DPDP Compliance Statement
FactWise Technologies Private Limited — Digital Personal Data Protection Act 2023
1. Overview
India’s Digital Personal Data Protection Act 2023 ("DPDP Act") came into force on 11 August 2023. It is India’s first comprehensive personal data protection law and establishes a framework for processing digital personal data, data principal rights, and obligations of data fiduciaries and processors.
FactWise Technologies Private Limited ("FactWise", "we", "us") operates a source-to-pay procurement platform for manufacturing and enterprise companies in India. We are committed to DPDP Act compliance as a Data Fiduciary for data we control and as a Data Processor for data processed on behalf of customers.
This statement should be read with our Privacy Policy, Terms of Service, and Cookie Policy.
2. Roles Under the DPDP Act
2.1 FactWise as Data Fiduciary
FactWise is a Data Fiduciary for employee data, account holders, billing contacts, admin users, website visitors, and data processed for our own business purposes such as marketing, fraud prevention, and platform improvement.
2.2 FactWise as Data Processor
FactWise is a Data Processor for customer-controlled personal data including supplier records, procurement data entered by customer employees, and any data where the customer determines purpose and means of processing. We process this data only on customer instructions and applicable Data Processing Agreements.
2.3 Significant Data Fiduciary Readiness
FactWise monitors SDF designation developments and maintains readiness for additional obligations such as Data Protection Officer appointment, Data Protection Impact Assessments, algorithmic audits, and data localisation restrictions if designated.
3. Lawful Basis for Processing
FactWise relies on lawful bases required by the DPDP Act.
| Processing Activity | Data Subjects | Lawful Basis |
|---|---|---|
| Account creation and management | Account holders | Contract - necessary to provide the Platform |
| Billing and invoicing | Billing contacts | Contract; legal obligation for tax law |
| Vendor/supplier data processed for customers | Vendors and suppliers | Legitimate use on customer Data Fiduciary instructions |
| Procurement analytics with anonymised data | All users | Legitimate use |
| Security and fraud prevention | All users | Legitimate use |
| Marketing to prospective customers | Leads and prospects | Consent |
| Support query responses | Users | Contract or legitimate use |
| Legal compliance and regulatory reporting | As applicable | Legal obligation |
3.1 Consent Management and Notice
Where consent is the lawful basis, FactWise ensures consent is free, specific, informed, and unambiguous. We maintain consent records including timestamp, purpose, and notice version.
Before or at collection, FactWise provides clear notice describing the data collected, the purpose of processing, how data principals can exercise rights, and how to raise a grievance.
4. Data Principal Rights
Data principals can contact privacy@factwise.io to exercise rights. FactWise responds within 30 days.
4.1 Right to Information
Data principals can know whether their personal data is processed, receive a summary of data held, and know processors and recipients.
How to exercise: Email privacy@factwise.io. For supplier data managed by a customer organisation, contact that customer; FactWise will assist in forwarding requests.
4.2 Right to Correction and Erasure
Data principals can correct inaccurate or incomplete data and request erasure when data is no longer needed for the original purpose.
How to exercise: Account holders may update data in Settings. Others can email privacy@factwise.io. If erasure is declined due to legal retention, FactWise will provide written reasons.
4.3 Right to Nominate
Data principals may nominate another individual to exercise DPDP Act rights on their behalf in death or incapacity.
How to exercise: Email privacy@factwise.io with nominee details and a signed declaration.
4.4 Right to Grievance Redressal
Data principals may raise grievances about FactWise data processing. We acknowledge within 72 hours and resolve substantively within 30 days.
How to exercise: Email privacy@factwise.io. If unresolved, data principals may approach the Data Protection Board of India once operational.
5. Data Fiduciary Obligations
Personal data is processed only for the purposes for which it was collected.
FactWise processes only data necessary for stated procurement workflows.
Users can correct their own data; customer-entered supplier data remains the customer’s responsibility.
Personal data is retained only as necessary and deleted after retention periods.
Controls include encryption, TLS, role-based access, penetration testing, and immutable audit logs.
FactWise maintains records for processing purposes, consent, rights requests, incidents, and processors.
6. Cross-Border Data Transfers
FactWise will update this section as cross-border transfer rules are notified under the DPDP Act.
- Default: personal data of Indian data principals is processed and stored in India, using AWS ap-south-1 Mumbai.
- Sub-processors outside India receive only minimum necessary technical data and must provide equivalent protections under data processing agreements.
7. Processing of Children’s Data
The DPDP Act places strict obligations on processing children’s personal data. FactWise does not knowingly collect or process children’s data, does not target children, designs the platform for enterprise procurement users, and deletes any child data if discovered.
8. Data Processor Obligations
- Process customer personal data only on documented instructions
- Bind FactWise personnel with access to confidentiality obligations
- Implement appropriate technical and organisational security measures
- Do not engage sub-processors without customer consent
- Assist customers with data principal rights requests
- Delete or return personal data within 90 days after termination
- Notify customers of security incidents within 72 hours
9. Grievance Redressal
FactWise has designated privacy@factwise.io as the data protection contact for grievances under Section 13 of the DPDP Act.
- Submit the grievance by email to privacy@factwise.io
- Include name, contact details, grievance description, and requested resolution
- FactWise acknowledges within 72 hours
- FactWise provides a substantive response within 30 days
- If unresolved, FactWise escalates internally and reverts within a further 14 days
- If still unresolved, you may approach the Data Protection Board of India once operational
10. Updates to This Statement
This statement will be updated when DPDP rules are notified, the Data Protection Board of India issues guidance, or FactWise practices change. Significant updates will be emailed to account administrators.
11. Related Documents
| Document | Location |
|---|---|
| Privacy Policy | factwise.io/privacy-policy |
| Terms of Service | factwise.io/terms-of-service |
| Cookie Policy | factwise.io/cookie-policy |
FactWise Technologies Private Limited is committed to the letter and spirit of India’s Digital Personal Data Protection Act 2023. This statement reflects our practices as of 1 January 2026 and will be updated as the regulatory framework develops.
For all DPDP-related enquiries: privacy@factwise.io