DPDP Act 2023 & Statutory Compliance Notice

Privacy Policy & Data Protection

How NB03 collects, processes, stores, and protects your personal digital data in strict compliance with India's Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025.

Last updated: September 2026 (2026-09-25)Jurisdiction: Republic of IndiaData Protection Officer: Nittish Baboria
DPDP Act 2023 Itemized Notice & Summary

We process digital personal data solely for legitimate service operations, secure user authentication, project delivery, anti-abuse protection, and statutory security logging. We never sell, monetize, rent, or lease your personal data to data brokers or third-party advertisers. We do not deploy Google Analytics or third-party advertising cookies on this website. Consent is affirmative, unbundled, and withdrawable at any time without penalty.

This policy is published for transparency about our data practices. It is not legal advice. For advice on your specific obligations, consult a qualified lawyer.

Data Fiduciary

NB03

Operated by Nittish Baboria

Primary Grounds

Affirmative Consent

& Contract Fulfillment

Grievance Turnaround

Response ≤ 90 days

Rule 14(3), DPDP Rules, 2025

1

Identity & Governance of the Data Fiduciary

Under Section 2(g) of the Digital Personal Data Protection Act, 2023 ("the Act"), NB03 ("we", "us", or "our"), operated by Nittish Baboria, is the Data Fiduciary that determines the purpose and means of processing of personal data (Section 2(n)) in digital form (Section 2(j) — "digital personal data"). Individuals to whom that data relates are Data Principals (Section 2(h)). We are not currently notified as a Significant Data Fiduciary under Section 10 of the Act.

Entity Name: NB03

Principal Operator: Nittish Baboria

Official Email: nittishbaboria123@gmail.com

Contact Phone: +91 70069 30270

Headquarters: Greater Kailash, Jammu, J&K 180011

Commercial Branch: Connaught Place, New Delhi, Delhi 110001

§

Statutory definitions (summary)

The following summaries track key terms in Section 2 of the Act. For authoritative wording, use the India Code text linked under Sources & legal basis below.

  • Consent (Section 2(d)): freely given, specific, informed, and unambiguous indication of a Data Principal's wishes signifying agreement to processing.
  • Certain legitimate uses (Chapter II, Section 7): processing without consent only where the Act expressly permits (e.g. specified State functions, compliance with law, medical emergency, employment safety, and other listed grounds).
  • Notice (Section 5; Rule 3, DPDP Rules, 2025): itemised description of personal data, specified purposes, and how to withdraw consent, exercise rights, and complain to the Board.
2

Itemized Categories of Personal Data Collected

In line with our obligations under Section 8 of the Act (including not retaining data beyond what is necessary — Section 8(7)) and the itemised notice standards in Rule 3 of the DPDP Rules, 2025, we collect only the digital personal data needed to operate this website, authenticate users, respond to inquiries, and protect security:

A. User Account & Credential Information

When you create an account or authenticate with our web application, we record:

  • Full Name & Email Address: Used for account identity and transactional service communication.
  • Password Cryptographic Hashes: Passwords are one-way hashed with bcrypt and random salt rounds before database storage. We never store, log, or have access to plain-text passwords.
  • One-Time Passcodes (OTP): During email verification, 6-digit cryptographically random OTPs are stored temporarily with an automatic 10-minute expiry timestamp in our verification queue.
  • Federated OAuth Data (Google Sign-In): When signing in via Google OAuth, we receive your verified Google email, name, avatar profile image, and provider account identifiers. We do not receive or request access to your Google Drive, contacts, or external Google services.
  • Consent Audit Timestamps: Exact timestamp and version ID when affirmative terms and privacy consent was accepted.

B. Client Inquiries, Project Scoping & WhatsApp Communications

When you submit a discovery inquiry via our contact form (/contact), direct email, or official WhatsApp channel:

  • Inquiry Details: Name, business email, service requested (e.g., Full-Stack Web Development, Instagram Automation, Website Revamp), and message description.
  • Delivery & Retention: Submissions are transmitted via encrypted SMTP to our business inbox (Google Gmail). They are not stored in our application database. Mailbox retention follows our email provider's settings and our internal lead-management practices.
  • Anti-Spam Rate Limiting: Your IP address and email may be used as ephemeral Redis/in-memory rate-limit keys (typically 5–10 minutes) to prevent automated abuse; keys auto-expire and are not used for profiling.

C. First-Party Analytics & Performance Telemetry

To monitor website responsiveness and optimize digital performance without relying on intrusive third-party trackers, our proprietary first-party telemetry logs:

  • Session Identifier: An ephemeral, randomly generated UUID (sessionId) stored in client memory/cookies to measure session duration.
  • Device & Browser Architecture: Device category (mobile, tablet, desktop), browser engine (Chrome, Safari, Firefox), operating system, and viewport dimensions (screenWidth, screenHeight).
  • Network & Regional Location: Client IP address (for fraud/abuse context), plus country, state/region, and city from Cloudflare/Vercel edge headers or a geo lookup when headers are absent. We do not access GPS sensors or precise device coordinates.
  • Page Navigation Flow: Requested route URL path, referrer URL, timestamp entered, timestamp left, and duration on page in seconds.
  • Campaign Attribution: Standard UTM parameters (utm_source, utm_medium, utm_campaign) to measure advertising and search engine performance.
  • Anonymity: For unauthenticated visitors, telemetry records are unlinked (userId = null).

D. Security Audit Logs & Incident Records

To safeguard the application from unauthorized breach attempts, brute-force dictionary attacks, and credential stuffing, our security subsystem maintains audit trails of security-relevant events:

  • Logged Event Types: Login success, login failure, logout, account created, account deleted, password changed, password reset requested, password reset completed, affirmative consent accepted, and administrative actions.
  • Logged Attributes: Event timestamp, associated email, IP address, and client User-Agent string.
3

Lawful Grounds & Purposes of Processing

Under Section 4 of the Act, personal data may be processed on the basis of consent or certain legitimate uses. Our processing relies on the following:

1. Affirmative Informed Consent (Section 6)

Freely given, specific, and unambiguous consent obtained through affirmative checkbox confirmation during registration and cookie preference selections.

2. Service delivery at your request

Providing accounts, project communications, and deliverables you request — typically supported by your consent (Section 6) and, where applicable, performance of pre-contract steps at your direction.

3. Certain legitimate uses & legal compliance (Sections 7 & 8)

Security safeguards, fraud prevention, and compliance with applicable Indian law (including CERT-In directions under the Information Technology Act, 2000) where processing is permitted without consent or alongside consent-based processing.

4

Log Retention, NTP Clocks & CERT-In Mandates

Under Direction No. 20(3)/2022-CERT-In (Section 70B(6), Information Technology Act, 2000) and our security obligations under Section 8(5) of the Act and Rule 6 of the DPDP Rules, 2025 (reasonable security safeguards, including log retention where required):

Synchronized NTP Clock Source:

All system transactions, security events, and audit logs are recorded using Network Time Protocol (NTP) synchronized clocks accurate to Indian Standard Time (IST) / Coordinated Universal Time (UTC).

Mandatory 180-Day ICT Log Retention:

ICT access logs and security event records are retained for at least 180 days where CERT-In directions apply, and for up to one year (or longer if another law requires) for security audit trails and consent records, consistent with Rule 6(1)(e) and our operational needs.

5

Authorized Technical Sub-processors & Cloud Infrastructure

We partner with premier infrastructure sub-processors bound by strict confidentiality, data protection obligations, and TLS 1.3 encryption:

Neon / PostgreSQL Cloud

Serverless encrypted PostgreSQL database for persistent storage of user credentials, audit trails, and analytics telemetry.

Vercel & Cloudflare Edge

Global edge computing network, DDoS mitigation, SSL/TLS certificate management, and web application firewall (WAF).

Google Cloud & Gmail SMTP

OAuth authentication provider for Google Sign-In and secure transactional email routing for OTP verification.

Upstash Redis

In-memory distributed key-value cache used strictly for high-speed rate limiting, brute-force mitigation, and token throttling.

6

Your Statutory Rights as a Data Principal

Chapter III of the Act (Sections 11–14) sets out rights to access information, correction and erasure, grievance redressal, and nomination. Rule 14 of the DPDP Rules, 2025 requires us to publish how you may exercise these rights. We provide self-service tools where available:

Right to Data Portability & Summary

You can download a complete, machine-readable JSON copy of all your personal data, profile attributes, and security logs in one click via your Profile Settings (/api/profile/export).

Right to Erasure & Account Deletion

You can permanently delete your account directly from /profile. This triggers an immediate cascade deletion of your user record, OAuth tokens, active sessions, and unlinks your analytics history.

Right to Correction & Updation

You have the right to correct inaccurate, outdated, or misleading personal data directly through your account dashboard or by submitting a written request to our Grievance Officer.

Right to Grievance Redressal & Nomination

You may register unresolved grievances with our designated Grievance Officer, nominate an individual to manage your data in the event of incapacity, or escalate to the Data Protection Board of India.

7

Cookies & Local Browser Storage Disclosure

We avoid invasive third-party ad network cookies. A full inventory, retention notes, and preference controls are in our Cookie Policy. Summary:

Cookie / Storage KeyTypeClassificationOperational Purpose
__Secure-next-auth.session-tokenHTTP CookieStrictly EssentialEncrypted JWT session token for authenticated user account access. Secure, HttpOnly, SameSite=Lax.
__Host-next-auth.csrf-tokenHTTP CookieStrictly EssentialCryptographic cross-site request forgery (CSRF) protection token.
nb03_cookie_consentLocal StorageStrictly EssentialStores your affirmative consent and cookie banner acceptance preferences.
admin_users_cache / admin_analytics_cacheLocal StoragePerformanceZero-millisecond instant client-side cache for administrative data; revalidated silently in the background. Cleared upon logout.
analytics_session_idsessionStorageAnalytics (consent)Anonymous session ID to calculate page flow; cleared when the browser tab closes.
analytics_has_visitedLocal StorageAnalytics (consent)Return-visitor flag for aggregate metrics only.
8

Protection of Children's Personal Data

Section 9 of the Act restricts processing children's personal data (a child is an individual who has not completed 18 years — Section 2(c)). Our services are directed at adults and businesses. We do not knowingly process children's data; where we become aware of such processing without authority, we will delete it. When child accounts are permitted in future, we will implement verifiable consent of a parent as required by Rule 10 of the DPDP Rules, 2025, and will not undertake tracking, behavioural monitoring, or targeted advertising toward children as prohibited by Section 9.

9

Withdrawing Consent (Section 6, DPDP Act)

Where processing is based on your consent, you may withdraw it at any time with comparable ease to how it was given:

  • Analytics: Use Cookie Preferences in the footer and select Essential Only or disable analytics in the modal.
  • Marketing account: Delete your account from /profile or email us to erase remaining personal data where self-service is unavailable.
  • Effect: We will cease consent-based processing within a reasonable time, subject to retention required by law or for cybersecurity evidence.
10

Cross-Border Processing (Section 16, DPDP Act)

Section 16 of the Act permits transfer of personal data outside India subject to conditions notified by the Central Government. Rule 15 of the DPDP Rules, 2025 provides that transfers may occur subject to restrictions specified by the Government in respect of foreign States or entities. Our sub-processors (Neon PostgreSQL, Vercel, Cloudflare, Google OAuth/SMTP, Upstash Redis) may process data on infrastructure outside India; we use encryption and vendor diligence and will comply with any transfer restrictions notified for those destinations. Contact us for processor-specific details relevant to your project.

11

Security Safeguards & Personal Data Breach Response

Under Section 8(5) of the Act and Rule 6 of the DPDP Rules, 2025, we implement reasonable security safeguards — TLS in transit, bcrypt password hashing, access controls, rate limiting, and audit logging. If we become aware of a personal data breach (Section 2(o)), we will act per Section 8(6) and Rule 7: notify affected Data Principals without undue delay with prescribed particulars, and notify the Data Protection Board of India without delay and with detailed updates within 72 hours (or as the Board may allow), alongside CERT-In obligations where applicable.

12

Policy Updates & Board Complaints

We may update this notice when our practices or law change; the Last updated date reflects the current version. Material changes affecting consent-based processing will be brought to your attention where the Act or Rules require. The Act provides for penalties for contraventions (Section 33 and the Schedule); we work to comply and do not use penalties to intimidate Data Principals. After exhausting grievance redressal under Section 13, you may approach the Data Protection Board of India under Chapter IV of the Act.

Statutory Grievance Redressal Officer

Under Section 13 of the Act, Rule 14(3) of the DPDP Rules, 2025 (grievance response within a reasonable period not exceeding 90 days), Rule 9 (published contact for questions about processing), and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the designated Grievance Redressal Officer for NB03 is:

Officer Name: Nittish Baboria

Designation: Lead Data Protection & Grievance Officer

Entity: NB03

Grievance Email: privacy@digital.nittish.in

Alternate Contact: nittishbaboria123@gmail.com

Official Phone: +91 70069 30270

Headquarters: Greater Kailash, Jammu, J&K 180011

* SLA commitment: We aim to respond to grievances within a reasonable period not exceeding 90 days (Rule 14(3), DPDP Rules, 2025). If dissatisfied, you may escalate to the Data Protection Board of India after this process, as provided in the Act.
← Back to NB03 Home