🇮🇳 India — Digital Personal Data Protection Act, 2023
Act No. 22 of 2023 · Applicable to all Indian Data Principals
Data Fiduciary
Indgrocart LLC acts as the Data Fiduciary as defined under the DPDP Act, 2023. AutoMentor Enterprise is a product of Indgrocart LLC. The Data Fiduciary determines the purpose and means of processing personal data of trainees, system users, and other Data Principals using the platform.
Administration of training programs and recording of participation. Legal basis: §6 (consent) or §7(i) (employment purpose).
Performance Tracking
KPI captures (pre-training and post-training), skill gap assessment scores.
Measuring training effectiveness and individual professional development. Legal basis: §6 (consent).
Certification & Badges
Training completion status, assessment scores used for certification issuance.
Issuing and maintaining training certificates and achievement badges. Legal basis: §6 (consent).
Gamification
Learning activity logs, quiz attempts, streaks, XP points, leaderboard rankings.
Personalising the learning experience. Legal basis: §6 (consent). Disabled for minors without guardian consent.
Session & Security
IP address, device type, browser user-agent, login timestamps.
Security monitoring, session management, and fraud prevention. Legal basis: §6 (consent) or §7(i) (employer protection).
Your Rights Under the DPDP Act (§11–§14)
§11 — Right to Access
You may request a summary of all personal data we hold about you, the purposes for which it is processed, and the identities of all third parties your data has been shared with. Access your data at /learners-central/my-data.
§12 — Right to Correction & Erasure
You may request correction of inaccurate or incomplete personal data, and request erasure of your personal data where retention is no longer necessary for the specified purpose or legally required.
§13 — Right to Grievance Redressal
You have the right to have grievances related to the processing of your personal data redressed by us. You must exhaust this mechanism before approaching the Data Protection Board of India.
§14 — Right to Nominate
You may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity.
§6(4) — Right to Withdraw Consent
Where consent is the legal basis for processing, you may withdraw your consent at any time with the same ease as you gave it. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
To exercise any of these rights, visit /learners-central/my-data within the platform, or contact us at contact@indgrocart.com.
Data Protection Contact (§8(9))
Indgrocart LLC — Data Protection Contact
117 South Lexington Street Ste 100, Harrisonville, MO 64701, USA
Data Protection Board of India (§13 Complaint Mechanism)
If you are not satisfied with our response to a grievance, you may file a complaint with the Data Protection Board of India, which has been established under Section 18 of the DPDP Act, 2023. The Board operates as a digital office at dpboard.gov.in. You must exhaust the grievance mechanism with us under §13 before approaching the Board.
Children's Data Protection (§9)
We obtain verifiable consent of the parent or lawful guardian before processing personal data of any trainee under 18 years of age. Gamification, behavioural tracking, and AI-based learning recommendations are disabled for minor trainees until guardian consent is recorded as Granted. We do not conduct targeted advertising directed at children.
Cross-Border Data Transfers (§16)
AutoMentor Enterprise is hosted on Base44 cloud infrastructure located in the United States. All personal data of Indian Data Principals is stored on Base44 servers outside India. This constitutes a cross-border transfer under Section 16 of the DPDP Act. We have a Data Processing Agreement with Base44 governing their obligations as our Data Processor. Additionally, session IP addresses are processed via a third-party geolocation service (ip-api.com, hosted in the USA) only where you have consented to session logging. If the Central Government restricts transfers to applicable countries under Section 16, we will take immediate steps to ensure compliance.
1. Introduction
Indgrocart LLC ("Indgrocart", "we", "us", "our") is committed to protecting your privacy and processing your personal data lawfully. AutoMentor Enterprise is a software product owned and operated by Indgrocart LLC. This Privacy Policy explains how we collect, use, store, share, and protect personal information in connection with the AutoMentor Enterprise platform.
This Policy is designed to comply with the Digital Personal Data Protection Act, 2023 (India), applicable US federal and state privacy laws including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), and the GDPR where we serve EU/UK customers. For Indian Data Principals, the DPDP Act, 2023 applies and prevails to the extent of any conflict with other laws.
2. Data Fiduciary / Data Controller
All privacy rights and obligations rest with Indgrocart LLC, which operates as the Data Fiduciary (under the DPDP Act, 2023) and Data Controller (under GDPR) for all personal data processed through AutoMentor Enterprise.
Indgrocart LLC
117 South Lexington Street Ste 100, Harrisonville, MO 64701, USA
Full name, email address, phone number, job title, and employee code
Organisation, dealer, branch, and region assignment
Login credentials (passwords hashed using one-way cryptography; plaintext never stored)
Training & Performance Data
Training program nominations, attendance records, and assessment scores
Certification records, badge awards, and skill endorsements
Pre-training and post-training KPI capture data
Quiz attempts, learning progress, and course completions
Gamification & Learning Activity
XP points, learning streaks, leaderboard rankings
Course video consumption and progress tracking
AI coaching recommendations and skill gap analyses
Session & Technical Data
IP address, browser type, device type, and operating system
Login timestamps and session duration
Geolocation (city, region, country derived from IP — where consent is given)
4. Data Sharing & Third-Party Disclosures
We share personal data only in the following circumstances:
Base44 (Cloud Infrastructure)
Country: USA
Platform hosting, data storage, and infrastructure services. Base44 acts as our Data Processor under a Data Processing Agreement.
ip-api.com (Geolocation)
Country: USA
IP address geolocation for security logging. Applied only where consent to session logging has been given.
Google Fonts CDN
Country: USA
Font delivery. Your browser may send IP address and user-agent to Google's servers when loading fonts.
Email Service Provider
Country: TBD
Notification delivery for platform alerts and training reminders.
Law Enforcement & Regulators
Country: India/applicable jurisdiction
Where required by law, court order, or regulatory authority including the Data Protection Board of India.
We do not sell, rent, or trade personal data to third parties for marketing purposes. Under CCPA/CPRA, we do not "sell" or "share" personal information as those terms are defined.
5. Data Retention
We retain personal data for the following periods (aligned with our DPDP-compliant Retention Policy, configurable per organisation):
Data Type
Default Period
On Expiry
Trainee records (inactive)
3 years after deactivation
Anonymised
Assessment records
7 years after training completion
Anonymised
Attendance records
7 years after training completion
Deleted
Nominations
7 years after training completion
Deleted
Session logs
2 years
Deleted
Certificates
10 years
Anonymised
Consent records
7 years
Retained (immutable audit evidence)
Audit logs
7 years
Retained (immutable)
Data may be retained longer where required by applicable law. Records subject to a legal hold are exempt from automated erasure.
6. Data Security Safeguards (DPDP Act §8(5))
TLS 1.2+ encryption for all data in transit
Role-based access control (RBAC) — users access only data relevant to their role
Organisation-level data isolation enforced server-side via JWT token verification
Session management with configurable idle timeout, concurrent session limits, and force-logout capability
Comprehensive audit logging for all personal data create, update, delete, and export operations
Automated security anomaly detection from audit log patterns
Formal security incident management process with Board notification capability under §8(6)
In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in accordance with Section 8(6) of the DPDP Act, 2023.
7. California Privacy Rights (CCPA / CPRA)
California residents have the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt-out of the sale or sharing of personal information. We do not sell or share personal information. To exercise your rights, contact us at contact@indgrocart.com.
8. EU / UK GDPR Rights
Where we process personal data of EU or UK data subjects, you have rights under the GDPR/UK GDPR including: access, rectification, erasure, restriction of processing, data portability, and the right to object. You also have the right to lodge a complaint with your local supervisory authority. Contact us at contact@indgrocart.com.
9. Cookies & Session Data
We use session cookies to maintain login state and platform functionality. We do not use cookies for cross-site advertising or third-party tracking. You may control cookies through your browser settings, though this may affect platform functionality.
10. India Addendum — DPDP Act Applicability
For customers and Data Principals in India, the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) applies to all processing of personal data carried out through the AutoMentor Enterprise platform. The provisions of the DPDP Act prevail over any conflicting provision in these Terms or this Privacy Policy to the extent of such conflict. Data-related disputes and grievances involving Indian Data Principals shall follow the grievance and appeal mechanism under the DPDP Act. If you are dissatisfied with our response to a grievance, you may escalate to the Data Protection Board of India. Nothing in these Terms limits or waives any right conferred on you by the DPDP Act.
11. Changes to This Policy
We may update this Policy periodically. We will notify registered users at least 14 days before material changes take effect. Where changes affect the legal basis or purpose of processing your personal data under the DPDP Act, we will present an updated notice and, where required, re-obtain your consent.
12. Contact Us
Indgrocart LLC — Data Protection Contact
117 South Lexington Street Ste 100, Harrisonville, MO 64701, USA