Digital Personal Data Protection Act, 2023

Our role under DPDP Law

For the purposes of the DPDP Law, BridgeBeyond is the Data Fiduciary in respect of personal data collected through the BridgeBeyond Platform and is responsible for its lawful processing. Where BridgeBeyond processes personal data solely on behalf of another organisation, it acts as a Data Processor in accordance with that organisation’s instructions and applicable contractual obligations.

Lawful bases for processing

BridgeBeyond processes personal data on one or more of the following lawful bases under the DPDP Law:

• Consent — where you have given free, specific, informed and unambiguous consent for a specific processing activity.
• Legitimate Uses — where processing is necessary for a legitimate use recognised under the DPDP Law, including the performance of a contract to which you are a party, compliance with a legal obligation, or the performance of a function under law.
• Legal Obligation — where processing is required to comply with applicable Indian law, judicial orders or regulatory requirements.
• Employment and related purposes — where processing is necessary in connection with employment, recruitment, assessment, or the provision of services related to workforce mobility.

Your rights as a Data Principal

Under the DPDP Law, you have the following rights in respect of your personal data processed by BridgeBeyond:

• Right to access — to obtain a summary of the personal data we hold about you and the purposes for which it is being processed.
• Right to correction and erasure — to have inaccurate or incomplete personal data corrected, and to have personal data erased where it is no longer necessary for the purpose for which it was collected or where consent has been withdrawn, subject to any legal or regulatory retention obligations.
• Right to grievance redressal — to have any grievance relating to the processing of your personal data addressed by our Grievance Officer within the timelines prescribed under the DPDP Law.
• Right to nominate — to nominate an individual to exercise your rights in the event of your death or incapacity.
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal may affect your ability to continue using certain Services.

To exercise any of these rights, please contact our Grievance Officer using the details in the Contact section below or via our contact page.

Your obligations as a Data Principal

Under the DPDP Law, you are required to:

• provide only accurate and authentic personal data to BridgeBeyond;
• not impersonate another individual or provide false information;
• not suppress material information that may affect BridgeBeyond’s ability to render services; and
• comply with applicable Indian law when exercising your rights under the DPDP Law.

Children’s personal data

In accordance with Section 9 of the DPDP Law, BridgeBeyond does not process the personal data of a child (any individual below 18 years of age) without obtaining verifiable consent from a parent or lawful guardian, except where another lawful basis is recognised under applicable law. We do not use children’s personal data for behavioural profiling or targeted advertising.

Personal data breaches

In the event of a personal data breach that is likely to result in harm to you, BridgeBeyond will notify the Data Protection Board of India and, where required, affected individuals within the timelines prescribed under the DPDP Law and any rules framed thereunder.

Grievance Officer

For the purposes of the DPDP Law, BridgeBeyond has designated a Grievance Officer to address data-related complaints and requests:

Name: Girish Singhania
Designation: Founder & CEO
Email: support@bridgebeyond.in
Postal Address: 1/1, Pollock Street, Kolkata, West Bengal, India, 700001

We will acknowledge your complaint within three business days and endeavour to resolve it within thirty days of receipt.