We are Recognised for Excellence and Trusted by Professionals
Seamlessly merge your global team from one powerful platform
How Time Champ aligns with India's Digital Personal Data Protection Act, 2023 (DPDP Act) - consent, retention, Data Principal rights, breach notice, and data localisation options.
Effective Date: June 9, 2026
Time Champ (operated by Snovasys Solutions Pvt. Ltd., headquartered in Hyderabad, India) is committed to processing personal data in accordance with India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and any rules notified thereunder.
This page summarises our DPDP commitments. It is intended as a practical reference for our Indian customers and their Data Principals. It supplements (and does not replace) our Privacy Policy and our standard Data Processing Agreement.
When you use Time Champ to monitor and manage your workforce, your organisation is the Data Fiduciary under the DPDP Act — you decide why and how Digital Personal Data is processed. Time Champ acts as a Data Processor on your behalf, processing personal data only in accordance with your documented instructions and our agreement with you.
For personal data we collect directly from individuals — for example, when you sign up for our website, request a demo, subscribe to newsletters, or visit our marketing pages — Time Champ acts as the Data Fiduciary.
Under Section 4 of the DPDP Act, we process Digital Personal Data only on one or more of the following grounds:
When we rely on Consent, we ensure the request is presented in clear and plain language and includes the information required by Section 6 (purpose, contact details of the Data Protection Officer or other person, and a means to withdraw consent or lodge a complaint).
If you are a Data Principal (the individual to whom the Digital Personal Data relates), you have the following rights under Chapter III of the DPDP Act:
When Time Champ acts as Data Processor on behalf of an employer (Data Fiduciary), Data Principals should direct their rights requests to the employer. We will assist Data Fiduciaries in responding to such requests as required by the DPDP Act.
When we collect Digital Personal Data directly from you, we provide a notice that includes:
In accordance with Section 8(7) of the DPDP Act, Time Champ will erase Digital Personal Data when (a) the Data Principal withdraws consent, or (b) the personal data is no longer necessary for the specified purpose for which it was processed — whichever is earlier, unless retention is required by law.
When Time Champ acts as Data Processor, retention periods are determined by the Data Fiduciary’s configuration and instructions. Standard backup retention windows are described in our DPA.
Section 16 of the DPDP Act permits transfer of Digital Personal Data outside India, except to countries notified by the Central Government as restricted. Where Time Champ’s infrastructure or sub-processors are located outside India, we rely on contractual safeguards (including with our cloud service providers) and continuously monitor any restrictions notified by the Central Government.
Indian customers who require data localisation within India can request hosting on Indian AWS regions or on-premises deployment for sensitive engagements. Please contact our team to discuss your data residency requirements.
In accordance with Section 8(5) of the DPDP Act, Time Champ implements reasonable security safeguards to prevent personal data breach. These include encryption in transit and at rest, role-based access controls, vulnerability management, secure development practices, employee training, and regular security audits. For details, see our Security page.
In accordance with Section 8(6) of the DPDP Act, we will notify the Data Protection Board of India and each affected Data Principal in the event of a personal data breach, in the manner and within the timeline prescribed under the rules. When Time Champ acts as Data Processor, we will notify the affected Data Fiduciary (our customer) without undue delay so that they can comply with their own notification obligations.
Time Champ does not knowingly process Digital Personal Data of children (defined under the DPDP Act as individuals below the age of eighteen). Our Services are intended for use by businesses to manage their adult workforce. Customers (Data Fiduciaries) are responsible for ensuring that they do not upload children’s personal data to our platform without obtaining verifiable parental consent in accordance with Section 9 of the DPDP Act.
Some of our customers may be designated as “Significant Data Fiduciaries” under Section 10 of the DPDP Act, which imposes additional obligations such as appointing a Data Protection Officer, conducting Data Protection Impact Assessments, and periodic audits. Time Champ supports these customers with audit logs, DPIA support documentation, and reasonable assistance in fulfilling these obligations.
Time Champ has a Grievance Redressal Officer who responds to complaints from Data Principals about how we handle their Digital Personal Data. To raise a grievance, please contact:
We aim to acknowledge grievances within three (3) business days and resolve them within thirty (30) days. If you are not satisfied with our response, you may escalate the grievance to the Data Protection Board of India once it is constituted under Chapter V of the DPDP Act.
This page is provided for informational purposes only and does not constitute legal advice. The DPDP Act and its rules continue to evolve. Customers should obtain their own legal advice on their DPDP obligations.
Seamlessly merge your global team from one powerful platform
4.7/5 avg.
Join our family of 1500+ companies using smart insights to redefine workforces!
Free Trial
No Credit Card Required