Summary: SignupDesk is operated by Decipher Consultancy Services. We act as a Data Processor on behalf of our business clients (event organisers), who are the Data Fiduciaries responsible for the personal data they collect from their event attendees. We comply with the Digital Personal Data Protection Act, 2023 (India).
Section 01
Who We Are
SignupDesk is a product of Decipher Consultancy Services, a company registered in Gurugram, Haryana, India.
We provide a white-label, multi-tenant event registration software platform ("Platform") to event organisers ("Clients"). When an event attendee registers for an event hosted on our Platform, they interact with our Client's branded page — but the Platform infrastructure is owned and operated by us.
In this document:
- "We / Us / Our" = Decipher Consultancy Services (SignupDesk operator)
- "Client" = the event organiser who has subscribed to SignupDesk
- "Attendee / You" = a person registering for a Client's event
Section 02
What Data We Collect
When you register for an event using SignupDesk, the following personal data is collected:
- Mandatory: Full name, email address, mobile number
- Optional (may be required by specific events): Company name, designation, city
- Custom fields: Any additional fields configured by the event organiser for their specific event
- Technical data: IP address (for fraud prevention and rate limiting), browser user agent, registration timestamp
- Consent record: Whether you gave consent, the consent text shown to you, and the time of consent
We do not collect payment card details, government IDs, biometric data, or any sensitive personal data unless explicitly required by a specific event and separately disclosed.
Section 03
How We Use Your Data
Your personal data is used exclusively for the following purposes:
- Allocating and confirming your event seat
- Generating your unique QR code pass for event entry
- Enabling check-in verification at the event venue
- Providing your registration confirmation and downloadable pass
- Allowing the event organiser to send event-related communications
- Maintaining an audit trail of seat allocations for the event organiser
We do not use your data for advertising, profiling, data brokerage, or any purpose outside the scope of event registration services.
Section 04
Legal Basis for Processing
Under the Digital Personal Data Protection Act, 2023 (India), personal data may only be processed with a valid legal basis. We rely on:
- Consent: You are shown a clear consent notice at the time of registration and must actively tick a checkbox to proceed. The full text of the consent is saved against your record.
- Legitimate interest: Technical data (IP, timestamps) is processed for platform security and fraud prevention.
Important: The event organiser (our Client) is the Data Fiduciary under DPDP Act 2023. They determine why your data is collected and are legally responsible for the lawful purpose of that collection. We, as the Data Processor, only process data according to our Client's instructions and our Data Processing Agreement.
Section 05
Data Sharing & Sub-Processors
We do not sell your personal data. We may share data only with:
- The event organiser (our Client): They receive your registration details for their event management purposes.
- Cloud infrastructure providers: Our Platform is hosted on Amazon Web Services (AWS), Asia Pacific region. AWS processes data as our sub-processor under their Data Processing Agreement.
- Email service providers: For sending registration confirmation emails, we may use a transactional email service (e.g., AWS SES).
All sub-processors are bound by data processing agreements and are required to maintain equivalent data protection standards.
Section 06
Data Storage & Security
- Location: All data is stored on AWS infrastructure in the Asia Pacific (Mumbai) region — your data stays in India.
- Encryption: Data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
- Access control: Only authorised event organiser personnel (via their admin panel) and our engineering team can access your data, strictly on a need-to-know basis.
- Tenant isolation: Each event organiser's data is logically isolated — other organisers cannot access your data.
- Backups: Data is backed up daily. Backups are retained for 30 days and subject to the same security controls.
Section 07
Your Rights Under DPDP Act 2023
The Digital Personal Data Protection Act, 2023 grants you the following rights:
- Right to Access: You may request a summary of the personal data held about you. Contact the event organiser or us at the address below.
- Right to Correction: You may request correction of inaccurate personal data.
- Right to Erasure: You may request deletion of your personal data. On your confirmation page, you can directly request erasure of your registration data — this will anonymise your record within minutes.
- Right to Withdraw Consent: You may withdraw consent at any time, which will trigger the same erasure process as above.
- Right to Grievance Redressal: You may raise a grievance with us using the contact details below. We will respond within 30 days.
Erasure note: When you request deletion, your personal data (name, email, mobile, company, designation, city) is immediately anonymised. Your seat number record is retained in anonymised form to preserve the event organiser's audit trail — this is a legitimate purpose under DPDP Act 2023.
Section 08
Data Retention
We retain your registration data as long as the event organiser's subscription with SignupDesk is active, and for a period of up to 12 months after event completion, unless you request earlier deletion or the event organiser instructs us to delete sooner.
After the retention period, data is permanently purged from our systems and backups (allowing up to 30 days for backup rotation).
Section 09
Cookies
The registration platform uses the following cookies:
- Session cookie: Required for CSRF protection on form submissions. This is a security-essential cookie and cannot be disabled.
- No tracking cookies: We do not use Google Analytics, Facebook Pixel, or any advertising/tracking cookies on the registration pages.
The marketing website (signupdesk.in) may use minimal analytics cookies with your consent. These are separate from the registration platform.
Section 10
Changes to This Policy
We may update this Privacy Policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page. Continued use of the Platform after changes constitutes acceptance of the revised policy.
For material changes affecting data processing purposes or your rights, we will notify affected event organisers in advance, who will in turn notify attendees as required by their obligations as Data Fiduciaries.
Section 11
Contact Us
For privacy-related queries, rights requests, or grievances: