GDPR and DPDP Act Privacy Notice

Last updated: 13 October 2026 · Effective date: 13 October 2026

This notice adds to our Privacy Policy. It explains your rights under the EU General Data Protection Regulation (GDPR) and the UK GDPR, and under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Who is responsible

HYRAX COMMUNICATION PRIVATE LIMITED, Shop No. 6, Alerk Apartment, Airport Road, Bhopal 462030, Madhya Pradesh, India ("we"), the provider of DNDTeams AI.

For account holders and website visitors, we are the controller (GDPR) and Data Fiduciary (DPDP).
For personal data that businesses collect through DNDTeams AI about their own customers, the business is the controller / Data Fiduciary and we act as its processor / Data Processor.

Contact: jitendrawadhwani.com@gmail.com · +91 8827409728 Grievance Officer (DPDP): Jitendra Wadhwani, jitendrawadhwani.com@gmail.com EU representative (GDPR Art. 27): Not appointed at this time. Contact jitendrawadhwani.com@gmail.com if you need confirmation for your region. UK representative: Not appointed at this time. Data Protection Officer: We have not appointed a separate DPO at this time; privacy requests go to the Grievance Officer above. If a DPO becomes required, we will update this notice.

Part A: GDPR (EU/EEA and UK)

Legal bases we rely on: contract, legitimate interests (security, fraud prevention, service improvement), legal obligation, and consent (marketing and optional cookies). See the table in our Privacy Policy.

Your rights:

Access your personal data (Art. 15)
Rectification (Art. 16)
Erasure, the "right to be forgotten" (Art. 17)
Restriction of processing (Art. 18)
Data portability (Art. 20)
Objection, including to direct marketing at any time (Art. 21)
Withdraw consent at any time, without affecting earlier processing
Not to be subject to decisions based solely on automated processing that have legal or similarly significant effects (Art. 22). We do not make such decisions.
Complain to your local supervisory authority

International transfers: we are based in India, which does not have an EU adequacy decision. Where we transfer personal data from the EU/UK, we rely on Standard Contractual Clauses (or the UK IDTA/Addendum) and supplementary measures as appropriate.

Response time: within one month, extendable by two months for complex requests.

Data minimisation: we collect only what is needed to run the Service.

Part B: DPDP Act, 2023 (India)

Notice and consent. Where we rely on consent, we ask for it with a clear notice of the personal data we collect and why. You can withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing that took place before it. We may also process data for "certain legitimate uses" allowed under Section 7, such as data you voluntarily provide for a specified purpose, or to meet legal obligations.

Your rights as a Data Principal:

Information about the personal data we process and with whom we share it (Sec. 11)
Correction, completion, updating and erasure of your personal data (Sec. 12)
Grievance redressal through our Grievance Officer (Sec. 13)
Nominate another person to exercise your rights in the event of death or incapacity (Sec. 14)
If your grievance is not resolved, complain to the Data Protection Board of India

Your duties (Sec. 15): give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.

Children. We do not knowingly process the personal data of anyone under 18 without verifiable parental consent, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children.

Consent Managers. We do not currently integrate with registered Consent Managers under the DPDP framework. If that changes, we will update this notice.

Security and breaches. We take reasonable security safeguards. If a personal data breach occurs, we will inform the Data Protection Board of India and affected Data Principals as the law requires.

Retention. We erase personal data when it is no longer needed for the purpose, or when you withdraw consent, unless the law requires us to keep it. Specific periods (see also the Privacy Policy): deleted accounts erased or anonymised after 30 days; unconfirmed deletion requests expire after 7 days; OTPs 24 hours; error logs 30 days; AI provider logs 90 days; read admin alerts 180 days; wallet/transaction records kept anonymised for accounting; backups 14 days.

Part C: California (CCPA/CPRA)

We do not sell or share personal information. California residents may exercise rights to know, access, correct and delete, without discrimination, at jitendrawadhwani.com@gmail.com. For customer data we act as a service provider/processor.

For businesses using DNDTeams AI (our customers)

You are the controller / Data Fiduciary for your customers' data, such as leads, contacts, chat visitors and recipients. You must:

give your own privacy notice, for example on your website or chat form, and get any consent needed, especially before WhatsApp campaigns
respond to your customers' rights requests. We will help you through the Service or on request.
not upload sensitive or special-category data unless you have a lawful basis

You indemnify HYRAX for claims arising from your processing, as set out in our Terms. Our Terms serve as the Data Processing Addendum; Standard Contractual Clauses and a sub-processor list are available on request at jitendrawadhwani.com@gmail.com.

Make a request

Email jitendrawadhwani.com@gmail.com with the subject "Privacy request". Tell us which right you want to exercise and the email or phone number linked to your account. We will verify your identity before acting. Account deletion is available in the app (Settings → Delete account) and at https://ai.dndteams.com/delete-account; you can also email us. In chats you can Report AI replies and Block contacts. Support is 24x7, always available (AI + team). Grievances are acknowledged within 24 hours and resolved within 15 days.

If this notice is translated, the English version prevails.