Privacy Notice & Data Protection Policy

This Privacy Notice is provided by GizDevCraft (accessible at gizdevcraft.com) in compliance with Section 5 of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025.

This notice explains in clear, plain language what personal data we collect, the specific purpose for which it is processed, how you can exercise your Data Principal rights, how you may withdraw consent at any time, and how you can contact our designated Grievance Officer.

Data Fiduciary: GizDevCraft determines the purpose and means of processing personal data on this platform, acting as the Data Fiduciary under the DPDP Act.

Data Processors: We engage reputable third-party Data Processors strictly to support essential infrastructure under binding data protection agreements:

• Email / SMTP Infrastructure: To deliver transactional emails (account verification, password reset, security alerts, and double opt-in newsletter confirmation).
• Security & Bot Defense (Cloudflare Turnstile / Google reCAPTCHA): To protect public forms against automated bot abuse, credential stuffing, and malicious scraping.
• Secure Cloud Hosting & CDN: To provide resilient, encrypted server infrastructure and low-latency asset delivery.

We do not sell, rent, or trade your personal data to third-party data brokers or marketing aggregators.

In accordance with Section 5 of the DPDP Act and the DPDP Rules, 2025, below is an itemised breakdown of all personal data categories collected, specified purposes, retention periods, named third-party processors, and statutory legal bases:

Specific & Informed Consent: Wherever consent is the legal basis, we present explicit, un-ticked consent checkboxes clearly specifying the purpose of processing. We never use pre-checked checkboxes, bundled forced agreements, or dark patterns.

Right to Withdraw Consent: Under Section 6(4) of the DPDP Act, withdrawing consent must be as easy as giving consent. You may withdraw your consent at any time through:

• Self-Service Account Deletion: Go to Account Settings and select "Delete Account". An email verification code confirms the action, instantly purging your personal data.
• Newsletter 1-Click Unsubscribe: Every email newsletter contains a direct, 1-click unsubscribe link in the footer.
• Email Request: Send an email to our Grievance Officer at gizdevcraft@gmail.com with the subject line "Withdraw Consent".

Withdrawal of consent does not affect the lawfulness of processing undertaken prior to the withdrawal.

Under Chapter III of the DPDP Act, 2023, you are entitled to the following statutory rights:

• Right to Access Information (Section 11): You may request a summary of your personal data processed by GizDevCraft and the identities of any Data Processors with whom it has been shared.
• Right to Correction & Updating (Section 12): You have the right to correct inaccurate data or update incomplete personal information directly in your profile.
• Right to Erasure (Section 12): You have the right to request erasure of personal data that is no longer necessary for the specified purpose for which it was collected.
• Right of Grievance Redressal (Section 13): You have the right to readily accessible grievance redressal mechanisms with our Grievance Officer.
• Right to Nominate (Section 14): You have the right to nominate an individual who, in the event of death or incapacity, shall exercise your rights in accordance with the Act.

We adhere to the principle of storage limitation. We never retain personal data indefinitely:

• Active User Accounts: Personal data is maintained as long as the account remains active. Upon self-service deletion or request, account data is erased immediately from active databases.
• Inquiries & Messages: Contact and sponsorship form submissions are retained for up to 180 days to resolve queries and follow-up correspondence, after which they are systematically purged.
• Server Security Logs: IP address logs and security access telemetry are automatically rotated and purged every 30 days.
• Client-Side Tool Artifacts: 0 days (instant browser memory disposal upon closing the tab).

In compliance with Section 8(5) of the DPDP Act, GizDevCraft implements robust technical and organisational security measures to prevent personal data breaches:

• Encryption in Transit: Mandatory TLS 1.3 encryption across all website endpoints with Strict-Transport-Security (HSTS).
• Cryptographic Password Obfuscation: Passwords are secured using modern adaptive salted hashing algorithms (Bcrypt / Argon2ID). Plaintext passwords are never logged or stored.
• Anti-User & Fake Domain Security Guard: We verify domain DNS MX/A records and reject disposable/spam domains (e.g. ventura17.ru) to stop non-existent and fraudulent bot registrations.
• Intelligent CAPTCHA & Rate-Limiting: Cloudflare Turnstile and Google reCAPTCHA safeguard authentication, comments, and submission forms against brute-force attacks and automated scraping.
• Access Control: Administrative access is restricted to verified administrators via multi-layered authorization and login throttle limits.

In accordance with Section 8(6) of the DPDP Act and the 2025 Rules, GizDevCraft maintains an active Incident Response Protocol. In the event of an intimation or detection of a personal data breach:

• Immediate containment and mitigation protocols are triggered to secure data integrity.
• We will notify the Data Protection Board of India (DPBI) in the prescribed format and time limit detailing the nature of the breach, affected personal data categories, and containment measures.
• We will notify each affected Data Principal directly with clear remediation steps to mitigate potential consequences.

GizDevCraft is an educational and engineering platform designed for software developers, engineers, and adult learners. We do not knowingly process personal data belonging to children under 18 years of age without verifiable parental consent.

In compliance with Section 9 of the DPDP Act:

• We do not undertake tracking or behavioural monitoring of children.
• We do not serve targeted advertisements directed at children.
• If we learn that personal data of a minor has been collected without verifiable consent of a parent or lawful guardian, we will immediately delete that information.

In compliance with Section 8(10) and Section 13 of the DPDP Act, 2023, GizDevCraft has appointed a designated Grievance Redressal Officer. You may contact our officer or submit a grievance ticket directly:

Escalation to the Data Protection Board of India (DPBI): If you do not receive a response from our Grievance Officer within 30 days, or if you are not satisfied with the resolution provided, you have the statutory right under Section 13(3) of the Act to file a complaint with the Data Protection Board of India via the digital portal established by the Ministry of Electronics and Information Technology (MeitY), Government of India (meity.gov.in).

In compliance with Section 16 of the Digital Personal Data Protection Act, 2023, GizDevCraft hereby discloses the cross-border transfer and processing of digital personal data:

• Permitted Jurisdictions: GizDevCraft transfers personal data strictly to countries and territories that are not restricted or blacklisted by the Central Government of India pursuant to Section 16 of the DPDP Act.
• Global Infrastructure Partners: To maintain world-class security, uptime, and edge latency, we rely on established international service providers:
  • Cloudflare, Inc. (United States / Global Edge): Encrypted reverse-proxy, DDoS mitigation, and edge caching. User IP addresses and transient HTTP headers may be processed across Cloudflare's secure global network.
  • Google LLC (United States / Global): User authentication (OAuth 2.0 Google Sign-In) and aggregated, anonymized web telemetry (Google Analytics 4 with IP anonymization and Consent Mode v2 gating).
  • AWS / Cloud Hosting: Encrypted backup storage and server infrastructure located in SOC 2 Type II certified data centers.
• Transfer Safeguards: All cross-border personal data transfers are safeguarded by robust contractual mechanisms (Data Processing Agreements incorporating Standard Contractual Clauses), mandatory TLS 1.3 transit encryption, and AES-256 rest encryption. GizDevCraft ensures that foreign data processors afford the same or higher standard of personal data protection as required under the DPDP Act.

In accordance with Section 5(3) and Section 18 of the DPDP Act, 2023, Data Principals are entitled to access this privacy notice in English or any of the 22 languages specified in the Eighth Schedule to the Constitution of India. Below is the Hindi (हिन्दी) summary of our privacy commitments: