Our Story

Privacy and Policy

Compliance Framework under the Digital Personal Data Protection Act, 2023 (DPDP Act)

Effective Date: 27 September 2026 | Last Updated: 27 September 2026

1. Scope and Identity of Data Fiduciary

Indipik Digital Media LLP, trading as Indipik ("Data Fiduciary"), is committed to processing personal data responsibly and in full compliance with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable data protection regulations. This Privacy Policy governs personal data collected when you visit www.indipik.com, register accounts, subscribe to retainers, submit briefs, or interact with our services.

2. Key Data Protection Principles

We adhere to core DPDP Act principles: lawful and specified purpose, data minimization, accuracy, reasonable security safeguards, defined retention limits, and accessible grievance redressal.

3. Personal Data Categories Collected

We collect: (a) Account Data (name, business email, phone, job title, company name, login hashes); (b) Billing & Tax Data (GSTIN, corporate address, invoice records, payment transaction references via Axis Bank); (c) Licensing & Project Data (Image IDs, Declared End-Client names, brief parameters); (d) Technical Data (IP address, browser type, device logs, timestamp, Cookie IDs); and (e) Model Release Records (names, guardian consents, physical releases stored securely with restricted access).

4. How Personal Data is Collected

Data is collected: directly through user input (forms, registrations, checkout); automatically via cookies and server logs; and from corporate account administrators designating team seats.

5. Specified Purposes of Processing

Personal data is processed strictly to: (a) create and administer business accounts; (b) execute 100% advance transactions and issue GST invoices; (c) issue legal Licence Certificates naming Declared End-Clients; (d) deliver assisted search ("Brief-to-Board"); (e) secure the platform against fraud and AI scraping; and (f) comply with tax and statutory obligations.

6. Lawful Grounds for Processing

Processing is based on: (a) explicit user consent given during sign-up; (b) performance of contractual obligations; (c) compliance with statutory legal duties under Indian law; and (d) voluntary provision of business contact details for specified commercial services.

7. Business-to-Business (B2B) Communications

We may send business account holders updates regarding new regional collections, retainer renewals, and industry reports. Users may opt out of promotional emails at any time via the unsubscribe link. Essential transactional alerts (invoices, licence certificates, security notices) will continue.

8. Cookies and Tracking Technologies

The Platform utilizes strictly necessary, functional, analytics, and performance cookies. Users may customize their tracking preferences via the Cookie Settings panel. Refer to Part 3 for details.

9. Automated Processing and Search Ranking

Search results and image recommendations utilize automated indexing algorithms based on metadata keywords. Automated tools do NOT make decisions producing legal or significant personal effects concerning users.

10. Sharing and Disclosure of Personal Data

We share personal data ONLY with trusted service providers under strict data-processing agreements: (a) Axis Bank payment gateway for PCI-DSS secure checkout; (b) AWS cloud hosting and security infrastructure; (c) auditing and legal advisors; and (d) statutory Indian government authorities when required by law. WE NEVER SELL PERSONAL DATA TO THIRD-PARTY ADVERTISERS.

11. Payment Information Isolation (Axis Bank Gateway)

Online advance payments are processed directly through Axis Bank's PCI-DSS compliant secure gateway. Indipik receives payment confirmation tokens and transaction IDs, but NEVER sees or stores credit card numbers, CVV codes, or net banking passwords.

12. Data Retention Schedules

Personal data is retained according to statutory schedules:

  • Account Profiles: Retained while active + 3 years post-closure for dispute logs.
  • Tax Invoices & GST Records: Retained for 8 years as mandated under Indian tax law.
  • Licence Certificates & End-Client Records: Retained PERMANENTLY to evidence perpetual commercial usage rights.
  • Briefs & Temporary Reference Comps: Retained for 90 days following project completion.

13. Technical and Organizational Security Safeguards

Indipik implements SSL 256-bit encryption, AES-256 storage encryption, multi-factor authentication for administrators, firewalls, and quarterly vulnerability scans to protect data against unauthorized access.

14. Personal Data Breach Management Protocols

In the event of a verified personal data breach, Indipik shall take immediate containment measures, document findings, and notify the Data Protection Board of India and affected data principals in accordance with DPDP Act timelines.

15. Children's Personal Data Protection

The customer platform is strictly for business users aged 18 and older. Information regarding child models appearing in regional photography is collected solely through physical parental/guardian model releases, stored securely offline with restricted access.

16. Rights of Data Principals under DPDP Act 2023

Data principals possess the right to: (a) access a summary of personal data being processed; (b) request correction or updating of inaccurate data; (c) request erasure of personal data (subject to tax and licence retention laws); (d) register grievances; and (e) nominate another individual in the event of death or incapacity.

17. Mechanism for Exercising Data Rights

Data principals may exercise their DPDP rights by emailing support@indipik.com with account verification details. Requests shall be acknowledged within 24 hours and resolved within 15 business days.

18. Grievance Redressal Officer Contact Details

In accordance with the DPDP Act 2023, the designated Grievance Officer is:

  • Name & Title: Shailendra Chouhan, CEO (Grievance Officer), Indipik Digital Media LLP
  • Address: 40, Brijeshwari Nx, 2nd Floor, Near Bengali Square, Indore (452016), MP, India.
  • Email: support@indipik.com | Phone: +91 93033 37321

19. Account Closure and Post-Termination Data Handling

Account closure terminates active platform access but preserves historical tax invoices and generated Licence Certificates necessary to defend historical commercial usage rights.

20. Cross-Border Data Transfers

Any international transfer shall comply strictly with DPDP Act notification rules.

21. Updates to Privacy Policy

We may update this Privacy Policy to reflect statutory changes under the DPDP Rules. Material updates shall be notified via registered email and banner alerts.

22. Contact Information for Privacy Matters

For privacy inquiries or DPDP compliance questions, email support@indipik.com or write to our Indore corporate office.

23. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of India. Disputes shall be subject to sole-arbitration seated in Indore, Madhya Pradesh.