LEGAL · PRIVACY

Privacy Policy

How Express IVR collects, uses and protects personal data — in line with India's DPDP Act, 2023 and DPDP Rules, 2025.

This policy is a professionally drafted template for Express IVR, grounded in the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 and TRAI's TCCCPR. It is not legal advice — please have it reviewed and finalised by qualified legal counsel before publication.

Last updated: December 2025 · Effective date: to be confirmed

1. Who we are

Express IVR is operated by SMS Cloud Technologies Pvt Ltd · B&B Genesis, A-12-13, First Floor, A Block, Sector 16, Noida, Uttar Pradesh 201301, India ("Express IVR", "we", "us"). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), we act as a Data Fiduciary for the personal data of our website visitors and account holders, and as a Data Processor for personal data we process on behalf of our business customers.

2. Scope

This policy explains what personal data we collect, why, the lawful basis on which we process it, how long we keep it, who we share it with, and the rights available to you as a Data Principal under Indian law.

3. Personal data we collect

  • Account & contact data — name, work email, phone number, company and role when you sign up, request a demo or contact us.
  • Usage & technical data — IP address, device and browser information, pages viewed and actions taken, collected via cookies and similar technologies.
  • Service data — call and message metadata (numbers, timestamps, duration, delivery status), recordings and transcripts where enabled, processed to deliver the service to our customers.
  • Billing data — such information as is necessary to invoice and collect payment. We do not store full card numbers.

4. How and why we use it

We process personal data to provide and secure the service, to respond to enquiries, to bill, to meet legal and regulatory obligations, and to improve our products. Where the DPDP Act requires consent, we rely on your free, specific, informed and unambiguous consent, collected through a clear, standalone notice that states the purpose. You can withdraw consent at any time (see section 6).

Our consent notices describe each purpose in plain language and, where practical, tie each item of personal data to the specific purpose for which it is processed. Withdrawing consent is as easy as giving it, and will not affect the lawfulness of processing carried out before withdrawal.

6. Your rights as a Data Principal

Subject to the DPDP Act and DPDP Rules, you have the right to:

  • Access a summary of the personal data we process about you and the processing activities;
  • Correct, complete or update inaccurate or incomplete personal data;
  • Erase personal data that is no longer necessary for the stated purpose;
  • Withdraw consent previously given;
  • Grievance redressal — raise a complaint with us and, if unresolved, with the Data Protection Board of India;
  • Nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any right, contact our Grievance Officer (section 12). We will respond within the timelines required by law.

7. Retention & erasure

We keep personal data only for as long as the purpose for which it was collected is being served, or as required by law. In line with Section 8(7) of the DPDP Act and Rule 8 of the DPDP Rules, we erase personal data when consent is withdrawn, the purpose is fulfilled, or a retention period lapses — unless retention is required for legal compliance.

8. Security

We apply reasonable security safeguards — including encryption, access controls and masking where appropriate — to protect personal data in our possession or control, including data processed by our sub-processors. In the event of a personal data breach, we will notify affected Data Principals and the Data Protection Board as required by the DPDP Rules.

9. Sharing & processors

We share personal data only with vetted sub-processors (such as cloud hosting and telecom carriers) under contracts that require them to protect it, and where disclosure is required by law or a competent authority. We do not sell personal data.

10. Cross-border transfers

Where personal data is transferred outside India, we do so in accordance with the DPDP Act and DPDP Rules and any restrictions notified by the Central Government, and under appropriate safeguards.

11. Children's data

We do not knowingly process the personal data of children (individuals under 18) without verifiable parental consent, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children, as required by the DPDP Act.

12. Grievance Officer & contact

For any question, consent withdrawal or complaint about this policy or your personal data, contact our Grievance Officer at [email protected], SMS Cloud Technologies Pvt Ltd · B&B Genesis, A-12-13, First Floor, A Block, Sector 16, Noida, Uttar Pradesh 201301, India. If you are not satisfied with our response, you may approach the Data Protection Board of India.

13. Changes to this policy

We may update this policy from time to time. The "last updated" date above reflects the latest version. Material changes will be notified through the service or by email.