1. Statutory Basis and Applicability

This Privacy Policy (“Policy”) is issued in accordance with and governed by:

• Digital Personal Data Protection Act, 2023 (DPDP Act, 2023)
• Information Technology Act, 2000
• Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
• Public Records Act, 1993
• Applicable rules, notifications, and guidelines issued by the Government of India and Government of Goa.

This Policy applies to all Users accessing the CM Helpline Website, Mobile Application, and AI-powered phone helpline (1905) (collectively, the “Platform”).

2. Definitions

Unless otherwise specified, capitalized terms shall have the meanings assigned under the DPDP Act, 2023.

• “Data Principal” means the individual to whom the Personal Data relates.
• “Data Fiduciary” means the Government of Goa, acting through the Department of Public Grievances.
• “Personal Data” means any data about an identifiable individual.
• “Processing” means any operation performed on Personal Data, whether automated or otherwise.

3. Role of the Government of Goa

The Government of Goa is the Data Fiduciary for all Personal Data collected through the Platform and determines the purpose and means of Processing in accordance with law.

4. Categories of Personal Data Collected

The Platform may collect the following categories of Personal Data:

• Identity Information
  • Name
  • Government-issued identification details (as required)
• Contact Information
  • Mobile number
  • Email address
• Grievance-Related Information
  • Complaint description
  • Department references
  • Supporting documents uploaded by the User
• Technical and Usage Data
  • IP address
  • Device and browser details
  • Login timestamps
  • Call recordings (AI helpline)

5. Lawful Purpose of Processing

Personal Data is collected and processed strictly for lawful purposes, including:

• registration and authentication of Users;
• submission, tracking, and resolution of grievances;
• communication with Users regarding grievance status;
• identity verification and fraud prevention;
• audit, monitoring, and service improvement;
• compliance with statutory obligations.

Processing is carried out only to the extent necessary for the above purposes.

6. Consent Under DPDP Act, 2023

By using the Platform and submitting Personal Data, the User provides free, specific, informed, unconditional, and unambiguous consent as required under Section 6 of the DPDP Act, 2023.

Consent may be withdrawn in accordance with Applicable Law; however, withdrawal may affect grievance processing.

7. Processing Through AI-Powered Phone Helpline (1905)

• Calls to the AI helpline may be recorded.
• Voice inputs may be processed to generate grievance records.
• AI-generated outputs are used only to facilitate grievance handling.
• No automated decision-making producing legal effects is carried out without human oversight.

8. Disclosure and Sharing of Personal Data

Personal Data may be shared only with:

• concerned government departments for grievance resolution;
• authorized service providers engaged by the Government under contractual obligations;
• statutory authorities pursuant to legal requirements or court orders.

No Personal Data is sold, rented, or shared for commercial purposes.

9. Data Security and Safeguards

The Government implements reasonable security practices and procedures, including:

• access controls and authentication mechanisms;
• encryption and secure storage;
• role-based access for authorized personnel;
• regular system audits and monitoring.

Security measures are aligned with Rule 8 of the SPDI Rules, 2011.

10. Data Retention and Deletion

Personal Data is retained only as long as required:

• for grievance resolution;
• under record retention laws and government policies;
• for audit or legal purposes.

Upon completion of the lawful purpose, data may be archived or deleted in accordance with the Public Records Act, 1993 and applicable retention schedules.

11. Rights of Data Principals

In accordance with Chapter III of the DPDP Act, 2023, Data Principals have the right to:

• access information about processing of their Personal Data;
• seek correction or updating of inaccurate data;
• request erasure of data where legally permissible;
• withdraw consent, subject to statutory limitations;
• lodge grievances regarding data processing.

12. Grievance Redressal Mechanism (DPDP Act – Section 8)

Any grievance relating to Personal Data may be addressed to:

Designated Data Protection / Grievance Officer
Department of Public Grievances
Government of Goa
📧 Email: [email protected]
📞 Phone: 1905

Grievances shall be resolved within the timeframe prescribed under law.

13. Children’s Personal Data

The Platform does not knowingly collect Personal Data of children. If such data is identified, it shall be processed strictly in accordance with the DPDP Act, 2023 and applicable rules.

14. Cross-Border Data Transfer

Personal Data shall be stored and processed within India unless otherwise permitted under Applicable Law and government policy.

15. Accuracy and User Responsibility

Users are responsible for ensuring the accuracy and authenticity of the Personal Data and documents submitted. Submission of false or misleading information may attract legal action.

16. Exemptions and Legal Obligations

Processing may be exempted from certain provisions of the DPDP Act where permitted under law for:

• legal proceedings;
• prevention, detection, or investigation of offences;
• public order and governance functions.

17. Amendments to This Policy

This Policy may be updated periodically. Any changes shall be published on the Platform and shall become effective immediately upon publication.

18. Governing Law and Jurisdiction

This Privacy Policy shall be governed by the laws of India. Courts located in Goa shall have exclusive jurisdiction.