DPDP Compliance & Data Protection.

This Digital Personal Data Protection Policy explains how Ucartz Online Private Limited ("Ucartz", "we", "our", or "us") processes, stores, and protects digital personal data in strict alignment with the Digital Personal Data Protection Act, 2023 (DPDP Act, Act No. 22 of 2023) enacted by the Parliament of India, together with applicable rules framed thereunder, the Information Technology Act, 2000, and the cybersecurity directives issued by the Indian Computer Emergency Response Team (CERT-In).

Our commitment is to process digital personal data transparently, securely, and only for purposes you have consented to or that qualify as lawful legitimate uses under the Act.

DPDP Compliance Notice, updated November 2026 (Version 1.0)

1) Introduction & Legislative Scope

Ucartz is dedicated to safeguarding the privacy, confidentiality, and data sovereignty of individuals whose digital personal data we handle. This policy outlines our governance architecture under the DPDP Act, ensuring you have complete visibility over how your data is collected, used, processed, retained, and protected.

Material & Territorial Scope: This policy applies to the processing of digital personal data within the territory of India where such data is:

• Collected in digital form across our public websites, client portal (https://www.ucartz.com/clients), APIs, and digital applications; or
• Collected in non-digital form and digitized subsequently.

It also applies to the processing of digital personal data outside the territory of India if such processing is carried out in connection with offering goods or services to Data Principals located within the territory of India.

Exclusions: In accordance with Section 3(c) of the DPDP Act, this policy does not apply to personal data processed by an individual for any personal or domestic purpose, or personal data that is made or caused to be made publicly available by the Data Principal to whom such personal data relates, or by any other person under a legal obligation to do so.

2) Key Definitions & Legal Roles

The DPDP Act establishes distinct roles and responsibilities. Ucartz operates in two distinct legal capacities depending on the context of the service:

• Data Fiduciary (Section 2(i)): Ucartz acts as a Data Fiduciary regarding customer account data, identity verification records, billing transactions, support tickets, communication logs, and portal telemetry. In this role, Ucartz determines the purpose and means of data processing.
• Data Processor (Section 2(k)): When you host websites, applications, databases, multimedia streams (Icecast, Shoutcast, CentovaCast, VdoPanel), or customer files on Ucartz Shared Hosting, Reseller Hosting, KVM VPS, Dedicated Servers, or GPU nodes, you act as the Data Fiduciary and Ucartz acts strictly as a Data Processor processing data on your behalf pursuant to our Data Processing Addendum (DPA) and service agreements.
• Data Principal (Section 2(j)): The individual to whom the personal data relates. Where the individual is a child (under 18 years of age) or a person with a disability, the term includes their lawful parent or legal guardian.
• Digital Personal Data (Section 2(n)): Personal data in digital form about an individual who is identifiable by or in relation to such data.
• Personal Data Breach (Section 2(u)): Any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, alteration, destruction, or loss of access to personal data that compromises its confidentiality, integrity, or availability.
• Consent Manager (Section 2(g)): An entity registered with the Data Protection Board of India that acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw consent.
• Data Protection Board of India (DPBI): The statutory regulatory and adjudicatory body established by the Central Government of India under Section 18 of the DPDP Act.

3) Lawful Grounds for Processing Personal Data

In accordance with Section 4 of the DPDP Act, Ucartz processes digital personal data only on lawful grounds:

3.1 Processing Based on Consent (Section 6)

Where processing is based on consent, we ensure that your consent is free, specific, informed, unconditional, and unambiguous, expressed through a clear affirmative action. Consent signifies an explicit agreement to the processing of personal data for a specified purpose, limited only to the data strictly necessary for that purpose.

3.2 Processing for Certain Legitimate Uses (Section 7)

Under Section 7 of the DPDP Act, Ucartz may process digital personal data without obtaining separate consent for specified legitimate uses, including:

• Specified voluntary provision: Where you voluntarily provide personal data to Ucartz for a specific purpose (such as submitting an order, initiating payment, or opening a support ticket) and have not expressed an objection to such processing.
• Fulfillment of legal obligations: Processing required to comply with any law in force in India, including tax filings under the Goods and Services Tax (GST) Act, corporate governance under the Companies Act 2013, and mandatory system log maintenance under CERT-In directives.
• Compliance with judicial orders: Complying with any judgment, decree, or order issued under any law in force in India by a competent court or tribunal.
• Safety and emergency responses: Responding to medical emergencies involving a threat to life or public health.
• Network security and fraud prevention: Taking necessary technical measures to prevent cyber security incidents, investigate brute-force intrusions, mitigate Distributed Denial of Service (DDoS) attacks, and maintain platform integrity.

4) Notice & Consent Framework

To ensure full transparency under Section 5 of the DPDP Act, every request for consent is accompanied or preceded by an itemised notice presented in clear and plain language.

• Itemised Details: Our notice explicitly specifies the categories of personal data to be collected, the exact purpose of processing, the manner in which you may exercise your statutory rights (including withdrawal of consent and grievance redressal), and the contact details of our Grievance Officer.
• Multilingual Accessibility (Section 5(3)): You have the statutory option to access our notice and consent requests in English or in any of the 22 languages specified in the Eighth Schedule to the Constitution of India (such as Hindi, Malayalam, Tamil, Kannada, Bengali, etc.) upon request.
• Unconditioned Consent: We do not condition the provision of our hosting, server, or domain services on your consent to the collection of personal data that is not necessary for delivering that service.
• Ease of Withdrawal: You have the right to withdraw your consent at any time as easily as it was granted. Withdrawal can be executed via your client portal settings or by notifying our Grievance Officer at compliance@ucartz.com. Withdrawal does not affect the lawfulness of processing carried out prior to such withdrawal. Upon withdrawal, Ucartz and its data processors cease processing your personal data, unless ongoing retention is legally required by applicable law.
• Consent Managers: You may manage, review, or withdraw consent through registered Consent Managers recognized by the Data Protection Board of India once interoperability standards are operationalized.

5) Personal Data We Process

We collect and process digital personal data across distinct operational categories:

• Account & Identity Data: Full name, company name, registered email address, mobile phone number, billing address, country of residence, username, encrypted password hashes, and tax identification numbers (PAN or GSTIN where applicable).
• Billing & Payment Data: Invoices, transaction identifiers, payment gateway tokens, payment timestamps, and credit/debit records. Payment card details are processed securely through Level 1 PCI-DSS certified payment gateways (e.g., Razorpay, Stripe, PayPal). Ucartz never stores raw credit or debit card numbers on its servers.
• Technical & System Telemetry: Public IP addresses, browser headers, operating system details, timestamps of server access, SSH and control panel authentication logs, firewall trigger logs, and API usage records.
• Domain Registration (WHOIS) Data: Registrant, technical, and administrative contact details required by ICANN, the National Internet Exchange of India (NIXI for .IN domains), and accredited registrars.
• Customer Support & Diagnostics: Tickets, email exchanges, chat transcripts, diagnostic error logs, and temporary administrative server credentials voluntarily provided for TechOps, CloudOps, DevOps, or SecOps assistance.
• Data Stored in Hosted Environments: Content, files, databases, and media that you upload or transmit through our infrastructure. We treat this data as strictly confidential and process it only as your Data Processor.

6) Purpose of Processing

Ucartz processes digital personal data exclusively for specified, legitimate, and necessary purposes:

• Service Provisioning & Automation: Creating, provisioning, deploying, and maintaining your Web Hosting, KVM VPS, Dedicated Servers, GPU Servers, Domain Names, SSL Certificates, and Streaming solutions.
• Billing, Accounting & Taxation: Processing subscription invoices, collecting payments, applying statutory GST calculations, issuing receipts, and maintaining corporate statutory books of account.
• Platform Stability & Cybersecurity: Detecting and mitigating malicious traffic, brute-force attacks, DDoS attempts, server abuse, spam, and enforcing our Acceptable Use Policy (AUP).
• Customer Support & Operations: Investigating service incidents, troubleshooting server configurations, executing migrations, and responding to client tickets.
• Professional Services Execution: Delivering managed server administration, FinOps, CloudOps, and SecOps tasks in accordance with agreed Statements of Work.
• Essential Service Communications: Delivering vital transactional notifications, invoice reminders, security advisories, scheduled maintenance notices, and policy revisions.
• Marketing & Announcements (Opt-In Only): Sending product updates, technology guides, and promotional discounts only where you have explicitly opted in. You can unsubscribe at any time with one click.

7) Data Sharing, Processors & Disclosures

We do not sell, rent, or trade your digital personal data to third parties. Data is shared only with vetted recipients bound by confidentiality and statutory data protection agreements under Section 8(2) of the DPDP Act:

• Infrastructure & Data Center Partners: Tier III and Tier IV data center facilities located in India (Mumbai, Bengaluru, Noida) and global hub locations (Germany, Netherlands, USA, UK, Singapore, Australia) where server hardware is housed.
• Payment Gateways: Regulated payment aggregators and gateways (e.g., Razorpay, Stripe, PayPal) operating under Reserve Bank of India (RBI) and PCI-DSS compliance frameworks.
• Domain Registries & Registrars: ICANN-accredited domain registrars and NIXI (.IN Registry) for fulfilling domain registration, transfer, and lifecycle mandates.
• Transactional Communication Relays: Secure email and SMS delivery gateways utilized strictly for sending automated invoices, system alerts, and authentication OTPs.
• Law Enforcement & Statutory Authorities: Government agencies, CERT-In, courts, or regulatory authorities only when strictly required by a lawful summons, warrant, or statutory mandate under Indian law.
• Corporate Restructuring: In the event of a merger, acquisition, or sale of company assets, subject to strict non-disclosure obligations and continued adherence to this policy.

8) Cross-Border Transfers of Personal Data

Ucartz operates high-performance hosting clusters across more than 15 countries worldwide. Cross-border transfers of digital personal data are governed by Section 16 of the DPDP Act:

• Permitted Jurisdictions: The Central Government of India permits the transfer of personal data outside India to countries and territories, except those specifically notified on a restricted list ("negative list"). Ucartz does not transfer data to any restricted jurisdictions.
• Customer Choice of Region: When ordering Cloud VPS, Dedicated Servers, or Shared Hosting, you have the full contractual freedom to choose your data center location. Indian enterprises requiring data to reside within national borders can select our Indian facilities (Mumbai, Bengaluru, or Noida) for complete data localization.
• Transfer Safeguards: Any cross-border data transfer required for account management, global DNS resolution, or international billing is safeguarded by standard contractual clauses, encryption in transit (TLS 1.3), and equivalent technical measures.

9) Data Retention & CERT-In Log Compliance

Under Section 8(7) of the DPDP Act, Ucartz erases digital personal data as soon as the purpose for which it was collected has been fulfilled, or upon the withdrawal of consent, unless retention is legally required.

Our specific data retention schedules are structured as follows:

• Active Account Records: Retained throughout the duration of your active customer relationship with Ucartz.
• Invoicing & Tax Records: Retained for a mandatory period of 8 years following the end of the relevant financial year, in compliance with the Indian Companies Act, 2013, the Income Tax Act, 1961, and Goods and Services Tax (GST) regulations.
• CERT-In Cyber Security Log Compliance: In strict compliance with the Directions issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the Information Technology Act, 2000, all system, firewall, network, server authentication, and DNS access logs are securely retained for a mandatory minimum period of 180 consecutive days.
• Customer Support Records: Ticket histories and diagnostic communications are retained for 3 years to ensure operational continuity and dispute resolution.
• Server Backups: Product-specific rolling automated backups are retained according to the schedule in our Service Level Agreement (typically 7 to 30 days) and are permanently overwritten upon expiry.
• Terminated Server Data: Following service termination or cancellation, server storage volumes and container filesystems are purged and securely overwritten in accordance with industry-standard cryptographic wipe protocols.

10) Technical & Organizational Security Safeguards

Pursuant to Section 8(5) of the DPDP Act, Ucartz implements reasonable technical and organizational security safeguards to prevent personal data breaches:

• Data Encryption in Transit: All website traffic, client portal sessions, API endpoints, and webmail portals are secured using TLS 1.3 / TLS 1.2 cryptographic protocols.
• Data Encryption at Rest: Database repositories containing personal data, customer invoices, and credentials utilize robust AES-256 encryption at rest.
• Access Controls & Least Privilege: Access to customer records is restricted strictly to authorized staff on a role-based, least-privilege basis. Administrative sessions require mandatory Multi-Factor Authentication (MFA).
• Network Perimeter Defense: Automated perimeter firewalls, Web Application Firewalls (WAF), and multi-terabit DDoS mitigation systems continuously filter malicious network traffic.
• Vulnerability Management & Audits: Continuous automated system vulnerability scans, routine kernel patching, and periodic third-party penetration assessments.
• Data Center Physical Security: Hardware is housed in ISO/IEC 27001, SOC 1, and SOC 2 Type II certified data centers featuring 24/7 on-site security, biometric access control, CCTV monitoring, and redundant power systems.

11) Personal Data Breach Management & Notification

Ucartz maintains a comprehensive, tested Incident Response Plan. In the unfortunate event of a personal data breach affecting digital personal data processed by Ucartz, we fulfill our statutory obligations under Section 8(6) of the DPDP Act:

• Immediate Triage & Mitigation: Our security response team acts immediately to isolate affected systems, contain the breach, prevent further unauthorized access, and preserve forensic evidence.
• Notification to the Data Protection Board of India (DPBI): We will intimate the Data Protection Board of India without undue delay in the form and manner prescribed under the DPDP rules, outlining the nature of the breach, affected systems, categories of personal data compromised, potential impact, and remedial measures taken.
• Notification to Affected Data Principals: We will notify affected Data Principals without undue delay, providing a clear and transparent explanation of the incident, the specific data involved, potential consequences, the protective actions implemented by Ucartz, and actionable recommendations the Data Principal should take to mitigate risks.

12) Protection of Children's Personal Data & Persons with Disabilities

Ucartz takes the protection of minors and vulnerable individuals with utmost seriousness in compliance with Section 9 of the DPDP Act:

• Services Intended for Adults: Ucartz hosting, cloud, server, and domain services are strictly intended for businesses, professionals, developers, and individuals aged 18 and older. We do not knowingly solicit or collect personal data from individuals under 18 years of age.
• Verifiable Parental Consent: If our services are ever utilized to process the personal data of a child (an individual under 18 years of age) or a person with a disability who has a lawful guardian, verifiable consent of the parent or lawful guardian must be obtained prior to processing in the manner prescribed by the DPDP rules.
• Absolute Statutory Prohibitions: Ucartz strictly prohibits and does not engage in:
  • Any tracking, behavioral monitoring, or profiling of children;
  • Any targeted advertising directed at children; or
  • Any processing of digital personal data that is likely to cause a detrimental effect on the well-being of a child.

13) Rights of Data Principals

Under Chapter III of the DPDP Act, every Data Principal possesses statutory rights regarding their digital personal data:

• Right to Access Information (Section 11): You have the right to obtain from Ucartz a summary of personal data being processed, a description of the processing activities, the identities of all Data Fiduciaries and Data Processors with whom the personal data has been shared, and any other information prescribed under the rules.
• Right to Correction & Updating (Section 12(1)(a)): You have the right to request the correction of inaccurate or misleading personal data and the completion of incomplete personal data.
• Right to Erasure (Section 12(1)(b)): You have the right to request the erasure of your personal data that is no longer necessary for the purpose for which it was collected or to satisfy statutory obligations.
• Right of Grievance Redressal (Section 13): You have the right to readily available grievance redressal mechanisms provided by Ucartz regarding any act or omission regarding our obligations under the DPDP Act.
• Right to Nominate (Section 14): You have the right to nominate an individual who, in the event of your death or incapacity, shall exercise your rights as a Data Principal in accordance with the Act.

How to Exercise Your Rights: To exercise any of these rights, submit a request via our client area ticketing system at https://www.ucartz.com/clients/submitticket.php or email our Grievance Officer at compliance@ucartz.com. We will verify your identity to prevent fraudulent disclosure and respond within the statutory timeframe (normally within 30 days).

14) Duties of Data Principals

The DPDP Act establishes mutual responsibility. Under Section 15 of the Act, Data Principals have specific statutory duties:

• Compliance with Law: You must comply with the provisions of all applicable laws while exercising your rights under the DPDP Act.
• No Impersonation: You must not impersonate another individual when providing personal data for any purpose or while submitting orders.
• No Suppression of Material Facts: You must not suppress any material information when providing personal data for any document, unique identifier, proof of identity, or proof of address issued by the State or its instrumentalities.
• No False or Frivolous Grievances: You must not register a false, fabricated, or frivolous grievance or complaint with Ucartz or the Data Protection Board of India.

15) Data Processing Addendum (DPA) for Hosting Customers

If you process personal data on servers, cloud VPS, or shared hosting instances provided by Ucartz, you represent and warrant that you are the Data Fiduciary under the DPDP Act, and you have obtained valid consent or possess lawful legitimate grounds to process that personal data.

Pursuant to Section 8(2) of the DPDP Act, Ucartz acts as your Data Processor strictly under a valid contract (Data Processing Addendum):

• Ucartz processes hosted personal data solely on your documented instructions;
• Ucartz implements and maintains rigorous technical and organizational security controls to protect the hosted data;
• Ucartz assists you, where technically feasible, in fulfilling your obligations to respond to rights requests from your Data Principals;
• Ucartz permanently deletes or returns all customer hosted data upon the termination of services; and
• A standard Data Processing Addendum is incorporated by reference into our Terms of Service. Enterprise clients requiring a countersigned bilateral DPA can request one by contacting compliance@ucartz.com.

16) Grievance Redressal Mechanism & Escalation to DPBI

Ucartz has established an efficient, readily accessible grievance redressal mechanism in strict compliance with Section 8(10) and Section 13 of the DPDP Act.

Designated Grievance Officer:

• Company: Ucartz Online Private Limited [CIN: U72200KL2017PTC048470, GSTIN: 32AACCU0519P1ZA]
• Officer: Grievance Officer & Data Protection Lead
• Email: compliance@ucartz.com (Direct Grievance Desk: grievance@ucartz.com)
• Telephone: +91-7034004444
• Registered Office: Near LP School, Agasthiyacodu, Anchal, Kollam, Kerala - 691306, India
• Operational Center: Opposite to Phase 3 Gate, Technopark, Trivandrum, Kerala, India

Acknowledgement & Resolution Timelines:

• All grievances received will be formally acknowledged with a unique tracking ticket within 24 hours of receipt.
• Our Grievance Officer will investigate and aim to resolve the grievance within 15 calendar days, and in any case not exceeding the maximum period prescribed by statutory rules (30 days).

Escalation to the Data Protection Board of India (DPBI):

Under Section 13(3) of the DPDP Act, if you are not satisfied with the resolution provided by our Grievance Officer, or if we fail to respond within the stipulated timeline, you have the statutory right to escalate the matter by lodging a formal complaint with the Data Protection Board of India (DPBI) through its designated online portal.

17) Policy Updates & Review

We review this DPDP Policy periodically to reflect changes in our operational procedures, technological advancements, and evolving statutory rules issued under the Digital Personal Data Protection Act, 2023.

Any material revisions will be prominently announced on our website and communicated directly to account holders via email or client portal announcements prior to taking effect. We encourage you to review this page periodically to stay informed about how Ucartz protects your digital personal data.