DPDP Act 2023 Compliance
Last updated: May 2026
How Fluxeta and Decipher Consultancy Services comply with the Digital Personal Data Protection Act, 2023, and how you can exercise your rights as a Data Principal.
1. Our Role Under the DPDP Act
Decipher Consultancy Services is the Data Fiduciary for Fluxeta. A Data Fiduciary determines the purpose and means of processing personal data. We are responsible for ensuring lawful processing of all personal data collected through the Fluxeta platform.
Dual Role
Fluxeta has a dual role under the DPDP Act:
| Role | Context | Our Obligations |
|---|---|---|
| Data Fiduciary | Processing data of registered platform users (creators, subscribers, members) | Consent, rights fulfillment, breach notification, Grievance Officer |
| Data Processor | Processing data that creators upload on behalf of their audiences | Contractual safeguards, sub-processor audits, data isolation per site |
When you are a subscriber to a creator's newsletter or course hosted on Fluxeta, the creator is the Data Fiduciary for your data within their site, and Fluxeta acts as their Data Processor.
2. Consent
Under Section 6 of the DPDP Act, we rely on free, specific, informed, and unambiguous consent for most data processing activities. Here is how we collect and manage consent on Fluxeta:
| Processing Activity | Consent Method | Withdrawable? |
|---|---|---|
| Account registration | Checkbox at registration (links to Privacy Policy) | Yes — delete account |
| Marketing emails from Fluxeta | Separate opt-in checkbox | Yes — unsubscribe link in every email |
| Analytics cookies | Cookie consent banner on first visit | Yes — cookie preferences in footer |
| Creator newsletter subscription | Creator's subscribe form with consent checkbox | Yes — STOP / unsubscribe link |
| WhatsApp notifications | Explicit opt-in on subscribe form | Yes — reply STOP |
Withdrawing Consent
You may withdraw consent at any time:
- Platform consent — email [email protected] or delete your account from Settings.
- Newsletter consent — click the unsubscribe link in any newsletter, or email the creator directly.
- Cookie consent — click "Cookie Preferences" in the site footer.
- WhatsApp notifications — reply STOP to any message.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
3. Your Rights as a Data Principal
Under Sections 11–14 of the DPDP Act, 2023, you have the following rights:
You can request a summary of the personal data we hold about you and a description of how it is being processed. We will respond within 30 days.
You can request correction of inaccurate or incomplete personal data. You can also request erasure of personal data when it is no longer necessary for the purpose it was collected, or when you withdraw consent. We will complete the erasure (except legally mandated retention) within 30 days.
You have the right to raise a complaint with our Grievance Officer. We acknowledge within 48 hours and resolve within 30 days. If unsatisfied, you may escalate to the Data Protection Board of India.
You may nominate another individual to exercise your data rights in the event of your death or incapacity. Submit your nomination in writing to our Grievance Officer.
4. How to Exercise Your Rights
Submit your request using one of these methods:
| Request Type | How to Submit | What to Include |
|---|---|---|
| Data access request | Email [email protected] Subject: "Data Access Request" |
Your registered email, your name, proof of identity |
| Data correction request | Settings → Profile (for most data) or email [email protected] | What data is incorrect and what the correct data should be |
| Data erasure / account deletion | Settings → Account → Delete Account, or email [email protected] | Confirmation that you wish to delete your account and all associated data |
| Consent withdrawal | Email [email protected] Subject: "Consent Withdrawal" |
Your account email and which consent you are withdrawing |
| Grievance / complaint | Email [email protected] Subject: "DPDP Grievance" |
Description of the issue, relevant dates, and your desired resolution |
5. Creators: Your Obligations Under the DPDP Act
If you use Fluxeta to collect personal data from your audience (newsletter subscribers, course students, members), you are a Data Fiduciary for that data. You are responsible for:
- Collecting valid consent — Fluxeta's subscribe forms include a DPDP-compliant consent checkbox. Do not remove or bypass it.
- Publishing a Privacy Policy — you should publish a privacy notice for your audience that explains what data you collect and how you use it.
- Honouring data principal rights — if your subscribers request access, correction, or erasure of their data, you must respond. Fluxeta provides tools to export and delete subscriber data from your dashboard.
- Notifying us of breaches — if you become aware of a data breach involving your subscribers' data on Fluxeta, notify [email protected] immediately.
- Using data only for stated purposes — do not use subscriber data collected via Fluxeta for purposes outside the scope of your consent disclosure.
Fluxeta provides a built-in DPDP tools dashboard (under Settings → DPDP) to help you manage consent logs, data export requests, and deletion requests from your subscribers.
6. Sub-Processors
We engage the following sub-processors under written data processing agreements:
| Sub-Processor | Purpose | Location | Data Shared |
|---|---|---|---|
| Anthropic (Claude API) | AI writing, content analysis | USA | Content you submit to AI features (no PII by default) |
| Razorpay | Payment processing | India | Name, email, payment metadata |
| Zoho Books | Invoice generation | India | Name, email, address, GST number |
| AWS / DigitalOcean | Cloud hosting & storage | India / Singapore | All platform data (encrypted at rest) |
| Mailgun / SES | Transactional email delivery | USA | Email address, email content |
| Cloudflare | CDN, DDoS protection | Global | IP address (anonymised after 30 days) |
We review sub-processors annually and will notify you of material changes that affect how your data is processed.
7. Data Breach Response
In the event of a personal data breach that poses a risk to your rights or interests, we will:
- Contain the breach and assess its scope as quickly as possible.
- Notify the Data Protection Board of India as required under the DPDP Act.
- Notify affected Data Principals by email within the timeframe prescribed by the Board.
- Publish a summary of the incident (redacted where required for security) on this page.
If you believe your account has been compromised, contact us immediately at [email protected] or call +91 9911202099.
8. Grievance Officer
Grievance Officer — Fluxeta / Decipher Consultancy Services
Name: Subesh Kumar
Email: [email protected] | [email protected]
Phone: +91 9911202099
Address: 295, Block C, Sushant Lok III, Sector 57, Gurugram, Haryana – 122003, India
Acknowledgement: within 48 hours | Resolution: within 30 days
9. Data Protection Board of India
If you are not satisfied with our response to your grievance, you have the right to escalate your complaint to the Data Protection Board of India once it is formally constituted under the DPDP Act, 2023.
Information on how to approach the Board will be published here once the Board is operationalised by the Government of India.