Data Privacy & Compliance

DPDP Act 2023 Compliance

How aaoms protects your personal data under India's Digital Personal Data Protection Act, 2023. Transparent practices for healthcare professionals who trust us with their information.

Last updated: January 2025DPO: privacy@aaoms.co.in

Consent First

We process your data only with explicit, informed consent — never assumed.

Your Rights

Access, correct, delete, port, or restrict your data anytime. 72-hour response.

Security First

Encryption, access controls, DPA-signed processors, breach notification within 72 hrs.

What is the Digital Personal Data Protection Act, 2023?

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data privacy legislation, enacted to protect the personal data of individuals (called Data Principals) while enabling lawful data processing by organizations (called Data Fiduciaries).

The Act applies to all digital personal data processed in India, whether collected online or offline and digitized. It also applies to processing outside India if it involves offering goods/services to Data Principals in India.

Key principles under the Act:

Consent: Free, specific, informed, unconditional, and unambiguous.
Purpose Limitation: Data processed only for specified, explicit purposes.
Data Minimization: Collect only what is necessary.
Accuracy: Keep data accurate and up to date.
Storage Limitation: Retain only as long as necessary.
Security: Reasonable safeguards against unauthorized access.
Accountability: Demonstrate compliance.

As an e-commerce platform serving healthcare professionals across India, aaoms is fully committed to these principles. This page details our compliance posture in plain language.

Frequently Asked Questions

What is the DPDP Act 2023?

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's comprehensive data privacy law that governs how organizations collect, process, and protect personal data of individuals (Data Principals). It came into effect in 2024 and applies to all entities processing digital personal data in India.

How does aaoms comply with the DPDP Act?

aaoms complies by: (1) Obtaining explicit consent before processing personal data, (2) Implementing purpose limitation — data collected only for order fulfilment, embroidery customization, and customer support, (3) Data minimization — collecting only necessary information, (4) Storage limitation — retaining data only as long as required, (5) Security safeguards — encryption, access controls, and regular audits, (6) Grievance redressal mechanism via our Data Protection Officer, (7) Data Principal rights enablement — access, correction, erasure, and portability.

What personal data does aaoms collect?

We collect: Name, email, phone, delivery address, PIN code (for order fulfilment); Embroidery details (name, designation, logo) for custom orders; Payment information (processed securely via Razorpay — we do not store full card details); Account credentials (hashed); Website usage analytics (anonymized). We do NOT collect sensitive personal data like health information, biometrics, or financial history.

What are my rights as a Data Principal under DPDP Act?

You have the right to: (1) Access your personal data, (2) Correct inaccurate data, (3) Request erasure of data no longer needed, (4) Data portability, (5) Withdraw consent (where processing is consent-based), (6) Nominate a representative, (7) File a grievance with our Data Protection Officer, (8) Approach the Data Protection Board of India if unsatisfied.

How can I exercise my data rights?

Contact our Data Protection Officer at privacy@aaoms.co.in or via WhatsApp at 919071573566. Include 'DPDP Request' in the subject. We respond within 72 hours as per the Act. For account holders, you can also manage data via your account dashboard.

Do you share my data with third parties?

Only with your consent or as required for service delivery: (1) Courier partners (name, phone, address) for delivery, (2) Razorpay for payment processing, (3) Embroidery production vendors (only embroidery specifications), (4) Legal authorities when legally mandated. We never sell your data. All processors sign Data Processing Agreements compliant with DPDP Act.

How long do you retain my data?

Order data: 7 years (legal/tax requirements). Account data: Until account deletion or 3 years inactivity. Marketing data: Until consent withdrawal. Analytics data: 26 months (anonymized). Embroidery specs: 1 year post-delivery for reorder convenience. You can request earlier deletion where not legally required.

Is my data transferred outside India?

For international orders, minimal shipping data (name, address, phone) is shared with courier partners in the destination country. All other processing occurs on servers in India. We ensure adequacy or appropriate safeguards per DPDP Act cross-border transfer rules.

How does aaoms handle data breaches?

We have an incident response plan. In case of a breach affecting your data: (1) We assess and contain within 24 hours, (2) Notify affected Data Principals within 72 hours as per DPDP Act, (3) Report to Data Protection Board of India, (4) Provide remediation guidance. No breach has occurred to date.

What about cookies and tracking?

We use essential cookies for cart, authentication, and language preference. Analytics cookies (Google Analytics) require your consent via our cookie banner. No advertising/tracking cookies. You can manage preferences anytime via the cookie icon or browser settings.

Does aaoms process children's data?

No. Our products are for healthcare professionals (age 18+). We do not knowingly collect data from minors. If detected, we delete it immediately per DPDP Act Section 9.