๐ Upgrade your existing website with smart cookie consent, user preferences, and privacy compliance.
This Privacy Policy explains how ILLUME Intelligence ("ILLUME Intelligence," "we," "us," or "our"), the operator of the ComplyPolicy platform ("ComplyPolicy," the "Platform," or the "Service"), collects, uses, discloses, stores, and protects personal data when you visit complypolicy.com (the "Website"), use our Services, or interact with us in any other way.
This Policy is designed to comply with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and its rules, and, where applicable to visitors outside India, with the General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act ("CCPA").
Under the DPDP Act, ILLUME Intelligence acts as the Data Fiduciary in respect of personal data collected directly from you through this Website, and you, as the individual to whom the data relates, are the Data Principal. Where our Services process cookie and consent data on behalf of our business customers ("Customers") for their own end users, ILLUME Intelligence acts as a Data Processor, and the Customer is the Data Fiduciary for that data. Section 10 explains this distinction in more detail.
By using this Website or our Services, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Website or the Services.
We collect personal data in the following ways:
We do not knowingly collect Sensitive Personal Data (such as financial information beyond billing, health data, or biometric data) through this Website unless explicitly and separately consented to.
We use personal data for the following purposes, each grounded in a lawful basis under the DPDP Act (consent, or a legitimate use recognised under Section 7 of the Act, such as providing a service you have requested):
| Purpose | Legal Basis |
|---|---|
| Creating and managing your account | Consent / Contractual necessity |
| Providing, operating, and improving the Service | Consent / Legitimate use |
| Processing payments and billing | Contractual necessity |
| Responding to enquiries and support requests | Consent / Legitimate use |
| Sending service updates, security alerts, and (where opted in) marketing communications | Consent |
| Detecting fraud, misuse, or security incidents | Legitimate use |
| Complying with legal and regulatory obligations | Legal obligation |
| Improving Website performance through analytics | Consent (via cookie banner) |
We do not use personal data for any purpose incompatible with the purpose for which it was originally collected, as required under the DPDP Act.
Our Website itself uses cookies for essential functionality, analytics, and (where consented to) marketing purposes.
You can manage your preferences at any time through the cookie settings icon available on the Website, or via our Cookie Policy and Manage Cookie Settings page.
Non-essential cookies are not activated until you provide consent, consistent with the "consent-first" standard the DPDP Act requires of our own Customers' deployments.
We do not sell personal data. We may share personal data only in the following circumstances:
With vetted third-party vendors who support hosting, payment processing, email delivery, analytics, or customer support, under contractual confidentiality and data-protection obligations.
Where you interact with a website that uses ComplyPolicy's consent widget, your consent choices are shared with that website (as the Data Fiduciary) so it can honour your preferences.
Where disclosure is required to comply with a legal obligation, court order, or a lawful request from the Data Protection Board of India or another competent authority.
In connection with a merger, acquisition, financing, or sale of assets, subject to equivalent privacy protections for transferred data.
For any other purpose, only after obtaining your explicit consent.
We do not knowingly transfer personal data to any country restricted by the Central Government under the DPDP Act.
Where personal data is transferred outside India for hosting or processing, we ensure such transfers are subject to appropriate contractual safeguards.
We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law, including record-keeping obligations under the DPDP Act.
Consent logs and audit records are retained for the period necessary to demonstrate compliance, after which they are securely deleted or anonymised.
You may request earlier deletion of your data as described in Section 8, subject to any legal retention requirements.
We implement reasonable security safeguards to protect personal data against unauthorised access, alteration, disclosure, or destruction, as required under Section 8(5) of the DPDP Act.
These safeguards include:
In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in the manner and timeframe prescribed under the DPDP Act and its rules.
Under the DPDP Act, you have the right to:
To exercise any of these rights, contact our Grievance Officer using the details in Section 12. We will respond within the timelines prescribed under the DPDP Rules.
Our Services are intended for business use and are not directed at individuals under the age of 18.
In accordance with Section 9 of the DPDP Act, we do not knowingly collect personal data from children, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children.
If we become aware that we have inadvertently collected data from a child without verifiable parental/guardian consent, we will delete it promptly.
For personal data you provide directly to us (e.g., account information, billing details, Website visitor data), ILLUME Intelligence determines the purpose and means of processing and is directly responsible to you under this Policy.
When our Customers deploy the ComplyPolicy consent widget on their own websites, we process the end users' consent data on the Customer's instructions.
In that case, the Customer is the Data Fiduciary responsible for their own privacy policy and end-user relationship, and our processing is governed by a separate Data Processing Agreement with that Customer.
If you are an end user of one of our Customers' websites and have questions about how your data is used, please refer to that website's own privacy policy in the first instance.
Our Website and Service may contain links to, or integrations with, third-party platforms (e.g., Google Analytics, Meta Pixel, payment gateways).
This Policy does not cover the privacy practices of those third parties. We encourage you to review their respective privacy policies independently.
In accordance with the DPDP Act, we have designated a Grievance Officer to address any questions, concerns, or complaints regarding this Policy or our data practices:
We aim to acknowledge grievances within the timeframe prescribed by the DPDP Rules and resolve them as promptly as possible.
If you are not satisfied with our response, you retain the right to file a complaint with the Data Protection Board of India.
Where visitors access this Website from the European Economic Area, the UK, or California, we additionally recognise applicable rights under the GDPR (including the right to data portability and the right to object to processing) and the CCPA (including the right to know, delete, and opt out of the sale/sharing of personal information โ noting we do not sell personal data).
Requests under these frameworks may also be directed to the contact details in Section 12.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
We will post the revised Policy on this page with an updated "Last Updated" date, and where changes are material, we will provide additional notice (such as an email or website banner) before the changes take effect.
This Policy is governed by the laws of India.
Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts in New Delhi, India.