India DPDP Act notice
This notice is given under the Digital Personal Data Protection Act, 2023 and the rules made under it. It sits alongside our privacy policy, which covers the same processing in more detail; where the two differ on an Indian requirement, this notice governs.
Who is the Data Fiduciary
Fourth Dimension is the Data Fiduciary for personal data of our own customers, the people who hold accounts with us. For conversations between a visitor and an assistant deployed on a customer's website, that customer is the Data Fiduciary and we are a Data Processor acting on their instructions. If you are a visitor asking about a conversation, the website you were using decides what happens to it, and asking them first will be faster.
What we process, and why
| Personal data | Purpose |
|---|---|
| Name, email, password hash | Creating and securing your account |
| Billing contact and payment token | Charging for the service and issuing invoices, including GST compliance |
| Console activity | Diagnosing faults and improving the product |
| Conversation content (as processor) | Operating the assistant for the customer who deployed it |
| Approximate location, on request only | Answering "find my nearest store" when a visitor presses the button. Not retained. |
Legal basis
We process account, billing and service data to perform the contract you entered into, and to meet legal obligations such as tax record-keeping. Where we rely on consent, the location button is the clearest example: it is asked for at the moment it is needed, in plain terms, and refusing it leaves the rest of the assistant working.
Your rights
- Access, a summary of the personal data we hold about you and what we do with it.
- Correction and erasure, correct anything inaccurate, complete anything partial, erase what we no longer need.
- Withdraw consent, as easily as it was given, with the consequences explained before you do.
- Nominate, appoint someone to exercise these rights on your behalf if you die or become incapacitated.
- Grievance redressal, the route below, which you must use before approaching the Board.
Write to our contact form to exercise any of these. We respond within 30 days, and will tell you promptly if a request needs longer and why.
Grievance officer
Grievances go to our Data Protection Officer at our contact form, who will acknowledge within 72 hours and resolve within 30 days. Please put "DPDP grievance" in the subject so it is routed rather than queued.
If we do not resolve it to your satisfaction you may complain to the Data Protection Board of India. We would rather you gave us a chance first, and we will tell you when we think we have failed.
Children
The Act requires verifiable parental consent before processing a child's data, and prohibits tracking or targeted advertising directed at children. ChatWidget is a business product, not directed at children, and we do neither. If you believe a child's data has reached us, write to us and we will delete it.
Consent manager
We do not currently integrate a registered Consent Manager, because our processing rests on contract rather than consent for everything except the location button, which is asked for in context. Should that change, this notice will name the Consent Manager and the path to it before the change takes effect.
Data transfers
Your data is stored in India. Generating an assistant reply sends the question and the retrieved excerpts to a model provider that may process them outside India, named on the sub-processor page with its location.