Privacy Policy & DPDP Notice
How SoSign provides civic advocacy services to users across India, why we collect personal and KYC data, and how we protect and process it under the Digital Personal Data Protection (DPDP) Act, 2023.
Last Updated & Effective Date: October 2026 | Document Reference: SOSIGN-DPDP-2026-V2 | Jurisdiction: Republic of India
Statutory Privacy Notice (DPDP Act 2023 - Section 5)
Accessible in English and Eighth Schedule Indian languages per Section 5(3)
Name, email address, mobile number, role/designation, digital signatures on petitions, optional Aadhaar DigiLocker verification token, uploaded profile photo, and security logs (IP address, session cookies).
SoSign provides civic petition and democratic advocacy services to users across India. Your personal data is securely stored and kept on servers in India, Maharashtra (Nashik). We collect personal data strictly to verify citizen identity, guarantee genuine petition signatures, prevent automated bot manipulation and duplicate voting, submit verified petitions to Indian decision-makers and government bodies, process voluntary crowdfunding via RBI-regulated payment gateways, and deliver campaign updates.
You have the statutory Right to Access summaries of your data, Right to Correction/Updation, and the Right to Erasure (Section 12) to request permanent deletion of your account and petitions at any time via your profile page.
You may withdraw your consent for non-essential processing (analytics, marketing) at any time through your profile or cookie settings with the same ease as granting it.
Mr. Narendra Kumar (Data Protection & Grievance Redressal Officer), SoSign, Email: grievance@sosign.in, Helpline: +91 9323677688. Statutory acknowledgment within 24 hours and resolution within 15–30 days.
Under Section 13(3) of the DPDP Act 2023, if your grievance remains unresolved after 30 days, you have the statutory right to escalate your complaint to the Data Protection Board of India.
Purpose
Purpose of the Website
The purpose of the SoSign website is to provide an accessible, secure, and transparent digital civic advocacy platform for citizens across India to create, sign, and mobilize verified public petitions, advocate for community improvements and child-health buffer zones around schools, and present authentic collective representations directly to government authorities, elected representatives, and decision-makers. Your personal data is securely stored and kept in India, Maharashtra, Nashik server.
1. Identity of the Data Fiduciary & Services Offered to Users in India
This Privacy Notice is issued pursuant to Section 5 of the Digital Personal Data Protection (DPDP) Act, 2023 by LEO MEO IT Solution (“SoSign”, “we”, “us”, or “Data Fiduciary”). SoSign operates the civic petition and digital democracy platform accessible at sosign.in and its affiliated mobile and web applications.
SoSign specifically offers its goods and services to users located in India. This document governs how we process the personal data of registered citizens, petition creators, signers, donors, visitors, and civic respondents (“Data Principals”) located across the territory of India. By accessing our services, creating an account, or signing a petition, you acknowledge the processing practices detailed herein under Indian legal jurisdiction.
2. Why We Collect Your Personal Data (Explicit & Legitimate Purposes)
In strict adherence to the Purpose Limitation principle (Section 6 of the DPDP Act, 2023), SoSign collects personal data only for clear, specific, transparent, and lawful purposes directly necessary to operate a credible civic democracy platform in India. We collect personal data for the following specific purposes:
To provide our petition creation and civic engagement services to users throughout India, enabling individuals, student groups, RWAs, and civil society organizations to launch public campaigns, mobilize community support, and build democratic momentum.
To create your account profile, securely verify your credentials via email/mobile OTP, manage passwords using bcrypt (10 rounds), maintain encrypted authentication sessions, and protect your account from unauthorized access, impersonation, or identity theft.
To record verified digital signatures when you sign a petition. Government ministries, elected representatives, and municipal authorities require verifiable evidence that petition signers are authentic citizens, ensuring every campaign carries real democratic weight.
To maintain strict anti-fraud safeguards. We verify account uniqueness and utilize cryptographic hashing to prevent automated bots, scripts, fake email generators, or malicious actors from artificially inflating signatures or rigging petition counts.
To allow citizens to optionally verify their identity or constituency via DigiLocker, UIDAI Aadhaar OTP, Income Tax PAN, or Voter ID. We NEVER store 12-digit plaintext Aadhaar numbers or biometrics; only masked records (XXXXXXXX1234) are retained.
To compile verified petition dossiers—including verified signature totals, general geographic spread by state/city, and public comments—to be formally submitted to government ministries, MPs, MLAs, municipal commissioners, educational institutions, or corporate leadership.
To send transactional messages, mobile OTP verification codes, petition milestone updates (e.g., reaching 500 or 10,000 signatures), responses from decision-makers, campaign victory announcements, and critical account security advisories.
To securely process voluntary crowdfunding contributions and platform subscriptions via RBI-regulated payment aggregators (supporting UPI, RuPay, debit/credit cards, and NetBanking), generating statutory tax invoices compliant with Indian GST and IT rules.
To satisfy statutory legal mandates under Indian law, including Section 6 affirmative consent logs under the DPDP Act 2023, the Information Technology Act 2000, and CERT-In directions mandating 180-day retention of cybersecurity logs.
To investigate, document, and resolve user inquiries, content objections, petition reports, and statutory privacy requests (data access, correction, erasure) handled by our Data Protection & Grievance Redressal Officer in Mumbai within statutory timelines.
Strict Prohibition on Secondary Use & Commercial Sale (Section 6(1)): SoSign never sells, rents, leases, trades, or monetizes citizen personal data to commercial data brokers, advertising exchanges, or political marketing consultancies. Data is processed exclusively for the stated civic purposes above.
3. Comprehensive Personal Data Inventory (What Data We Collect)
Under the principle of Data Minimization (Section 6, DPDP Act), we collect only the personal data strictly necessary to fulfill explicit civic advocacy and account verification purposes:
A. Account & Registration Data:
- Basic Profile: Full name, verified email address, mobile number, user-chosen designation, bio, and profile avatar URL.
- Security Credentials: Passwords hashed using bcrypt (10 rounds); OAuth 2.0 unique identifiers for Google Sign-In.
- Referral & Verification Code: Alphanumeric unique identifier for signature verification attribution.
B. Voluntary Identity Verification (KYC) Data:
- Aadhaar Data: Masked Aadhaar number (
XXXXXXXX1234) and SHA-256 cryptographic one-way hash. We NEVER store 12-digit plaintext Aadhaar numbers or biometric data. Demographic confirmation (name, gender, state, district) obtained via DigiLocker / UIDAI-authorized OTP gateways. - PAN Card: Verified name, masked number, and taxpayer type against Income Tax Department records via authorized API.
- Voter ID (EPIC): Electoral constituency, EPIC number, and registered name for local legislative verification.
C. Petition & Civic Signature Data:
- Petitions authored (title, problem statement, solution, target decision-makers, uploaded proof documents).
- Signatures recorded: User ID, signature timestamp, optional verified constituency number, and masked identity token.
- Public comments, progress updates, and formal citizen objection reports.
D. Payment & Technical Device Data:
- Payments: Order IDs, amounts, and payment tokens handled exclusively by RBI-regulated payment gateways (Razorpay/Cashfree). We never store debit/credit card CVV or net-banking passwords.
- Technical & Logs: IP address behind reverse proxies (for DDoS rate limiting), browser user-agent, session cookies, and login timestamps.
4. Lawful Grounds for Processing (DPDP Act, Sections 6 & 7)
We process personal data only when a recognized lawful basis exists under the DPDP Act, 2023:
| Processing Activity | Categories of Personal Data | Applicable Lawful Ground |
|---|---|---|
| Account creation & profile authentication | Name, email, mobile number, password hash | Consent (Section 6) |
| Voluntary KYC verification (Aadhaar / PAN / Voter ID) | Masked ID, demographic details, OTP session token | Explicit Consent (Section 6) |
| Signing a petition & presentation to decision-makers | Signer name, general city/constituency, signature timestamp | Consent & Contract (Section 6) |
| Duplicate signature prevention & vote integrity | User ID, SHA-256 identity hash | Legitimate Use (Section 7(a)) |
| DDoS protection, rate limiting & cybersecurity logs | IP address, request method, user agent | Legitimate Use (Section 7(c) / Security) |
| Responding to legal warrants or statutory authorities | As requested by court order or lawful agency | Legal Obligation (Section 7(b)) |
5. Third-Party Data Processors & Infrastructure Partners
In accordance with Section 8(2) of the DPDP Act, SoSign engages only qualified Data Processors bound by strict contractual obligations to process personal data solely on our instructions with equivalent cybersecurity safeguards:
DigiLocker (NeGD / MeitY) & PlanAPI: Used strictly for citizen identity verification via government cloud repositories and UIDAI-authorized OTP routing. No biometric data is ever processed or stored.
Database & Server Hosting: Production databases and servers are located in India, Maharashtra (Nashik server), operating with enterprise encryption at rest (AES-256) and TLS 1.3 in transit.
2Factor.in & SMTP / Resend: Transmit one-time verification passwords (OTP), petition milestone notifications, and security alerts. Phone numbers are transmitted over encrypted TLS connections.
Cloudinary CDN: Ingests in-memory image buffers, campaign visuals, and proof documents. Files are never stored on local web server disks where they could execute unauthorized scripts.
* SoSign does not sell, rent, lease, or monetize citizen personal data to commercial brokers or third-party advertising exchanges.
6. Data Retention Periods & Disposal Schedule (Section 8(7))
Under Section 8(7) of the DPDP Act, a Data Fiduciary must erase personal data upon withdrawal of consent or as soon as the purpose for which it was collected is no longer served. Our standardized retention schedule is as follows:
| Data Classification | Retention Period | Disposal / Erasure Action |
|---|---|---|
| Active User Account Data | For the duration of active account membership | Purged upon self-service account deletion or request. |
| Aadhaar / KYC Session Tokens | 10 to 30 minutes (Ephemeral) | Automatically invalidated by JWT expiration. |
| Petition Signature Records | Active campaign duration + civic audit record | Signatures pseudonymized upon user account deletion. |
| Payment & Financial Invoices | 7 Years (Mandatory under IT Act & GST laws) | Securely archived for statutory financial compliance. |
| Cybersecurity & Rate Limiting Logs | 180 Days (CERT-In mandate) | Rotated and purged automatically after 180 days. |
7. Protection of Children's Personal Data (Section 9)
In strict compliance with Section 9 of the DPDP Act, 2023:
- Age Requirement: SoSign services are intended for individuals who have attained 18 years of age.
- Verifiable Parental Consent: Minors may only participate in petition campaigns under the verifiable consent and active supervision of their parent or lawful guardian.
- Prohibition on Behavioral Tracking: SoSign strictly prohibits behavioral monitoring, tracking, or targeted advertising directed at children.
- Prohibition on Detrimental Processing: No processing that could cause harmful effects on the well-being of a child is permitted.
8. Your Statutory Rights as a Data Principal (Sections 11, 12, 13)
Under Chapter III of the DPDP Act, 2023, you have enforceable legal rights regarding your personal data. SoSign provides both self-service tools and official grievance channels to exercise these rights:
You have the right to obtain a summary of personal data being processed and the identities of data fiduciaries/processors with whom it has been shared. You can download your machine-readable personal data archive from your profile settings.
You have the right to correct, complete, or update any inaccurate or misleading personal data stored in your account through your profile dashboard.
You may exercise your “Right to be Forgotten” and request the permanent deletion of your account and unlinking of non-statutory petition signatures directly from your profile settings or by submitting a privacy request.
Where processing is based on consent, you may withdraw your consent at any time as easily as giving it. Withdrawing consent does not affect the legality of processing conducted prior to withdrawal.
Want to exercise your DPDP rights immediately?
Use our dedicated citizen privacy request portal or manage your data directly from your account.
9. Statutory Grievance Redressal Officer (Sections 8(10) & 13)
As mandated by Section 8(10) and Section 13 of the Digital Personal Data Protection Act, 2023, SoSign has appointed a dedicated Data Protection & Grievance Redressal Officer to handle inquiries, complaints, and statutory data principal requests:
Designated Officer: Mr. Narendra Kumar (Data Protection & Grievance Redressal Officer)
Entity: LEO MEO IT Solution (SoSign Division)
Postal Address: NESCO Center, Western Express Highway, Goregaon East, Mumbai, Maharashtra 400063, India
Official Grievance Email: grievance@sosign.in
Helpline Number: +91 9323677688
Response & Resolution SLA:
- Acknowledgment: Every privacy grievance receives an automated or formal acknowledgment with a unique tracking ticket within 24 business hours.
- Resolution Timeline: Grievances are investigated and resolved within 15 calendar days (and in no event exceeding 30 days as prescribed by DPDP Rules).
- Right to Approach Data Protection Board: If you are not satisfied with our resolution, you have the statutory right to file a complaint with the Data Protection Board of India (DPBI).
10. Personal Data Breach Management & Statutory Response Plan (Sections 2(u), 8(5) & 8(6))
10.1 What Counts as a Personal Data Breach? [DPDP Act Section 2(u)]
Under Section 2(u) of the Digital Personal Data Protection Act, 2023, a "personal data breach" is strictly defined as:
“Any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction of or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.”
At SoSign, any incident that threatens the confidentiality, integrity, or accessibility of citizen records—including email addresses, contact details, signature records, or masked KYC proofs—is classified and handled immediately under our statutory Breach SOP.
10.2 Five-Stage Data Breach Incident Response Plan (SOP)
Automated anomaly detection, SIEM log analysis, or grievance intake triage according to Section 2(u) categories with severity rating (Low, Medium, High, Critical).
Under Section 8(5), immediate revocation of active JWT authentication sessions, isolation of compromised endpoints, mandatory credential reset flags, and firewall hardening.
Log audits to determine exact impacted records, evaluate confidentiality/integrity vectors, verify encrypted KYC boundaries, and draft root-cause analysis (RCA).
Statutory Section 8(6) intimation to the Data Protection Board of India and CERT-In, paired with direct email and in-app alerts to each affected Data Principal.
Regression penetration tests, credential re-issuance, permanent security patches, and regulatory incident registry retention for mandatory Board audits.
10.3 Mandatory Notifications to Users & Data Protection Board of India (Section 8(6))
In strict adherence to Section 8(6) of the DPDP Act and CERT-In Directions, whenever a breach is confirmed:
- Notice to Data Protection Board of India (DPBI): We submit formal intimation containing the incident reference, nature of the breach, affected volume, rapid containment actions taken, and the contact coordinates of our Grievance Redressal Officer.
- Notice to Affected Citizens (Data Principals): We communicate directly via registered email and in-app alerts, explaining the incident in plain language, describing the remedial measures taken, and offering actionable steps to secure accounts.
10.4 Proactive Harm Reduction Safeguards (Section 8(5))
To prevent downstream damage following an incident, our rapid harm reduction protocols immediately execute:
11. Child Data Safeguards & Parental Consent (Section 9)
In strict adherence to Section 9 of the Digital Personal Data Protection Act, 2023, SoSign enforces rigorous safeguards to protect children (defined under Indian law as individuals under 18 years of age):
Before processing any personal data of a minor, we require verifiable consent from the parent or lawful guardian via affirmative email/SMS verification.
Per Section 9(3), we strictly prohibit tracking, behavioral monitoring, or analytics profiling of any child account on our platform.
Targeted advertising directed at children is completely banned. Minors only have access to non-targeted civic engagement and public interest petitions.
12. Vendor & Data Processor Governance (Sections 8(2) & 8(7))
When SoSign engages third-party vendors (Data Processors) such as payment gateways, SMS/email relays, or government KYC gateways, we mandate strict compliance under Section 8(2):
- Data Processing Agreements (DPAs): Every vendor must execute a binding DPA guaranteeing equivalent technical safeguards and statutory confidentiality.
- Technical Security Standards: Vendors must maintain verified certifications, including ISO 27001, SOC 2 Type II, and PCI-DSS Level 1.
- Obligation to Return or Delete (Section 8(7)): Our contracts mandate that vendors must irreversibly erase or return personal data once the processing purpose concludes or upon citizen account deletion.
- Regular Compliance Monitoring: We conduct bi-annual audits of vendor security postures and log flow-through erasure dispatches.
13. Cross-Border Personal Data Transfers & Localization (Section 16)
SoSign prioritizes domestic data sovereignty under Section 16 of the DPDP Act 2023:
- Primary In-Country Storage: All citizen account credentials, signature records, and personal data are kept and hosted on secure servers located in India, Maharashtra (Nashik server).
- Government Restrictions Compliance: We verify and guarantee that no personal data is ever transferred to foreign countries or territories restricted or blacklisted by the Central Government.
- CDN Edge Optimization: Public petition media assets (images, banners) served via global edge networks (Cloudinary) utilize Standard Contractual Clauses (SCC) with end-to-end TLS 1.3 encryption and contain zero personal identification records.
14. Internal Data Protection Policies & Retention Schedule (DRAS)
SoSign maintains formal internal policies, including an Internal Data Protection Policy (IDPP), Vendor Security Policy, and a strict Data Retention & Archival Schedule (DRAS):
| Category | Retention Period | Disposal Protocol |
|---|---|---|
| Masked KYC Records | Account Lifespan + 5 Years (PMLA / SPDI Rules) | Cryptographic deletion upon account erasure |
| Access & Security Logs | 180 Days (CERT-In Mandatory Directions) | Automated rolling archival purge |
| Consent Proofs | Lifespan of Account + 3 Years | Statutory compliance ledger archive |
| Inactive Accounts | 24 Months Zero Activity | Notice dispatched, followed by automated erasure |
15. Changes to this Privacy Notice
We periodically review this policy to reflect platform updates, statutory notifications, or rules framed under the DPDP Act. When material revisions occur, we notify users via banner notice, email notification, or account alerts before changes take effect.
SoSign is dedicated to safeguarding citizen digital identity while powering democratic civic engagement across India.