DPDP compliance

1. Purpose of this statement

Agman (आगमन) is a visitor-management and community platform for Indian gated societies, operated by BIG HELPERS SOFTWARE AND SOLUTIONS PRIVATE LIMITED (“BigHelpers”, “we”, “us”), a company registered in India (CIN U72200MP2008PTC021190) with its registered office at HIG-2, M.P. Housing Board Colony, Tikuri, Katni 483501, Madhya Pradesh, India. This statement explains how Agman is built and run to meet the Digital Personal Data Protection Act, 2023 (the DPDP Act). Our privacy policy describes what we collect; this statement covers the legal roles on top of it — who answers for which data, how consent is taken, and how you use your rights.

2. Roles — who is responsible for what

The DPDP Act uses three terms. Knowing which is which tells you who to go to.

Data Principal

The Data Principal is the individual the data is about — a resident, family member, guard, office bearer, or a visitor recorded at the gate. If you are reading this about your own data, that is you.

The society is generally the Data Fiduciary

For its own records — roster, household members, vehicles, frequent visitors, entry logs, gate messages and guard duty records — the society is the Data Fiduciary. It decides who lives there, who is admitted, and how its register runs.

Agman acts as a Data Processor for those records

For that society data, Agman (BigHelpers) is a Data Processor. We hold those records on the society's behalf, acting on its instructions and to run the service — never for ends of our own.

Agman is the Data Fiduciary for account data it holds directly

For data we hold in our own right — name and mobile number for sign-in, role and membership status, the sign-in token and language preference on your device, platform audit logs, and society verification records — Agman is the Data Fiduciary and answers for it directly.

Whichever applies, write to admin@bighelpers.in and we will route the request correctly.

3. Consent and notice

Notice is given before data is taken, in plain language, at the point where it matters.

• At sign-in. You sign in with your mobile number and a one-time SMS code (OTP) — there are no passwords, and none are stored. Before the code goes out you are told what the number is for and that a third-party SMS provider (MSG91) delivers it. Requesting and entering the code is how consent is given.
• For household members. Adding a family member or cohabitant means giving us data about someone else. You are shown what will be recorded — name, relation, and whether the person is a minor — and are expected to have that person's agreement, or to consent as parent or guardian for a minor.
• For guards. Onboarding states what is recorded: ID type and only the last four digits of the ID, PSARA certificate details, photo, duty roster and attendance.
• At the gate. Visitors are told at entry what goes into the society's register — name, optional mobile, optional photo, purpose, vehicle number and time.

Withdrawing consent

Write to admin@bighelpers.in, or delete the record in the app where it is yours to delete — a household member, a vehicle, a frequent visitor. Withdrawal applies going forward. Two honest caveats: withdrawing consent for your mobile number ends sign-in, because the OTP has nowhere to go; and entries already in a society's register are the society's record, so removing them is its decision.

4. Purpose limitation and data minimisation

Every field in Agman exists because a specific job at the gate, in the society office, or — where a society has switched on सब्ज़ी-भाजी — in carrying an order to a society shopkeeper, needs it. There is no advertising, no profiling, no behavioural tracking, and no sale, rent or sharing of personal data for marketing. Data leaves us only to the SMS provider to deliver an OTP or notification, to the hosting provider, and where the law requires.

Payment for an order is not processed by us. Agman opens your own UPI app with the shopkeeper's UPI ID and the amount pre-filled; we hold no funds, take no commission, and never see your bank, card or UPI PIN. The only payment field we store is the reference number you choose to enter, so the shopkeeper can reconcile your order.

5. Children's data

A household member can be marked a minor. Before such a record is created, explicit parental or guardian consent is captured and recorded, and kept as evidence it was given. Agman does no behavioural tracking or monitoring of children and carries no advertising at all, so nothing can be targeted at a child. A minor's record holds only what a gate needs — name, relation, minor status — and a parent or guardian can correct or remove it at any time.

6. Rights of the Data Principal

To use any right below, email admin@bighelpers.in, quote the mobile number registered with Agman, and name your society, block and flat so we can find the record. Please do not send a full Aadhaar or other ID number — we do not need it and will not keep it.

Your right	How to use it
Access a summary of your data and its processing	Subject line "Access request". We return a summary of the personal data we hold about you, what it is used for, and who it has been shared with.
Correction and completion	Name, flat, household members, vehicles and frequent visitors you can edit yourself in the app. If a field is locked or a society record is wrong, email us the field, its current value and the correct one.
Erasure	You can erase your own account from inside the app — the ? menu → My account → Delete my account, confirmed with a fresh OTP to your number. It removes your identity everywhere and closes any shop you ran; a society's visitor register and a shopkeeper's order records remain as theirs, with your identity stripped out. For anything narrower — a household member, a single record — or if you cannot reach the app, email with subject "Erasure request".
Grievance redressal	Subject line "Grievance", describing what happened and the outcome you want. This reaches our Grievance Officer — see clause 11.
Nomination	You may nominate someone to exercise these rights for you in the event of death or incapacity. Send the nominee's name and mobile number and we record it against your account.

We acknowledge requests on arrival and answer within a reasonable period. If we need more to identify you we ask for the least that will do, and if we cannot do what you asked we say so and explain why.

7. Security safeguards

• No passwords anywhere. Sign-in is by one-time code, so there is no stored secret to leak or reuse.
• TLS in transit between your device and our servers.
• Signed gate passes. Each society has its own Ed25519 key; passes are cryptographically signed and verified offline by the guard app, so verification never calls a server and movements are not phoned out at the gate.
• Rotation and single-use nonces. Passes rotate roughly every 90 seconds and carry a nonce usable once, so a screenshot cannot be replayed.
• Strict multi-tenancy. One society can never read another society's roster or records.
• Least-privilege role checks — guard, resident and office bearer each see only what their role requires.
• Audit logging of sensitive actions: who did what, and when.

No system is perfectly secure, and we will not pretend otherwise.

8. Personal data breach

If personal data held by Agman is lost, accessed without authorisation, or wrongly disclosed, we contain the incident; establish from our audit logs what data and which people are affected; notify the affected Data Principals — what happened, what data was involved, what we have done, what you should do; notify the Data Protection Board of India as the DPDP Act requires; inform the affected societies as fiduciaries for their own records; then fix the cause.

9. Retention and erasure

Records are retained while a membership is active, and after that only as long as needed for the purposes described here or as required by law. When a purpose ends and no legal obligation applies, the data is erased. Two things to state plainly: visitor and entry logs are society records, so the society's retention decision governs them; and orders are the shopkeeper's record of a sale. Deleting your account removes your identity from both immediately, but does not delete the underlying society or shop record.

10. Cross-border transfer

Agman's data is hosted on infrastructure located in India. Rosters, verification outcomes, visitor records and audit logs sit inside the country, under Indian law. Nothing about your society is quietly shipped abroad. The only routine flow outside our systems is to the SMS provider, strictly to deliver an OTP or notification to your number.

11. Grievance redressal

If something about your data has gone wrong — a record you cannot get corrected, a request we did not answer, data used beyond its purpose — raise it with our Grievance Officer.

Where a grievance concerns a society's own records, we act as processor, take it up with that society as fiduciary, and keep you informed. If our handling does not satisfy you, you may escalate to the Data Protection Board of India under the DPDP Act.

12. Review of this statement

Agman is newly launched and the DPDP framework is still settling into practice. We review this statement as the rules develop and the product changes, and update it when the facts change. The date at the top shows the current version, and material changes are announced in the app. If anything here reads wrong to you, tell us at admin@bighelpers.in.