This Data Protection page sets out SkillSaajha's commitments under the Digital Personal Data Protection Act, 2023 of India (the "DPDP Act") and, where applicable, the General Data Protection Regulation of the European Union (the "GDPR"). It works alongside our Privacy Policy, which describes our actual data practices in detail.
1. Who We Are Under These Laws
Under the DPDP Act, SkillSaajha is a Data Fiduciary. Under GDPR, we are a Data Controller. Both terms mean the same thing in practice: we are the entity that decides why and how your personal data is processed, and we are responsible for protecting it.
SkillSaajha is operated by Amit Singh, sole proprietor, based in Gorakhpur, Uttar Pradesh, India.
2. Our Core Commitments
We hold ourselves to the following principles, which match the requirements of both the DPDP Act and GDPR:
- Purpose limitation. We collect personal data only for the specific, lawful purposes described in our Privacy Policy, and we do not use it for unrelated purposes without first obtaining consent.
- Data minimisation. We collect only what we need. We do not ask for sensitive information we do not actually use.
- Accuracy. We allow you to correct your information at any time directly in the app.
- Storage limitation. We retain personal data only as long as needed, following the schedule in section 18 of our Privacy Policy.
- Integrity and confidentiality. We protect personal data with encryption, access controls, and other reasonable security measures.
- Accountability. We document our practices, explain them in plain language, and are answerable for them.
- Transparency. We do not hide anything material about our processing. Our Privacy Policy describes what we collect, why, and what we do with it.
3. Your Rights
You have the following rights regarding the personal data we hold about you. To exercise any of them, contact our Grievance Officer (section 6 below) or email hello@skillsaajha.com. We respond within 30 days.
| Right | What it means | How to use it |
|---|---|---|
| Access | Get a copy of the personal data we hold about you | Email with subject "Access Request" |
| Correction | Fix inaccurate or incomplete information | Most fields are editable in Settings → Edit profile. For others, email us. |
| Erasure | Delete your account and personal data | Use Settings → Delete account or email us. See Privacy Policy section 19. |
| Restriction | Limit how we use your data in certain situations | Email with subject "Restriction Request" |
| Objection | Object to specific processing where we rely on legitimate interests | Email with subject "Objection Request" |
| Portability | Get your data in a portable, structured format (e.g. JSON) | Email with subject "Data Export". We respond within 30 days with a portable file. |
| Withdraw consent | Stop processing that depends on consent, such as location use | Adjust device permissions, or email us |
| Lodge a complaint | Approach a regulator if you are unsatisfied with our response | See section 8 below |
We will not penalise you for exercising any right under this section. Some requests may take longer if they require manual verification - we will tell you in advance if so.
4. Consent
For processing activities that depend on consent (such as the use of your approximate device location, or the delivery of push notifications), we:
- Ask for consent in clear language at the moment we need it, not buried in the Terms
- Make consent a genuine choice - you can use SkillSaajha without saying yes
- Allow you to withdraw consent at any time, as easily as you gave it
Withdrawing consent does not affect the lawfulness of processing that took place while consent was in force. After you withdraw, we stop the affected processing and, where reasonable, delete data that was collected only for that purpose.
5. Security Measures
We follow the security practices described in section 21 of our Privacy Policy. Briefly:
- All data in transit is protected by TLS encryption (HTTPS)
- Personal data at rest in our database is encrypted
- Access to personal data is limited to authorised personnel for legitimate purposes
- Sign-ins and admin actions are logged
- We rely on infrastructure providers (Supabase, Vercel) with their own strong security postures
- We patch software and dependencies regularly
In the event of a personal data breach affecting your rights, we will follow the notification timelines described in section 22 of our Privacy Policy, including notifying the Data Protection Board of India as soon as practicable.
6. Grievance Officer
As required by the DPDP Act, SkillSaajha has appointed a Grievance Officer to handle all data protection concerns:
Please use the subject line "Grievance" so your message is routed correctly. Tell us briefly what your concern is and what you want done about it. We will acknowledge receipt within 7 days and respond fully within 30 days.
7. How We Handle Your Requests
When you exercise a right under this page or the DPDP Act:
- We verify your identity. So that we do not give out one user's data to another, we may ask you to send the request from the email associated with your account or to verify ownership in another way.
- We acknowledge. Within 7 days of receiving a complete request, we confirm we have it.
- We act. Most requests are completed within 30 days. Complex requests may take longer; we will tell you why and when to expect a response.
- We explain. If we cannot fulfil a request fully or at all (for example, where we are legally required to retain certain information), we will tell you why and what your options are.
- We do not charge. Exercising your rights is free, except in cases of clearly excessive or repeated requests, where we may charge a reasonable fee or decline.
8. Right to Complain to a Regulator
If you believe we have not handled your personal data properly and our response did not resolve your concern, you have the right to complain to a data protection regulator:
- Users in India: the Data Protection Board of India, established under the DPDP Act, 2023. Once the Board's official website and procedures are published by the Central Government, we will link to them here.
- Users in the European Union: your national supervisory authority. A list is available at edpb.europa.eu.
- Users in the United Kingdom: the Information Commissioner's Office (ICO) at ico.org.uk.
We would always prefer to fix the issue directly. Writing to our Grievance Officer first usually results in a faster resolution.
9. International Data Transfers
SkillSaajha is operated from India. Some service providers we rely on (such as Supabase and Vercel) may store and process data in other countries. The full explanation is in section 17 of our Privacy Policy. In summary:
- For transfers from the EU, we rely on Standard Contractual Clauses approved by the European Commission.
- For transfers under the DPDP Act, we restrict transfers to countries not prohibited by the Central Government of India.
- We require service providers to apply appropriate security measures.
10. Children and Younger Users
SkillSaajha is intended for users aged 18 years and above. We do not knowingly collect personal data from anyone under 18. See section 3 of our Privacy Policy for details.
11. Changes to This Page
We may update this Data Protection page from time to time, especially as the DPDP Act Rules are finalised and as our practices evolve. The "Last Updated" date at the top will always show the most recent version. Material changes will be notified through the app, by email, or by a banner on the website.
12. Contact
For any data protection question, request, or complaint, write to hello@skillsaajha.com. Please use a clear subject line that describes your request so we can route it correctly.