Who we are
This policy covers the ConsentCenter website at consentcenter.io and its subdomains serving the marketing site (the "site"). The site is operated by Bytesurgelabs, Bengaluru-560066, India ("ConsentCenter", "we", "us"). We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the controller under the GDPR for the personal data described here.
It does not cover the ConsentCenter product used by our customers. When a customer runs ConsentCenter on their own website, that customer decides how their visitors' data is processed, and their own privacy notice applies; we act as their Data Processor under a separate agreement.
What we collect and why
| Where | Data | Purpose | Basis |
|---|---|---|---|
| Contact and demo form | Name, email, company, message, and the request's IP address, browser user agent and referring page | Reply to you, arrange a demo, prevent spam and abuse | Your consent (DPDP s.6); steps at your request before a contract (GDPR 6(1)(b)) |
| Free website audit | The website address you scan and the result; the IP address that started it | Run the scan and show you the result; limit scans per IP to stop abuse | Legitimate use for the service you requested (DPDP s.7(a)); legitimate interests (GDPR 6(1)(f)) |
| Full audit report form | Email address, the scanned website, its score, the exact notice you were shown and its version, IP address, user agent | Send you the full report and follow up about it. No newsletters. | Your consent (DPDP s.6; GDPR 6(1)(a)) |
| Analytics (consent only) | Pseudonymous cookie identifiers, pages viewed, clicks on links and buttons, approximate location from IP, device and browser | Understand which pages help visitors and improve the site | Your consent, given in the cookie banner |
| Consent banner | Your cookie choices, a consent identifier, time and banner version | Remember and prove your choice, as privacy law requires | Legal obligation (DPDP s.6(10); GDPR 6(1)(c), 7(1)) |
| Server and security logs | IP address, time, requested URL, user agent, response status | Keep the site secure and working, investigate attacks | Legitimate interests; legitimate use for security |
We do not knowingly collect sensitive or special-category data, and the forms do not ask for any. Please do not include it in a message.
Signing up and logging in happen in the ConsentCenter application, which the site's Login and Sign up links open. Account data is covered by the terms and privacy notice shown there.
The free website audit
- The audit reads the public pages of the address you give, as any visitor's browser would. It does not log in, submit forms or run the site's scripts. Only scan sites you own or are authorised to assess.
- The scan and its result are held in server memory only, for up to 24 hours, then discarded. Anyone you send a result link to can open it in that time.
- The full report link is private, unguessable and works for 24 hours.
- To stop abuse we count scans per IP address for one hour, in memory only.
- If you request the full report, your email and the details above reach our team inbox as a lead. We use it only for that report and the conversation about it.
Cookies and analytics
Google Analytics runs only on consentcenter.io, and only after you accept analytics in the cookie banner; until then the ConsentCenter autoblocker holds it back. Necessary storage keeps your consent choice. The Cookie Policy lists every cookie by name, and you can change your choice at any time.
Your rights
Depending on where you live, you can:
- Access a summary of the personal data we hold about you and how we use it, and the identities of those we have shared it with.
- Correct, complete or update inaccurate or incomplete data.
- Erase your data when it is no longer needed or you withdraw consent.
- Withdraw consent at any time, as easily as you gave it: by clearing this site's cookies (the banner then asks again) or by emailing us, for cookies and form data alike. Withdrawal does not affect processing already done.
- Object to or restrict processing based on legitimate interests, and receive your data in a portable format (GDPR, LGPD).
- Nominate someone to exercise your rights if you die or become incapacitated (DPDP Act).
- Opt out of sale or sharing (CCPA/CPRA). We do neither, and we honour the Global Privacy Control signal as an opt-out.
- Complain to our Grievance Officer (see below).
To exercise any right, email hello@consentcenter.io from the address the request concerns, or tell us how to verify you. We reply within 30 days at the latest (one month under the GDPR, 45 days under the CCPA), free of charge. We will never treat you differently for exercising a right.
Grievance Officer and contact
Questions, requests and complaints about personal data go to our Grievance Officer: hello@consentcenter.io, +91 93600 50309, Bytesurgelabs, Bengaluru-560066, India. We acknowledge a grievance within 48 hours and resolve it within 30 days.
Security
The site is served only over HTTPS. Audit data is held in memory and never written to a database. Access to form submissions is limited to the staff who answer them. No system is perfectly secure; if a breach affects your data, we will notify you and the relevant authorities as the law requires.
Children
The site is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has sent us data, write to us and we will delete it.
Changes to this policy
We update this policy when what we do changes. The date at the top shows the latest version. If a change affects how we use data you have already given us, we will ask for your consent again where required.