DPDP Act compliance

This page sets out how Vantigo meets its obligations as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (together, the "DPDP Act"). It supplements, rather than replaces, our Privacy Policy, which covers what data we collect and how it's used day to day. This page focuses specifically on your rights as a Data Principal and how to exercise them.

Where implementation currently stands

The DPDP Act is being rolled out in phases by the Government of India. Some provisions — including the Data Protection Board and the core obligations on Data Fiduciaries described below — are already in effect. Others, such as the Consent Manager framework that will let you manage consent across multiple platforms from one place, are still being operationalized nationally and aren't yet available from any provider. We'll update this page as further provisions take effect.

Who we are, in this context

Vantigo is the Data Fiduciary for the personal data you provide through the platform — meaning we determine why and how it's processed. Where you join through a sponsoring institution, that institution acts as a joint Data Fiduciary for the enrollment information it provides to us.

The basis on which we process your data

We process your personal data on the basis of your consent, given when you create an account and agree to our Terms of Service and Privacy Policy. Where you're enrolled by a sponsoring institution, limited enrollment data is processed on the basis of that institution's own legitimate engagement with you as a student, consistent with the DPDP Act's provisions for such cases.

Your rights as a Data Principal

Under the DPDP Act, you have the right to:

• Accessa summary of the personal data we hold about you and how it's being processed.
• Correction of inaccurate or incomplete personal data — most of this you can already update directly from your account settings.
• Erasureof your personal data, once it's no longer needed for the purpose it was collected for, or on request (see Data retention below for how this actually works).
• Withdraw consentat any time, with the same ease as giving it. Withdrawing consent doesn't affect the lawfulness of anything already processed before the withdrawal, and may mean we can no longer provide some or all of the Services to you.
• Grievance redressal— you can raise a complaint about how we've handled your data directly with us (see below), and if unsatisfied with our response, escalate to the Data Protection Board of India.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

How to exercise these rights

Email support@vantigo.in with your request and the email address on your Vantigo account. We'll verify your identity before acting on the request, and aim to respond within 30 days. There's no fee for exercising these rights.

Data retention

We retain your personal data only for as long as it's needed for the purposes it was collected for, or as required by law. If you request deletion, we retain your data for 30 days after approval (to prevent abuse of the deletion process, such as immediately rejoining to bypass entitlement limits), after which it's permanently deleted and you'll receive a confirmation email.

Cross-border processing

Some of your data is processed outside India by our AI providers (Anthropic and OpenAI, both US-based) strictly to power AI-driven features like resume analysis, mock interviews, and skill assessments. As of this writing, the DPDP Act permits such transfers by default except to countries the Government of India specifically restricts — none are currently restricted. We'll update this section if that changes.

Data breach notification

If a breach of your personal data occurs, we'll notify you and the Data Protection Board of India as required under the DPDP Rules, with details of what happened, what data was affected, and what we're doing about it.

Children's data

Vantigo is intended for students engaged in campus placement preparation, who are ordinarily 18 or older. We don't knowingly process personal data of children under 18 in a way that requires verifiable parental consent under the DPDP Act. If you believe a minor has created an account, contact us and we'll act promptly.

Changes to this page

As further provisions of the DPDP Act and Rules take effect, or as our own practices change, we'll update this page and the "last updated" date above.