Privacy Policy
How Dynoz collects, uses, shares and protects personal data, and your rights under Indian law.
Last updated 24 October 2026
Summary of this Policy
- Role of Dynoz. Dynoz acts as a Data Processor for the Personal Data of Guests and of Customer staff, Processing it solely on the instructions of the Customer, and as a Data Fiduciary for the Personal Data of Website visitors, persons submitting enquiries, job applicants, business contacts and its own personnel.
- Call recording. Calls are transcribed. They are recorded only where the Customer enables call recording, and the caller is told so at the start of the call; otherwise call audio is Processed in real time and is not stored. Dynoz does not use calls with Guests to train AI models without the written permission of the Customer.
- Data location. Personal Data that Dynoz Processes for Customers, including databases, backups, AI processing, speech-to-text and the assistant’s voice, is hosted in India by default, or in the region specified in the agreement with the Customer. Personal Data that Dynoz collects for itself is hosted in India. Certain service providers may Process limited Personal Data outside India, as permitted by law.
- No sale, no advertising, no cookies. Dynoz does not sell Personal Data or use it for advertising, and the Website does not set cookies.
- Rights of the Data Principal. Every Data Principal may seek access, correction, completion, updating and erasure of Personal Data, withdraw Consent, nominate another individual and seek grievance redressal, which is provided within one month.
1. Introduction and Applicability
1.1 This Privacy Policy (the “Policy”) is issued by Centora Technologies Private Limited, a company incorporated under the laws of India, having its registered office at First Floor, No. 24, Road No. 1, Mukesh Colony, Ballabhgarh, Faridabad, Haryana 121004, India (“Dynoz”, the “Company”, “we”, “us” or “our”). Dynoz provides an AI-powered guest engagement system that answers and makes telephone calls for hotels and other businesses and records the outcome in their own systems.
1.2 This Policy sets out the manner in which Dynoz collects, uses, stores, discloses, transfers, retains and otherwise Processes Personal Data, and the rights available to Data Principals under applicable law.
1.3 This Policy applies to Personal Data Processed through (a) the website at dynoz.ai (the “Website”); (b) enquiries, job applications and business communications; (c) the Dynoz platform, as used by Customers, their staff and their Guests (collectively, the “Services”); and (d) the engagement of Dynoz personnel. It does not apply to third-party websites or services linked from the Website.
1.4 This Policy is published in compliance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), and is designed to meet the requirements of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”). The provisions of the DPDP Act and the DPDP Rules apply from the dates on which they come into force, and Dynoz follows the practices described in this Policy in advance of those dates.
1.5 Where Dynoz relies on Consent, such Consent is sought separately and specifically, by a clear affirmative action, including through the consent checkbox on our forms. Queries regarding this Policy may be addressed to security@dynoz.ai or submitted through our contact form. Grievances may be raised with the Grievance Officer named in this Policy.
1.6 This Policy is published in English. On request to security@dynoz.ai, Dynoz shall make it available in other languages.
2. Definitions
In this Policy, unless the context otherwise requires, the following terms have the meanings set out below:
| Term | Meaning |
|---|---|
| Board | The Data Protection Board of India. |
| Consent | A free, specific, informed, unconditional and unambiguous indication of the Data Principal’s agreement to the Processing of their Personal Data for a specified purpose, signified by a clear affirmative action. |
| Customer | A business, such as a hotel, a serviced residence or a real estate company, that has engaged Dynoz to provide the Services. |
| Data Fiduciary | A person who, alone or in conjunction with others, determines the purpose and means of Processing of Personal Data. |
| Data Principal | The individual to whom the Personal Data relates, including the parent or lawful guardian of a child, and the lawful guardian of a person with a disability, acting on their behalf. |
| Data Processor | A person who Processes Personal Data on behalf of a Data Fiduciary. |
| Guest | An individual who calls, or is called by, a Customer through the Services, or whose Personal Data a Customer makes available to Dynoz, such as a hotel guest, a resident or a prospective buyer. |
| Legitimate Use | Processing permitted by law without Consent, including Processing of Personal Data that a Data Principal has voluntarily provided for a specified purpose, and Processing for the purposes of employment. |
| Personal Data | Any data about an individual who is identifiable by or in relation to such data. |
| Personal Data Breach | Any unauthorised Processing of Personal Data, or its accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises its confidentiality, integrity or availability. |
| Processing | Any wholly or partly automated operation performed on digital Personal Data, including collection, recording, organisation, storage, retrieval, use, combination, sharing, disclosure, restriction, erasure and destruction; and “Process” shall be construed accordingly. |
3. Role of Dynoz
3.1 Dynoz acts in the following capacities in respect of the following categories of Data Principals:
| Category of Data Principals | Role of Dynoz |
|---|---|
| Visitors to the Website | Data Fiduciary |
| Persons submitting enquiries | Data Fiduciary |
| Job applicants | Data Fiduciary |
| Business contacts | Data Fiduciary |
| Customer staff using the Services | Data Processor on behalf of the Customer |
| Dynoz personnel | Data Fiduciary |
| Guests | Data Processor on behalf of the Customer |
3.2 Where Dynoz acts as a Data Processor, the Customer is the Data Fiduciary. Dynoz Processes such Personal Data solely on the instructions of the Customer and in accordance with its written agreement with the Customer. The privacy notice of the Customer governs such Processing, and requests relating to it should be addressed to the Customer. Dynoz provides each Customer with notice wording for its Guests, and assists the Customer in responding to requests from Data Principals and in reporting Personal Data Breaches.
4. Personal Data Collected through the Website
| Personal Data | Internet Protocol (IP) address, browser and device information, and the pages requested. |
|---|---|
| Purpose | Delivery and security of the Website, prevention of misuse of its forms, and measurement of Website usage. |
| Legal basis | Legitimate Use: the Data Principal provides this information when requesting the Website, and it is Processed solely to deliver and secure the Website.DPDP Act, 2023 |
| Recipients | The hosting service provider of the Website, and the provider of the map on the contact page. |
| Retention | Server logs are retained for one (1) year. IP addresses are held transiently in memory to limit repeated form submissions and are not stored. |
4.1 Analytics. The Website uses analytics that do not use cookies. Visits are distinguished by an identifier that is discarded within twenty-four (24) hours, and the analytics data does not identify any Data Principal.
4.2 Third-party content. When the map on the contact page loads, its provider receives the IP address of the Data Principal and may set its own cookies, subject to its own privacy policy. All other content of the Website, including its images, is served from our own domain.
5. Personal Data Submitted with Enquiries
| Personal Data | Name and work email address and, at the option of the Data Principal, company name, telephone number and industry, together with the message, the selected topic, and a record of Consent with its date and time. |
|---|---|
| Purpose | To respond to and follow up on the enquiry, including requests for demonstrations, support and partnerships, and requests to exercise rights. |
| Legal basis | Consent, given through the consent checkbox on the form, which may be withdrawn at any time. Requests to exercise rights are also Processed in compliance with law.DPDP Act, 2023 |
| Recipients | Our email delivery service provider, which stores data in India, and the mailboxes of our team. |
| Retention | One (1) year from the date of the last communication with the Data Principal, after which the enquiry is erased. |
| Withdrawal and rights | Consent may be withdrawn at any time, with the same ease with which it was given, through our contact form or at security@dynoz.ai. The Data Principal may exercise the rights described in this Policy in the same manner, may raise a grievance with the Grievance Officer and, upon exhausting that remedy, may complain to the Board. |
5.1 The provision of Personal Data is voluntary. A Data Principal may instead write to us by email, and we request only such Personal Data as is necessary to respond.
6. Personal Data of Job Applicants
| Personal Data | Name, email address, professional profile link, project or portfolio link, curriculum vitae and the information it contains, the role applied for, and a record of Consent with its date and time. |
|---|---|
| Purpose | To assess the application and to communicate with the applicant regarding it. |
| Legal basis | Consent, given through the consent checkbox on the form, which may be withdrawn at any time.DPDP Act, 2023 |
| Age | Applicants confirm on the form that they are at least eighteen (18) years of age. Dynoz does not knowingly accept applications from children. |
| Use of artificial intelligence | Our recruitment system uses AI processing to read and classify applications. All hiring decisions are taken by individuals. |
| Recipients | Our careers mailbox, and our recruitment system hosted on servers in India. |
| Retention | One (1) year from the date of the application or of the last communication, whichever is later, after which the application and the curriculum vitae are erased. |
| Withdrawal and rights | Consent may be withdrawn at any time, with the same ease with which it was given, through our contact form or at security@dynoz.ai. The Data Principal may exercise the rights described in this Policy in the same manner, may raise a grievance with the Grievance Officer and, upon exhausting that remedy, may complain to the Board. |
7. Personal Data of Business Contacts
| Personal Data | Name, work email address, company, designation and notes of communications. |
|---|---|
| Sources | Publicly available business sources such as company websites, professional networks and industry directories; referrals and events; and contact lists purchased or licensed from data providers. The source of each contact is recorded. |
| Purpose | Introduction of the Services to prospective Customers and partners, and related follow-up communications. |
| Basis | Business contact details that are publicly available or shared for business purposes, Processed solely for business-to-business communication. |
| Opting out | Every email carries an unsubscribe option. A Data Principal may unsubscribe, reply “unsubscribe” or write to security@dynoz.ai, whereupon we shall cease sending emails and shall record the opt-out so that the Data Principal is not contacted again. |
| Retention | One (1) year from the date of the last communication. Opt-out records are retained for as long as is necessary to honour the opt-out. |
8. Personal Data of Customer Staff
| Personal Data | Name, work email address, role and permissions, a telephone number for alerts where enabled by the Customer, sign-in and activity records, and the requests and alerts handled by staff. |
|---|---|
| Role and basis | Dynoz Processes this Personal Data as a Data Processor, on the instructions of the Customer under its written agreement with the Customer. Staff should address requests regarding their Personal Data to the Customer, and Dynoz shall assist the Customer in responding. |
| Service providers | Sign-in is provided through a dedicated authentication service, and Dynoz does not store dashboard passwords. Where enabled by the Customer, alerts are delivered through a messaging service provider. |
| Security records | Sign-in and access logs are maintained to protect the Services. |
8.1 This Policy is linked from the sign-in page of the Dynoz dashboard and serves as notice to dashboard users of the Processing described above. Dashboard users accept the Terms of Use on first sign-in, and the acceptance is recorded.
9. Personal Data of Dynoz Personnel
| Personal Data | Name, contact details, identity and address documents, tax identifiers, bank account details for payroll, employment and engagement records, and records of devices and system access. |
|---|---|
| Purpose | To administer employment or engagement, pay remuneration, comply with employment, tax and other applicable laws, and secure our systems and devices. |
| Legal basis | Legitimate Use for the purposes of employment and, where the SPDI Rules, 2011 so require for sensitive personal data such as bank account details, written Consent.DPDP Act, 2023 |
| Recipients | Our payroll, banking and human resources service providers, and authorities where required by law. |
| Retention | For the period of employment or engagement, and thereafter for the periods prescribed by employment, tax and other applicable laws. |
9.1 This notice is provided to each member of our personnel at the commencement of their engagement. Personnel may exercise the rights described in this Policy and raise grievances with the Grievance Officer.
10. Personal Data of Guests
10.1 When a Data Principal calls a Customer, or is called by a Customer, through the Services, an AI assistant handles the call on behalf of the Customer. The Customer is the Data Fiduciary and determines the purpose and means of Processing; Dynoz Processes the Personal Data solely on the instructions of the Customer.
10.2 Manner of Processing
- The call commences with a short notice from the Customer, in the language set by the Customer, stating that the Data Principal is speaking with an AI assistant, that the call is transcribed and, where the Customer has enabled call recording, recorded, and how to learn more or to speak to a person. The playing of the notice is recorded in the call record.
- A speech-to-text service converts the speech of the Data Principal into text.
- AI processing prepares the replies of the assistant, on calls made to the Customer and on calls made by the Customer, such as reminder and feedback calls.
- A text-to-speech service speaks the replies in a voice generated by AI.
- Where the Data Principal asks to speak to a person and the call is transferred to the staff of the Customer, the assistant ceases to listen, and nothing said after the transfer is transcribed or, unless the Customer has enabled call recording, stored.
- Each of these steps takes place in India by default, or in the region specified in the agreement with the Customer.
10.3 Personal Data Processed
- The telephone number of the Data Principal, the words spoken by the Data Principal, and the replies of the assistant.
- Information held in the systems of the Customer that the call requires, such as name, contact details, booking, appointment or enquiry details, preferences and loyalty membership.
- Information that the Data Principal chooses to share for a stay or visit, such as dietary requirements, allergies or accessibility requirements, which may include sensitive personal data under the SPDI Rules, 2011, and which is passed to the Customer to enable it to provide its services.
- A transcript and a short summary of the call, available to the Customer in its Dynoz dashboard.
- Where the Customer enables call recording, an audio recording of the call, available to the Customer in its Dynoz dashboard.
- Where the Customer uses payment links, the details required to send a link for payment on the page of the payment service provider of the Customer. Dynoz does not receive card details.
10.4 Purpose and Legal Basis
Such Personal Data is Processed solely to handle the call on behalf of the Customer: to answer queries, to make or modify bookings and appointments, to convey requests, and to maintain a record of the call for the Customer. The legal basis is determined by the Customer, ordinarily Consent or the Legitimate Use of details voluntarily provided by the Data Principal to make a booking, an appointment or a request, as permitted by the DPDP Act, 2023.
10.5 Undertakings
- Dynoz records calls only where the Customer enables call recording. Otherwise, call audio is Processed in real time and is not stored.
- Dynoz does not use calls, recordings or transcripts to train AI models without the written permission of the Customer.
- The assistant does not request card details, one-time passwords or identity numbers such as Aadhaar or passport numbers. If a Data Principal discloses any of them during a call, they are removed from the transcript before it is stored.
- Calls made on behalf of a Customer concern the booking, stay, visit or request of the Data Principal, carry no promotional content, are placed within the calling hours set by the Customer, and are made in accordance with the Telecom Commercial Communications Customer Preference Regulations, 2018.
- Dynoz does not sell Personal Data or use it for advertising.
10.6 Storage and Retention
Transcripts, summaries, call recordings where enabled, and booking and appointment records are stored on servers in India by default, or in the region specified in the agreement with the Customer. They are retained for the period specified in the agreement between Dynoz and the Customer and for any minimum period prescribed by law, including under the DPDP Rules, 2025, and are thereafter erased automatically.
10.7 Choices of the Data Principal
As the Customer determines the Processing, the Data Principal should first approach the Customer. The Data Principal may also contact Dynoz through our contact form or at security@dynoz.ai, and Dynoz shall forward the request to the Customer on the same working day and assist the Customer in responding. A Data Principal who prefers not to speak with the assistant may ask to speak to a person. A Data Principal who does not wish to receive calls from a Customer may say so during a call or inform the Customer; the preference is recorded against the telephone number and honoured for all future calls from that Customer, as is any preference not to be contacted that the Data Principal has recorded with the Customer.
Where the Customer relies on Consent, the Data Principal may withdraw it at any time, including by saying so during the call, or by informing the Customer or Dynoz, and Dynoz shall forward the withdrawal to the Customer on the same working day. The Data Principal may also end the call at any time, after which no further Personal Data is collected from it. The Data Principal may exercise the rights described in this Policy through the Customer or Dynoz and, upon exhausting the grievance redressal mechanism of the Customer, may complain to the Board.
Bookings may include the number and ages of children, as provided by the adult making the booking. Dynoz does not knowingly collect any other information relating to children.
11. Purposes of Processing
11.1 Dynoz Processes Personal Data solely for the purposes described in this Policy, namely to:
- provide, operate, maintain and troubleshoot the Services;
- respond to enquiries, requests and grievances;
- assess job applications and communicate with applicants;
- introduce the Services to businesses that may be interested in them;
- administer the engagement of Dynoz personnel;
- secure the Services and the Website and prevent misuse; and
- comply with law and with lawful requests from authorities.
11.2 Dynoz does not sell Personal Data, does not use it for advertising and does not share it with advertisers. Dynoz does not take hiring or other significant decisions concerning a Data Principal solely by automated means.
12. Use of Artificial Intelligence
- Nature of use. The Services use AI processing to understand callers, respond to them, summarise calls and perform the tasks that a Customer enables, such as creating bookings, appointments or service requests. The assistant acts only through the tools enabled in the setup of the Customer.
- Disclosure. Each call opens with a notice that the Data Principal is speaking with an AI assistant, and the voice of the assistant is generated by AI.
- Accuracy and human assistance. AI output may be inaccurate. A Data Principal may ask to speak to a person at any time, and the staff of the Customer may review the transcript and summary of each call.
- Training of AI models. Dynoz does not use calls with Guests, recordings or transcripts to train AI models without the written permission of the Customer.
- Third-party AI services. Our AI service providers are bound by written terms not to use the Personal Data sent to them to train their models.
- Recruitment. AI processing assists in sorting job applications; all hiring decisions are taken by individuals.
13. Disclosure and Sharing of Personal Data
13.1 Dynoz discloses Personal Data only as set out below:
| Recipient | Personal Data disclosed and purpose |
|---|---|
| Service providers | Personal Data required by each service provider to perform its services for Dynoz, and solely for that purpose, under written agreements that bind the service provider to confidentiality, security, the location of Processing and the prohibition of training on our data. The service providers, the services they perform and their locations are listed under Subprocessors on our Trust Center, which is maintained up to date and forms part of this Policy. |
| Customers | Personal Data of Guests and Customer staff, which belongs to the Customer to which it relates. |
| Payment service providers chosen by the Customer | Where a Customer uses payment links, the details required to create the link. |
| Authorities | Personal Data that Dynoz is required by law to disclose to government agencies, regulators or courts. The law may prohibit Dynoz from informing the Data Principal of such disclosure. |
| Successor entity | In the event of a merger, acquisition or sale of all or part of the business of Dynoz, the Personal Data transferred as part of that transaction, subject to the protections of this Policy. |
14. Cross-Border Transfer of Personal Data
14.1 Personal Data is stored and Processed in the following locations, and each service provider is listed on our Trust Center:
| Processing | Location |
|---|---|
| Services provided to Customers: databases, file storage, backups, telephone calls, speech-to-text, the voice of the assistant, and AI processing for calls and call summaries | India by default, or the region specified in the agreement with the Customer |
| Processing by Dynoz for itself: Website forms and the emails they send, job applications, and system and security logs | India |
14.2 Where the agreement with a Customer specifies a region outside India, the Personal Data Processed for that Customer is transferred to and Processed in that region on the instructions of the Customer. Certain service providers listed on our Trust Center may also Process Personal Data outside India. Dynoz transfers Personal Data outside India only as permitted by law, and only to recipients that ensure the same level of data protection as Dynoz is required to maintain under Indian law. The DPDP Act, 2023 permits such transfers save to such countries as the Central Government may restrict by notification.
15. Retention and Erasure of Personal Data
15.1 Personal Data is retained only for so long as is necessary for the purpose for which it was collected, or for such longer period as may be required by law, and is erased automatically at the end of the applicable period:
| Personal Data | Retention period |
|---|---|
| Enquiries | One (1) year from the date of the last communication. |
| Job applications | One (1) year from the date of the application or of the last communication, whichever is later. |
| Business contacts | One (1) year from the date of the last communication. |
| Opt-out records | For as long as is necessary to honour the opt-out. |
| Records of Consent | Retained with the enquiry or application to which they relate, for the same period. |
| Records of requests and grievances | One (1) year from the date of closure. |
| Personal Data of Guests and Customer staff | The period specified in the agreement with the Customer, being not less than any minimum period prescribed by law. |
| Personnel records | The period of engagement and the periods prescribed by applicable law thereafter. |
| System and security logs | One (1) year, maintained in India. |
| Website analytics identifier | Twenty-four (24) hours. |
| Database backups | Erased Personal Data is removed from backups within seven (7) days. |
15.2 Where any law prescribes a minimum retention period, including the one-year period under the DPDP Rules, 2025, Dynoz shall retain the Personal Data for that period, shall not Process it for any other purpose, and shall erase it upon the expiry of that period. Where a Customer instructs Dynoz to erase the Personal Data of a Guest, Dynoz shall cease Processing it forthwith and shall erase it upon the expiry of any such minimum period.
16. Rights of the Data Principal
16.1 Subject to applicable law, including the DPDP Act, 2023 and the SPDI Rules, 2011, every Data Principal has the following rights:
| Right | Description |
|---|---|
| Right to access information | To obtain a summary of the Personal Data Processed by Dynoz, the Processing activities undertaken in respect of it, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared, together with a description of the Personal Data so shared. |
| Right to correction, completion and updating | To have inaccurate or misleading Personal Data corrected, incomplete Personal Data completed, and Personal Data updated. |
| Right to erasure | To have Personal Data erased where it is no longer necessary for the purpose for which it was collected, or upon withdrawal of Consent, unless its retention is required by law. |
| Right to withdraw Consent | To withdraw Consent at any time, with the same ease with which it was given, through our contact form or at security@dynoz.ai. Withdrawal shall not affect the lawfulness of Processing carried out before it, and Dynoz shall cease Processing the Personal Data concerned within a reasonable time. Where Consent is withdrawn or not given, Dynoz may be unable to provide the service requested. |
| Right to nominate | To nominate another individual to exercise these rights in the event of the death or incapacity of the Data Principal, by writing to Dynoz. |
| Right of grievance redressal | To have grievances redressed by the Grievance Officer and, upon exhausting that remedy, to approach the Board. |
16.2 Manner of Exercising Rights
A request to exercise any of the above rights may be submitted through our contact form or to security@dynoz.ai, stating the email address or telephone number used with Dynoz, to enable the relevant Personal Data to be identified. Dynoz may verify the identity of the Data Principal before acting on the request. Each request is recorded and tracked until it is closed. Where a Data Principal gives, manages, reviews or withdraws Consent through a Consent Manager registered with the Board, Dynoz shall give effect to it.
| Request | Timeline |
|---|---|
| Request to exercise a right | Acknowledged promptly and responded to within one (1) month. |
| Grievance | Resolved within one (1) month from the date of receipt. |
| Request relating to Personal Data Processed for a Customer | Forwarded to the Customer on the same working day. |
16.3 Duties of the Data Principal
In exercising these rights, a Data Principal shall comply with applicable law, shall not impersonate another person, shall not register a false or frivolous grievance or complaint, and shall furnish only verifiably authentic information when seeking the correction or erasure of Personal Data, as required by the DPDP Act, 2023.
17. Children and Persons with Disability
17.1 The Website and the Services are intended for adults and businesses. Dynoz does not knowingly collect Personal Data of children through the Website and, upon becoming aware of any such collection, shall erase the Personal Data. Dynoz does not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children.
17.2 The parent or lawful guardian of a child, and the lawful guardian of a person with a disability, may exercise the rights described in this Policy on their behalf. The number and ages of children included in a booking are Processed as described for Guests.
18. Cookies and Similar Technologies
18.1 The Website does not set cookies, and its analytics do not use cookies. The map on the contact page may set cookies of its provider when it loads. The Dynoz dashboard used by Customer staff stores sign-in information in the browser to keep users signed in, and clears such information upon sign-out.
19. Reasonable Security Practices and Procedures
19.1 Dynoz maintains a documented information security programme comprising reasonable security practices and procedures to protect Personal Data, as required by the Information Technology Act, 2000, the SPDI Rules, 2011 and the DPDP Act, 2023, including:
- encryption of Personal Data in transit and at rest on our servers;
- role-based access control for production systems and Personal Data, with access reviewed every month;
- a log of every access to the Personal Data of Guests;
- masking of telephone numbers in the Dynoz dashboard and its exports;
- removal of card numbers, one-time passwords and identity numbers from transcripts before they are stored;
- system and security logs that exclude call conversations, telephone numbers and email addresses;
- verification of the signature on each request received from our telephony service provider and between our systems;
- dashboard sign-in through a dedicated authentication service, such that Dynoz does not store passwords;
- automated database backups, maintained in the same region as the data they protect, with restores tested periodically;
- system clocks synchronised with time sources traceable to the National Informatics Centre or the National Physical Laboratory, as the CERT-In Directions require;
- vulnerability management and timely application of security patches;
- confidentiality undertakings and privacy and security training for all personnel with access to Personal Data; and
- an audit of these practices by an independent auditor at least once a year.
20. Personal Data Breach
20.1 No method of transmission or storage is completely secure. Dynoz maintains a documented incident response plan, under which a suspected incident is escalated within one (1) hour of being noticed.
20.2 In the event of a Personal Data Breach affecting Personal Data for which Dynoz is the Data Fiduciary, Dynoz shall intimate the affected Data Principals and the Board without delay, describing the breach, its likely consequences, the measures taken to mitigate it and the steps the Data Principal may take, together with a contact for queries, and shall submit a detailed report to the Board within seventy-two (72) hours of becoming aware of the breach, in the manner prescribed by law.
20.3 Where a Personal Data Breach affects Personal Data that Dynoz Processes for a Customer, Dynoz shall inform the Customer without delay, with the details the Customer requires to discharge its obligations.
20.4 Dynoz shall report cyber security incidents to the Indian Computer Emergency Response Team (CERT-In) within six (6) hours of noticing them, as required by law.
21. Amendments to this Policy
21.1 Dynoz may amend this Policy from time to time. The “Last updated” date above shall reflect the date of the latest amendment. Where an amendment is material, Dynoz shall highlight it on this page and notify Customers and dashboard users by email.
22. Grievance Officer
22.1 In accordance with the Information Technology Act, 2000, the SPDI Rules, 2011 and the DPDP Act, 2023, the Grievance Officer of Dynoz addresses grievances and responds to queries regarding the Processing of Personal Data:
| Name | Shubham Aggarwal |
|---|---|
| Designation | Grievance Officer |
| Company | Centora Technologies Private Limited |
| Address | First Floor, No. 24, Road No. 1, Mukesh Colony, Ballabhgarh, Faridabad, Haryana 121004, India |
| shubham@dynoz.ai | |
| Timeline | Grievances are acknowledged promptly and resolved within one (1) month from the date of receipt. |
22.2 A Data Principal who is not satisfied with the resolution of a grievance may approach the Board.
23. Governing Law
23.1 This Policy shall be governed by and construed in accordance with the laws of India.
Questions about this page?
Our team will be glad to assist with any questions about this document.