Privacy Notice for India Residents 

 

If you are located in India, this section applies to you in addition to the rest of the Acquia Privacy Policy. In the event of any conflict between this section and the rest of the Policy, this section will prevail with respect to the processing of your personal data.

Acquia processes your personal data in accordance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"). For the purposes of the DPDP Act, Acquia acts as a Data Fiduciary in respect of personal data collected directly from you through our websites and services, and as a Data Processor where we process personal data on behalf of our customers.

Applicable Law Statement

Acquia complies with the DPDP Act and DPDP Rules with respect to the collection, use, storage, sharing, and protection of personal data about individuals located in India ("Data Principals"). This section sets out the specific rights available to you and the obligations Acquia has to you under Indian law.

Legal Basis for Processing

Acquia processes your personal data on the following legal bases under the DPDP Act:

  • Consent: Where you have provided free, specific, informed, unconditional, and unambiguous consent to the processing of your personal data through a clear affirmative action. Examples include signing up for our newsletter, registering for a webinar, or accepting cookies for marketing or analytics purposes.

  • Legitimate use: Where processing is necessary for the performance of a contract to which you are a party, to comply with a legal obligation applicable to Acquia, or for other legitimate purposes recognised under the DPDP Act and Rules — for example, processing necessary to provide the services you have requested, to respond to your enquiries, or to maintain the security of our systems.

Where we rely on your consent, you have the right to withdraw it at any time (see "Your Rights" below). Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, but may mean that Acquia is unable to continue providing certain features or services to you.

Personal Data We Collect and How We Use It

The categories of personal data we collect from Indian Data Principals, and the purposes for which we use it, are set out in Sections 4 through 4.7 of this Privacy Policy. In summary, depending on how you interact with Acquia, this may include:

  • Contact and identification data (e.g., name, email address, phone number) — to respond to enquiries, provide services, and manage your account.
  • Financial and billing data (e.g., payment card details) — to process purchases and manage subscriptions.
  • Device and usage data (e.g., IP address, browser type, cookies) — to operate and improve our websites and services, and for analytics and marketing purposes where consent has been obtained.
  • Employment and professional data (e.g., job title, company) — where you register for events, download content, or engage with our sales teams.

We do not collect personal data from Indian Data Principals beyond what is necessary for the stated purposes. We will inform you if we need to process your personal data for a new or incompatible purpose, and will seek your consent where required.

Your Rights as a Data Principal

Under the DPDP Act, you have the following rights in relation to your personal data held by Acquia:

  • Right to Access You may request a summary of the personal data Acquia holds about you and information about the purposes for which it has been processed and the entities with whom it has been shared.
  • Right to Correction You may request that any inaccurate or incomplete personal data held by Acquia be corrected or updated.
  • Right to Erasure You may request that Acquia erase your personal data where you have withdrawn consent, the purpose for which it was collected has been fulfilled, or processing is otherwise unlawful. Please note that this right may be limited where Acquia is required by applicable law to retain your data, or where it is necessary to defend legal claims.
  • Right to Grievance Redressal You have the right to have any grievances relating to the processing of your personal data by Acquia addressed promptly. Please see the "Grievance Redressal" section below for how to raise a complaint.
  • Right to Nominate You may nominate another individual to exercise your data principal rights on your behalf in the event of your death or incapacity. To register a nomination, please contact us at [email protected] with the subject line "Data Principal Nomination – India."
  • Right to Withdraw Consent Where processing is based on your consent, you may withdraw that consent at any time by contacting us at [email protected] or by using the preference management tools available on our website (e.g., the cookie preference centre). Withdrawal will not affect the lawfulness of prior processing.
  • To exercise any of these rights, please submit a request through our Privacy Request Centre or contact us directly at [email protected]. We may need to verify your identity before fulfilling your request. We will respond within a reasonable timeframe and in accordance with the requirements of the DPDP Act.

Grievance Redressal

Acquia is committed to addressing privacy-related concerns from Indian Data Principals in a timely and transparent manner.

If you have a complaint or concern about how Acquia has handled your personal data, please contact our Global Privacy Officer at:

Email: [email protected]
Subject line: Privacy Grievance – India
Postal address: Acquia Inc., 53 State Street, 10th Floor, Boston, MA 02109, USA

We will acknowledge your grievance promptly and aim to provide a substantive response within 30 days of receipt. Where additional time is needed, we will inform you of the reason for the delay and the expected resolution timeline.

If your grievance is not resolved to your satisfaction through Acquia's internal process, you have the right to escalate your complaint to the Data Protection Board of India, the supervisory authority established under the DPDP Act.

Cross-Border Transfers of Personal Data

As a global organisation headquartered in the United States, Acquia may transfer personal data collected from Indian Data Principals outside India for the purposes described in this Privacy Policy — for example, to Acquia's affiliates, cloud infrastructure providers, or other service providers located in other countries.

Such transfers are made in compliance with the DPDP Act. Under the DPDP Act, personal data may be transferred outside India unless the Central Government of India has restricted transfers to a specific country or territory by notification. Acquia will comply with any such restrictions as and when notified.

For further information about Acquia's cross-border data transfer practices and safeguards, please contact us at [email protected].

Data Breach Notification

In the event of a personal data breach that is likely to affect your rights as a Data Principal, Acquia will notify the Data Protection Board of India in accordance with the DPDP Act and Rules. Where required, Acquia will also notify affected Indian Data Principals in clear and plain language, describing the nature of the breach and the steps being taken to address it. Notifications will be made without undue delay and within the timeframes required by applicable law

Children's Privacy – India

Under the DPDP Act, a "child" means any individual under the age of 18 years. Acquia does not knowingly process the personal data of individuals under 18 located in India without obtaining verifiable parental or lawful guardian consent prior to such processing.

Acquia does not engage in behavioural monitoring, tracking, or targeted advertising directed at children. If you are a parent or guardian and believe that your child's personal data has been collected by Acquia without your consent, please contact us immediately at [email protected] and we will take prompt steps to delete the relevant data.

Please note that for users located outside India, the minimum age threshold described in Section 4.6 of this Privacy Policy continues to apply.

Language Accessibility

This Privacy Policy is provided in English. If you require information about how Acquia processes your personal data in another language listed in the Eighth Schedule of the Constitution of India, please contact us at [email protected] and we will make reasonable efforts to accommodate your request using machine-translation.

Contact – India Privacy Enquiries

For all privacy enquiries relating to this India section, please contact Acquia's Global Privacy Officer:

Email: [email protected]
Postal address: Acquia Inc., 53 State Street, 10th Floor, Boston, MA 02109, USA

You may also submit a request through our Privacy Request Centre.

This section was last updated on June 19, 2026, and reflects the requirements of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.