Privacy Policy

This Privacy Policy explains how Blue Pencil Strategies Private Limited (“Blue Pencil”, “we”, “us”) handles personal data in connection with Sehmat, our consent management platform. Blue Pencil is a company incorporated under the Companies Act, 2013, with its registered office at 5th Floor Vinay Bhavya Complex, 159A, CST Road, Kalina, Santacruz East, Mumbai 400098.

We follow the Digital Personal Data Protection Act, 2023 (the “Act”) and the Digital Personal Data Protection Rules, 2025 (the “Rules”). Words such as Data Fiduciary, Data Principal, Data Processor and Board have the meanings given in section 2 of the Act.

1. Two roles, two kinds of data

We handle personal data in two different roles. It matters which one applies to you.

We are the Data Fiduciary for:

• people who visit this website;
• people who write to us;
• people who request access to Sehmat for their organisation; and
• staff of our customer organisations who sign in to the Sehmat console.

For this data, we decide why and how it is used, and we answer to you directly.

We are a Data Processor for the personal data of people who give, refuse or withdraw consent through Sehmat. The organisation that asks for your consent is the Data Fiduciary. It decides what to ask, why and for how long. We process that data only on its instructions, under a contract with it, as section 8(2) of the Act requires.

We do not sell this data. We do not use it for our own purposes. We do not share it with anyone the organisation has not named or approved.

If you gave consent to an organisation through Sehmat, that organisation is responsible for your data. Its contact details and its officer are printed on the notice you saw and on your receipt. Section 9 of this policy explains how to reach it.

2. Data we collect as Data Fiduciary

2.1 Website visitors

This website does not set cookies. It does not use analytics, advertising or tracking tools. It has no forms that send data to us.

Our hosting provider, Amazon CloudFront, keeps standard server access logs. Each entry records the IP address, browser and device details (user agent), the page requested and the time. We use these logs only for security and to keep the site running.

The accessibility menu and the read-aloud feature save your preferences only in your own browser. Read-aloud uses your browser’s built-in speech. Nothing from either feature is sent to us. See our Cookies and Local Storage page.

2.2 People who write to us

The Contact page opens your own email app with a message addressed to contact@bluepencil.com. If you send it, we receive your email address, your name if you include it, and what you write.

2.3 People who request access

The signup form on the Sehmat console asks for:

• your organisation’s name, type and address;
• registration and tax details, such as PAN, GSTIN, CIN, or 12A or 80G registration;
• how you plan to use Sehmat; and
• a contact person’s name, email address and mobile number.

Most of this is about the organisation, not a person. The contact details are personal data.

2.4 Console users

When your organisation adds you as a user, we hold your name, work email address, mobile number if given, your role and permissions, and sign-in and security records. We also record what you do in the console, such as publishing a form or recording a paper consent. These records form part of your organisation’s audit log.

3. Why we use it and on what basis

Under the Act, we may process personal data with consent (section 6) or for a legitimate use (section 7).

Data	Purpose	Basis
Server access logs	Keep the website secure and running; investigate misuse	Section 7(a): the data your browser sends when you visit, used only for that purpose
Emails you send us	Reply to you and keep a record of what we agreed	Section 7(a): you gave us the data for that purpose
Access requests	Check that the organisation is genuine, including an AI-written summary of public facts for our reviewer, decide on the request, set up the account, and contact you about it	Section 7(a), and your consent where we ask for it on the form
Console user data	Give you access, keep accounts secure, keep an audit trail for your organisation, and send service messages	Section 7(a) for the details you give us to sign in. Actions recorded in your organisation’s audit log are processed for your organisation, as its Data Processor
Any of the above	Meet a legal duty or a court order	Section 7(d) and section 7(e)

We do not use this data for advertising. We do not sell it. If we want to send you news about Sehmat, we will ask first, and you can stop at any time.

4. Data we process for customer organisations

When an organisation uses Sehmat to ask for consent, we process, on its behalf:

• the details it chooses to collect, such as name, mobile number, email address and any identifier it uses;
• the notice and form version shown, the language, the choices made, the time, and the channel (link, SMS, WhatsApp, paper or in person);
• scanned or photographed paper consent sheets, if the organisation uses paper;
• withdrawals, rights requests and grievances;
• for a child or a person with a lawful guardian, the guardian’s details and the outcome of an age or guardian check; and
• messages sent to the person, such as receipts and breach notices.

The organisation decides what is collected and for which purposes. Questions about these choices should go to the organisation.

5. How long we keep data

We keep personal data only as long as the purpose needs it, or longer only where a law requires it (section 8(7) of the Act).

• Server access logs: at least one year, as Rule 8(3) requires for logs of processing. We then delete them unless a law requires longer.
• Emails: as long as needed to deal with your message and any follow-up, and then for one year.
• Access requests: while we review the request. If we approve it, for as long as the organisation’s account is open. If we decline it, for one year after our decision, and then we erase it.
• Console user data: while your user account is active. After it is closed, we keep sign-in and security records for one year. Your name and actions remain in your organisation’s audit log for as long as the organisation keeps its consent evidence.

Customer data. The organisation sets how long its data is kept. By default, consent evidence is stored in write-once storage for 7 years. During that period, no one, including us, can change or delete the stored evidence. When the organisation’s retention period ends, or when it tells us to erase data, we erase it, subject to that lock and to any law that requires us to keep it. When a contract ends, we return or erase the data as the contract says.

6. Who we share data with

We use service providers to run Sehmat. They process personal data for us under contracts or published terms that bind them to use it only to provide their service. The current list, with what each one does and where it processes data, is on our Service providers page. We update that page before we add or replace a provider.

We may also disclose data where a law, a court or a government authority lawfully requires it. If we sell or merge our business, data may pass to the new owner, who must keep to this policy or tell you of any change.

7. Where data is stored

We store personal data in India. Our systems run in the AWS Mumbai region, and database backups are copied to the AWS Hyderabad region. The AI features run within India.

Some data can leave India:

• WhatsApp. WhatsApp messages are carried by Meta, whose systems may be outside India. This applies whether an organisation sends through MSG91 or through Meta’s Cloud API.
• Providers an organisation brings. If an organisation connects its own Twilio, SendGrid or mail server account, its messages go through that provider, which may be outside India.
• Our own email. Mail to contact@bluepencil.com is hosted by Microsoft 365.

Section 16 of the Act allows such transfers unless the Central Government has restricted transfers to that country. Some sector laws, such as those for banking, can require data to stay in India; an organisation subject to them should choose its channels with that in mind.

8. How we protect data

We take reasonable security safeguards, as section 8(5) of the Act and Rule 6 require. They include:

• encryption of stored data, with customer-managed encryption keys (AWS KMS) for consent evidence;
• write-once storage (S3 Object Lock) for consent evidence;
• a tamper-evident audit log, in which each entry is linked to the one before it by a hash, so that any change can be detected;
• malware scanning of uploaded files;
• a web application firewall;
• multi-factor sign-in, which console users can turn on;
• access limited by role; and
• backups in a second Indian region.

No system is completely secure. If a personal data breach affects data for which we are the Data Fiduciary, we will tell you and the Board as Rule 7 requires. If it affects customer data, we will tell the organisation without delay so that it can inform you and the Board.

9. Your rights

9.1 Data we hold as Data Fiduciary

Under sections 11 to 14 of the Act, you have the right to:

• access: get a summary of your personal data and how we process it, and the names of other Data Fiduciaries and Data Processors we have shared it with, with a description of what was shared (section 11);
• correction and erasure: have your data corrected, completed or updated, and have it erased when it is no longer needed for the purpose or required by law (section 12);
• grievance redressal: have a complaint about our handling of your data dealt with (section 13); and
• nomination: name one or more people to use your rights if you die or become unable to act (section 14 and Rule 14(4)).

Where you gave consent, you can withdraw it at any time. Withdrawing is as easy as giving it (section 6(4)). It does not affect processing done before you withdrew. After you withdraw, we stop processing that data unless a law requires us to keep it.

To use any of these rights, email contact@bluepencil.com. Tell us your name and the email address or mobile number you used with us, so that we can find your data. We may ask you to confirm your identity. We will reply within a reasonable time and no later than 90 days.

9.2 Data we process for an organisation

If you gave consent to an organisation through Sehmat, make your request to that organisation. You can:

• use the link on your receipt or the organisation’s My consents page, where available, to see and withdraw your consents; or
• contact the organisation’s officer, whose details are on the notice and your receipt.

If you write to us instead, we will pass your request to the organisation promptly and help it respond. We will not act on customer data without the organisation’s instructions, except where a law requires us to.

9.3 Your duties

Section 15 of the Act asks you to give accurate information, not to impersonate anyone, and not to file false or frivolous complaints.

10. Grievances and the Data Protection Board

If you have a concern about how we handle your data, contact our Grievance Officer:

Bhupendra Singh Mewari Grievance Officer and Data Protection Officer Blue Pencil Strategies Private Limited 5th Floor Vinay Bhavya Complex, 159A, CST Road, Kalina, Santacruz East, Mumbai 400098 Email: contact@bluepencil.com

We will respond to your grievance within 90 days of receiving it, in line with Rule 14(3). If you are not satisfied after using this process, you may complain to the Data Protection Board of India (section 13(3) of the Act). See our Grievance Redressal page for details.

11. Children

The Sehmat website and console are for organisations and their adult staff. They are not meant for children, and we do not knowingly collect a child’s data for our own purposes. If we learn that we have, we will erase it.

Organisations that use Sehmat may need consent for children or for persons with a lawful guardian. Sehmat helps them get verifiable consent from a parent or lawful guardian, as section 9 of the Act and Rules 10 and 11 require. That processing is done for the organisation, as described in section 4.

12. Links to other sites

Our website may link to other sites, such as government sources. We are not responsible for their privacy practices. Please read their policies.

13. Changes to this policy

We may update this policy when our services or the law change. We will post the new version here with a new date. If a change materially affects how we use your data, we will tell console users and customer contacts by email before it takes effect, and ask for fresh consent where the law requires it.

14. Contact us

For any question about this policy, email contact@bluepencil.com or write to Blue Pencil Strategies Private Limited, 5th Floor Vinay Bhavya Complex, 159A, CST Road, Kalina, Santacruz East, Mumbai 400098.