDP Act 2023, AcadKits has appointed a dedicated Grievance Redressal Officer:

Designation: Data Protection & Grievance Redressal Officer

Organization: AcadKits Technologies

Physical Address: Legal & Compliance Office, Sector 15, Gandhinagar, Gujarat, India 382015

Dedicated Statutory Email: contact@acadkits.dev (Subject: Attn: Grievance Officer)

Statutory Escalation Roadmap:

Grievance Submission: Send your complaint to contact@acadkits.dev (Subject: Grievance Redressal) with full identification details and the specific nature of your grievance.
Acknowledgment: We issue a formal acknowledgment with a tracking ticket number within 48 hours.
Resolution Window: The Grievance Officer will investigate and resolve the issue within 30 days.
Escalation to Data Protection Board of India (DPBI): If you do not receive a response within 30 days or are unsatisfied with the resolution, you hold the statutory right under Section 13(3) of the DPDP Act to make an official complaint to the Data Protection Board of India.

6. Statutory Duties of the Data Principal (Section 15)

Every Data Principal using AcadKits has legal duties under Section 15 of the DPDP Act, 2023:

No Impersonation (§ 15(a)): You shall not impersonate another individual when providing personal data.
No Suppression of Material Info (§ 15(b)): You shall not suppress any material information while providing personal data for government identifiers or registrations.
No Frivolous Grievances (§ 15(c)): You shall not register false, frivolous, or vexatious grievances with AcadKits or the Data Protection Board.
Authentic Information (§ 15(d)): You shall furnish only authentic and verifiably correct information when exercising your rights.

Statutory Notice pursuant to DPDP Act, 2023 (Republic of India)

Last Revised: September 22, 2026 • Published by AcadKits Technologies Compliance Office