Skip to main content

Notice to Data Principals (DPDP Act, 2023)

Last updated: 29 July 2026

This notice is provided under section 5 of the Digital Personal Data Protection Act, 2023 ("DPDP Act"). ProdigiAI, Mumbai, Maharashtra, India, is the Data Fiduciary in respect of personal data processed through MyTradeDesk.

Personal data processed and purpose

See our Privacy Policy for a categorised list and purposes.

Manner of exercising your rights

  • Right to access: Settings → Data safety → "Export everything" gives you a ZIP containing every row we hold against your account.
  • Right to correction & erasure: most fields are editable in Settings. To erase your account, use Settings → Security → "Schedule account deletion".
  • Right to grievance redressal: see below.
  • Right to nominate: contact the DPO with the nominee details and a copy of valid identification.

Withdrawal of consent

You may withdraw consent at any time by deleting your account. Where processing is necessary for legal compliance (e.g. retention of payment records under tax law), we may continue to retain such data for the minimum period required.

Grievance Officer / Data Protection Officer

Varun ChatlaniGrievance Officer & Data Protection Officer
ProdigiAI
Mumbai, Maharashtra, India
Email: varun@prodigiai.org
Phone: +91 93217 27752
Subject line: DPDP grievance

We will acknowledge every grievance within 24 hours and substantively respond within 15 days. If unsatisfied, you may approach the Data Protection Board of India.

Personal data breach notification

In the event of a personal data breach, we will notify each affected Data Principal and the Data Protection Board of India as required under section 8(6) of the DPDP Act, and will report reportable incidents to CERT-In within 6 hours of becoming aware of them. See our security practices for the full process.

Cross-border transfers

Personal data is processed primarily in India. Some sub-processors may process data in other jurisdictions notified by the Central Government. All processors are bound by contractual data-protection obligations.