Privacy Policy

This Privacy Policy explains how Root Digit handles personal data when you visit rootdigit.com, submit an enquiry, apply for a role, use a Root Digit account or product, communicate with us, or represent a customer, supplier or partner.

Root Digit LLC is the controller of website, commercial, recruitment and account-administration data unless another incorporated Root Digit entity is expressly identified at collection. Root Digit Private Limited is proposed and does not presently control data or contract. When we process personal data only on a customer’s documented instructions, that customer is controller and our Data Processing Agreement applies.

We ask you not to send passwords, private keys, access tokens, government identifiers, financial credentials, health data or other sensitive information unless we specifically request it through an approved secure process.

Where consent is the legal basis, you may withdraw it prospectively. Withdrawal does not invalidate earlier processing. We do not use consent where the processing is genuinely required to perform a contract or meet law.

We disclose personal data only for a defined purpose and subject to appropriate access, confidentiality and contractual controls.

• Service providers: cloud hosting, security, communications, collaboration, customer support, payment, analytics and professional-service providers.
• Customer or organisation: where you interact with us on its behalf, relevant records may be available to its authorised administrators.
• Professional advisers: lawyers, auditors, insurers, accountants and due-diligence advisers under confidentiality obligations.
• Authorities and affected parties: where reasonably necessary to comply with law, protect safety or rights, investigate misuse, or establish and defend legal claims.
• Corporate transactions: a genuine prospective or completed merger, financing, reorganisation or sale, subject to confidentiality and lawful-use restrictions.

Root Digit operates and uses service providers across borders. Personal data may therefore be processed outside your country, including in the United States and locations used by contracted infrastructure providers.

Where transfer restrictions apply, we use a legally recognised mechanism or another lawful basis, assess relevant risks, apply contractual and technical safeguards, and limit access to what is necessary. UAE, Indian and U.S. regional rights remain available to the extent applicable.

These are default periods, not promises to keep every record for the maximum. We may retain less where the purpose ends, or longer where law, litigation hold, fraud prevention or a signed agreement requires it. Backups are isolated and age out under controlled schedules.

We use risk-appropriate administrative, technical and organisational measures, which may include least-privilege access, authentication controls, encryption in transit, protected secrets, logging, backups, dependency management, vulnerability remediation, supplier review and incident procedures. No system is absolutely secure.

If a confirmed personal-data incident triggers a legal or contractual notice obligation, Root Digit will notify the appropriate customer, regulator or affected individual within the applicable period and provide information reasonably available at that time.

Depending on your location, our role and applicable statutory thresholds, you may request access or confirmation, correction, deletion, restriction, portability, withdrawal of consent, objection to certain processing, an explanation of certain decisions, nomination of another person, or an appeal of a request decision. You may also complain to the competent regulator.

Submit a request through the privacy and legal enquiry route. We may verify identity and authority, narrow an overbroad request, or deny a request where law permits. We will explain a denial and available appeal route. Authorised agents must provide evidence of authority.

United States

During the preceding twelve months, Root Digit has collected the categories described in this Policy for the stated business purposes and disclosed relevant categories to service providers and other recipients described above. We have not sold personal information or shared it for cross-context behavioural advertising. We do not offer a financial incentive for personal data. Where a legally recognised opt-out signal such as Global Privacy Control applies to our processing, we will treat it as a request for the relevant browser or device.

India

Where Indian data-protection law applies, Root Digit will provide required notice, process digital personal data for lawful purposes, maintain reasonable safeguards, enable grievance handling and honour rights within applicable statutory timelines. References to the DPDP framework apply according to its phased commencement. The Grievance Officer role can be reached through the legal enquiry route.

United Arab Emirates

Where the UAE Personal Data Protection Law applies, Root Digit will rely on consent or another lawful ground, maintain appropriate security, support data-subject rights and apply lawful cross-border transfer safeguards. Sector-specific or free-zone rules may apply instead for particular processing; the customer agreement will identify that context.

Root Digit’s commercial website and Services are not directed to children, and we do not knowingly collect personal data from children through this website. If you believe a child has submitted data, use the legal enquiry route so we can investigate and take appropriate action. A product designed for education or minors requires a separate approved scope, notices, permissions and safeguards.

We may use automation to route enquiries, detect misuse or support evaluation, but we do not use website data to make a solely automated decision that produces legal or similarly significant effects about an individual. Human review remains available where required.

Links to client portals, social networks, translation services or other third-party sites take you to services operated under their own notices. We receive only information those platforms lawfully provide to us, such as messages, public profile details or aggregate page statistics. This website does not currently deploy social-media advertising pixels.

Submit privacy requests, complaints or appeals through the structured legal enquiry form. Select “Privacy, legal or rights request” and describe the relationship, right and relevant account or interaction without sending secrets.

We may update this Policy when our processing, Services or law changes. The effective date and version will change, and material changes will be communicated through an appropriate channel. Previous versions may be requested where reasonably required for a transaction or claim.