Privacy PolicyLast updated: Aug 11, 2026
CivicDataLab (“we”, “us”) operates CivicDataSpace (the “Platform”) - an open, collaborative platform for data changemakers, where governments, researchers, technologists, and civil society come together to share datasets, knowledge resources, and AI use-cases for the public good.This Policy explains what personal information we collect, why we collect it, how we protect it, and your rights under India’s Digital Personal Data Protection Act, 2023.
What we collectWe collect the following personal information relating to registered users:If you register: name, email, organisation, designation. Location is collected only if you choose to provide it.Automatically: IP address, timestamp, and pages requested, logged for security and platform stability only.Cookies: session cookies for login; Google Analytics to understand Platform usage (see Google’s Privacy & Terms). No advertising trackers are used.Published datasets: drawn from public/government sources and describe places and systems, not individual people. Certain public sources name identifiable individuals (e.g. a contractor in a tender) - we do not use it to profile or draw inferences about that person.
How we use the dataWe use your information only to run your account, enable contributions, communicate with you, secure the Platform, and comply with the law.We do not use advertising trackers, we do not sell your personal information or your Platform activity data to anyone, for any purpose, and we do not share it for third-party marketing. We may share it with our own team or vetted service providers (under confidentiality obligations), with law enforcement/courts where legally required (with prior notice where permitted), and with the Data Protection Board of India where required, e.g. for breach reporting.A small amount of technical information is processed automatically to keep the Platform running. Our servers also keep standard access logs, ie the IP address, time, and page requested, for security purposes. These are retained for one year, as required by the security provisions of the Digital Personal Data Protection Rules, 2025, and are used only to detect and investigate security incidents, never to identify or profile visitors. This data exists to keep the Platform secure and working, and for nothing else.We also use Google analytics to collect data on how our users are using CivicDataSpace so that we can improve its functionality. Please see the Google Privacy & Terms for information on how Google handles these data.
Data storage, security and retentionData is stored on servers in India. Access to personal information is restricted to authorised CivicDataLab staff, who undergo regular data security training, and service providers on a role-based, need-to-know basis; access to raw data and backend systems is limited to designated administrators. We encrypt data in transit and store passwords in hashed form. In case of any breach, we will notify you and the Data Protection Board as required by law.Account information is kept while your account is active or until you withdraw consent/request deletion. Technical logs are retained for a minimum of one year under Rule 8 of the DPDP Rules, 2025, made under the DPDP Act, 2023, then erased unless other laws require longer retention.
Your rightsUnder the DPDP Act, you can ask us what personal data we hold about you, and ask us to correct or delete it. You can also raise a complaint about how data is handled. For any of these, write to us at legal@civicdatalab.in. We will acknowledge your request and resolve it within 90 days, as required under the Digital Personal Data Protection Rules, 2025.
Contactlegal@civicdatalab.in