RITE Labs is committed to transparent, responsible data stewardship. This document explains our approach to compliance with India's Digital Personal Data Protection Act (DPDPA) 2023 and where applicable, the General Data Protection Regulation (GDPR) of the European Union.
1. India's DPDPA 2023
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) is India's primary data protection legislation. RITE Labs operates as both a Data Fiduciary (for the personal data of our registered app users) and a Data Processor (for customer data entered by shop owners into RITE POS).
Your Rights Under DPDPA as a RITE POS User
| DPDPA Right | How RITE Labs Implements It |
|---|---|
| Right to Information | This Privacy Policy and this DPDPA page explain exactly what data we collect and how we use it. |
| Right of Access | You can view your personal account data within the app (Settings → Profile) at any time. |
| Right to Correction | You can update any personal information directly within the app or by emailing us. |
| Right to Erasure | You can request complete account deletion at any time. See our Data Deletion page. Transaction records are retained only for the period required by the CGST Act. |
| Right to Grievance Redressal | Contact our Data Protection Contact (details below) for any privacy concerns. We respond within 30 days. |
| Right to Nominate | As a registered user, you may contact us to nominate another individual to exercise rights on your behalf in the event of your incapacity or death. |
Consent and Purpose Limitation
Under the DPDPA, personal data must be processed only for specified, clear, and lawful purposes for which consent has been provided. RITE Labs collects your data for the specific purposes of:
- Providing and operating the RITE POS application
- Managing your subscription and processing payments
- Improving the app through anonymized analytics
- Legal compliance (GST data retention)
- Customer support
We do not use your data for personalized advertising or sell it to third-party data brokers.
Data Fiduciary Obligations (As a Shop Owner)
If you are a RITE POS shop owner and you collect personal data of your customers (names, phone numbers, purchase history) within the app, you become a Data Fiduciary under the DPDPA for that customer data. Your obligations include:
- Obtaining and maintaining the appropriate consent of your customers before storing their personal data in RITE POS
- Ensuring customers can access, correct, or have their data deleted upon request
- Not using customer data for any purpose other than the operation of your pharmacy
- Notifying us immediately if you become aware of a personal data breach involving customer data stored in RITE POS
2. GDPR Applicability
RITE POS is primarily designed for Indian users. If you are a resident of the European Economic Area (EEA) or the United Kingdom, GDPR may apply to the processing of your personal data. In such cases:
- Our lawful basis for processing your data is contractual necessity (to provide the Service you signed up for) and legal compliance.
- You have all GDPR rights including: access, rectification, erasure, restriction, portability, and objection.
- For data transfers outside the EEA (to our Firebase servers), we rely on Standard Contractual Clauses (SCCs) as provided by Google's data processing agreement with Firebase.
- To exercise your GDPR rights, contact us at: sahoosoumya242004@gmail.com
3. Privacy by Design Principles
RITE POS is built with privacy-by-design principles embedded into its architecture:
- Data Minimization: We only collect data that is necessary to provide the Service. We do not collect location data, call logs, contacts, or any other sensitive data unrelated to POS functionality.
- Storage Limitation: Data is retained only as long as necessary — account data deleted on request, transaction data for 7 years (legal requirement).
- Integrity and Confidentiality: All local data is encrypted using Isar's built-in encryption. All cloud data is protected by Firebase Security Rules with shop-level isolation.
- Offline-First: By operating primarily offline, we minimize unnecessary data transmission and cloud exposure.
- Access Controls: Role-based access control ensures employees can only access the data relevant to their job function.
4. Data Breach Policy
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, RITE Labs will:
- Notify the relevant Data Protection Board of India within 72 hours of becoming aware of the breach (as required by DPDPA)
- Notify affected users without undue delay via in-app notification and email
- Take immediate steps to mitigate the breach and prevent recurrence
- Document the breach and our response in our security incident log
5. Data Protection Contact
For all data protection, DPDPA, or GDPR related inquiries, please contact our Data Protection Contact:
- Name: RITE Labs Data Protection Team
- Email: sahoosoumya242004@gmail.com
- Subject: "DPDPA / GDPR Inquiry — [Your Name]"
- Response Time: We will acknowledge within 5 business days and respond fully within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it is established and operational, or with your national data protection authority (for GDPR complaints from EEA residents).