Privacy Policy

This Privacy Policy explains how Root Digit handles personal data when you visit rootdigit.com, submit an enquiry, apply for a role, use a Root Digit account or product, communicate with us, or represent a customer, supplier or partner.

Root Digit Engineering, 209 A, Lichubagan, Hengerabari, Guwahati, Assam 781036, India, decides why and how website, commercial, recruitment and account-administration data is processed. It is the data fiduciary under India’s Digital Personal Data Protection Act, 2023, the controller under the GDPR and UK GDPR, and a business under U.S. state privacy laws where their thresholds are met.

When customers use our software-as-a-service products, such as RootDigit CRM, to store their own contacts, leads, communications or other records, the customer is the controller of that data and Root Digit processes it only on the customer’s documented instructions under our Data Processing Agreement. Individuals whose data is held in a customer’s account should direct requests to that customer; we will assist it as the agreement requires.

We ask you not to send passwords, private keys, access tokens, government identifiers, financial credentials, health data or other sensitive information unless we specifically request it through an approved secure process.

For people in the EEA and UK, these bases correspond to Article 6 of the GDPR and UK GDPR: contract, legal obligation, legitimate interests and consent. Under India’s DPDP Act, we process personal data on consent or on a legitimate use the Act recognises. Where we rely on legitimate interests, we balance them against your rights and you may object.

Where consent is the legal basis, you may withdraw it prospectively. Withdrawal does not invalidate earlier processing. We do not use consent where the processing is genuinely required to perform a contract or meet law.

We disclose personal data only for a defined purpose and subject to appropriate access, confidentiality and contractual controls.

• Service providers: cloud hosting, security, communications, collaboration, customer support, payment, analytics and professional-service providers.
• Customer or organisation: where you interact with us on its behalf, relevant records may be available to its authorised administrators.
• Professional advisers: lawyers, auditors, insurers, accountants and due-diligence advisers under confidentiality obligations.
• Authorities and affected parties: where reasonably necessary to comply with law, protect safety or rights, investigate misuse, or establish and defend legal claims.
• Corporate transactions: a genuine prospective or completed merger, financing, reorganisation or sale, subject to confidentiality and lawful-use restrictions.

Root Digit is based in India, and personal data we control is primarily processed in India. Our infrastructure and service providers may process it in other countries, including the United States and member states of the European Union.

Under India’s DPDP Act, transfers are permitted except to countries the Government of India restricts by notification. For personal data from the EEA, UK or Switzerland, we rely on an adequacy decision where one exists, or on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or an equivalent mechanism, together with safeguards appropriate to the risk. Other regional transfer rules are applied where they reach our processing.

These are default periods, not promises to keep every record for the maximum. We may retain less where the purpose ends, or longer where law, litigation hold, fraud prevention or a signed agreement requires it. Backups are isolated and age out under controlled schedules.

We use risk-appropriate administrative, technical and organisational measures, which may include least-privilege access, authentication controls, encryption in transit, protected secrets, logging, backups, dependency management, vulnerability remediation, supplier review and incident procedures. No system is absolutely secure.

If a confirmed personal-data incident triggers a legal or contractual notice obligation, Root Digit will notify the appropriate customer, regulator or affected individual within the applicable period and provide information reasonably available at that time.

Depending on your location, our role and applicable statutory thresholds, you may request access or confirmation, correction, deletion, restriction, portability, withdrawal of consent, objection to certain processing, an explanation of certain decisions, nomination of another person, or an appeal of a request decision. You may also complain to the competent regulator.

We respond within the period applicable law sets, for example one month under the GDPR (extendable where the law permits) and 45 days under California law, and we will not discriminate against you for exercising a right.

Submit a request through the privacy and legal enquiry route. We may verify identity and authority, narrow an overbroad request, or deny a request where law permits. We will explain a denial and available appeal route. Authorised agents must provide evidence of authority.

India

Where Indian data-protection law applies, Root Digit will provide required notice, process digital personal data for lawful purposes, maintain reasonable safeguards, enable grievance handling and honour rights within applicable statutory timelines. References to the DPDP framework apply according to its phased commencement.

Grievance Officer: Root Digit Engineering, 209 A, Lichubagan, Hengerabari, Guwahati, Assam 781036, India, reachable through the legal enquiry route. If a grievance is not resolved, a Data Principal may approach the Data Protection Board of India as the Act provides.

United States

During the preceding twelve months, Root Digit has collected the categories described in this Policy for the stated business purposes and disclosed relevant categories to service providers and other recipients described above. We have not sold personal information or shared it for cross-context behavioural advertising, we do not use sensitive personal information to infer characteristics about you, and we do not offer a financial incentive for personal data. Where a legally recognised opt-out signal such as Global Privacy Control applies to our processing, we will treat it as a request for the relevant browser or device.

Residents of other states with comprehensive privacy laws may exercise the rights those laws grant, including an appeal of a denied request. An authorised agent may submit a request with evidence of authority. Commercial email we send follows the CAN-SPAM Act, including a working unsubscribe mechanism.

European Economic Area and United Kingdom

Where the GDPR or UK GDPR applies, you may lodge a complaint with the supervisory authority where you live or work or where an alleged infringement occurred. Where Article 27 of the GDPR or UK GDPR requires Root Digit to appoint a representative, we will do so and identify it in this Policy.

Other regions

Where the privacy law of another jurisdiction applies, such as the UAE Personal Data Protection Law, Singapore’s Personal Data Protection Act, Canada’s PIPEDA, Australia’s Privacy Act 1988 or Brazil’s LGPD, Root Digit will provide the notices and honour the rights it requires within its legal scope.

Root Digit’s commercial website and Services are not directed to children, and we do not knowingly collect personal data from children through this website: that is, people under 18 under India’s DPDP Act, under 13 under the U.S. Children’s Online Privacy Protection Act, and under the age set by local law in the EEA and UK. If you believe a child has submitted data, use the legal enquiry route so we can investigate and take appropriate action. A product designed for education or minors requires a separate approved scope, notices, permissions and safeguards.

We may use automation to route enquiries, detect misuse or support evaluation, but we do not use website data to make a solely automated decision that produces legal or similarly significant effects about an individual. Human review remains available where required.

Links to client portals, social networks, translation services or other third-party sites take you to services operated under their own notices. We receive only information those platforms lawfully provide to us, such as messages, public profile details or aggregate page statistics. This website does not currently deploy social-media advertising pixels.

Submit privacy requests, complaints or appeals through the structured legal enquiry form. Select “Privacy, legal or rights request” and describe the relationship, right and relevant account or interaction without sending secrets.

We may update this Policy when our processing, Services or law changes. The effective date and version will change, and material changes will be communicated through an appropriate channel. Previous versions may be requested where reasonably required for a transaction or claim.