Bigdomainhost (“we”) is the Data Fiduciary for the personal data described here, under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). You are the Data Principal.
This policy covers bigdomainhost.com, our client area and our support channels. It does not cover the content you host on our servers — for that data you are the Data Fiduciary and we act as a processor on your instructions.
1. What we collect
| Category | Examples | Why |
|---|---|---|
| Identity & contact | Name, business name, email, mobile number, postal address | Open and run your account, send invoices, reach you in an incident |
| Tax & KYC | GSTIN, PAN, address proof where required | Issue a valid tax invoice; comply with Indian tax and KYC rules |
| Billing | Invoice history, payment reference, last four digits and card brand | Take payment and keep accounts. We never store full card numbers or CVV — the payment gateway does |
| Technical | IP address, browser and device, server and access logs, API tokens | Security, abuse investigation, fraud prevention, debugging |
| Support | Tickets, emails, WhatsApp messages, call records | Answer you and keep a history of what was done to your servers |
| Usage | Pages viewed on bigdomainhost.com, referrer, aggregate analytics | Understand which pages help and which do not |
2. On what basis
- Performance of contract — to give you the service you bought.
- Legal obligation — tax records, GST filings, lawful requests from authorities, retention under the IT Act and the CERT-In Directions of 28 April 2022.
- Legitimate use / consent — security monitoring, service notices, and marketing only where you opted in.
3. Who we share it with
We do not sell personal data. We share only what is needed, with:
- Payment gateways (Razorpay, PayU, Stripe or similar) to take payment;
- Registrars and certificate authorities when you buy a domain or SSL, where ICANN or the CA requires registrant details;
- Data-centre and network providers that host the physical infrastructure;
- Licence vendors (cPanel, CloudLinux, Microsoft, LiteSpeed) for licence issue and validation;
- Law enforcement, CERT-In and courts when served with a valid order.
4. How long we keep it
- Account and billing records: 8 years after the last transaction, as Indian tax law requires.
- Server, access and firewall logs: 180 days, per the CERT-In Directions of 28 April 2022.
- Support tickets: 3 years.
- Customer data on a terminated service: 7 days, then permanently deleted.
- Marketing consent records: until you withdraw, plus 1 year.
5. Your rights under the DPDP Act
You may ask us, free of charge, to:
- Access a summary of the personal data we hold about you and who we shared it with;
- Correct data that is inaccurate, or complete data that is partial;
- Erase data we no longer need for the purpose it was collected or for a legal obligation;
- Nominate another person to exercise these rights if you die or become incapacitated;
- Withdraw consent at any time, as easily as it was given;
- Complain to us, and then to the Data Protection Board of India if you are not satisfied.
Send requests to [email protected] or call +91 75994 50220. We verify identity first, and respond within 30 days.
6. How we protect it
- TLS 1.2+ on every connection to our website, client area and control panels.
- Passwords stored as salted hashes; two-factor authentication available on the client area and offered on cPanel and WHM.
- Role-based internal access, on a need-to-know basis, with staff actions logged.
- Encrypted backups, network firewalling and DDoS filtering at the edge.
- In the event of a personal-data breach we notify affected Data Principals and the Data Protection Board of India without undue delay, and report to CERT-In within 6 hours of becoming aware, as the CERT-In Directions require.
7. Children
Our services are not offered to children under 18. We do not knowingly process a child's personal data without verifiable parental consent, and we do not carry out tracking, behavioural advertising or targeted advertising directed at children.
8. Cross-border transfers
Data for Indian services stays on Indian infrastructure. Where you choose a region outside India, or where a vendor above processes data abroad, transfers are made only to countries not restricted by the Central Government under section 16 of the DPDP Act, and under contractual safeguards.
9. Cookies
Cookies and similar technologies are covered separately in the Cookie Policy.
10. Changes
We post changes here and, for material changes, email the address on your account at least 30 days in advance.
Grievance officer
As required by the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the grievance officer for Bigdomainhost is:
- Name: Parth Sharma
- Designation: Proprietor & Grievance Officer
- Email: [email protected]
- Phone: +91 75994 50220
- Address: 32 A/G-673 A, Kamla Nagar, Agra, Uttar Pradesh 282005, India
Complaints are acknowledged within 24 hours and resolved within 15 days of receipt, as the Rules require.
How to reach us
Questions about this policy, or anything else, go to the same 24×7 team:
- Phone: +91 75994 50220 (24×7, IST)
- Email: [email protected]
- WhatsApp: +91 75994 50220
- Postal address: Bigdomainhost, 32 A/G-673 A, Kamla Nagar, Agra, Uttar Pradesh 282005, India
- Proprietor: Parth Sharma