Wix Customer & DPO Onboarding Guide — DPDP Star Documentation (docs.star.dpdpa.support)

Step 1 of 8

Install DPDP Star & Automatic Wix Site Scan POST /integrations/wix/register

When you open the DPDP Star dashboard page inside Wix, the app automatically verifies your Wix App Instance token and scans your storefront (dpdp-star-scanner) to detect installed Wix apps (Wix Stores, Wix Bookings, Wix Forms, Wix Members, Wix Chat), analytics tags, and any existing cookie banner.

Wix Onboarding Step 1: Welcome and automatic site scan results — **1A. Welcome & Site Scan Summary** Shows what DPDP Star detected on your Wix site (checkout, contact forms, analytics, or an existing cookie banner) before you click *Set up my consent notice*.

Wix Onboarding: Compliance scan report sent to owner email — **1B. Optional Compliance Report Delivery** You can also email a snapshot of the initial DPDP Act readiness check to your site owner address before completing setup.

Step 2 of 8

Connect Your Organisation & Verify Work Email POST /integrations/wix/connect

Enter your legal organisation name (Data Fiduciary) and work email. DPDP Star's native Java mail engine (OnboardingMail via OtpDelivery) immediately sends a 6-character verification code to prove ownership before linking your Wix site to a tenant organisation.

Wix Onboarding Step 2: Enter Organisation Name and Email — **2A. Enter Organisation Details** Calls `action: "create_org"` on `/integrations/wix/connect` and triggers a 6-character verification code to your email.

Wix Onboarding Step 2B: Verify 6-character email code — **2B. Enter 6-Character Verification Code** Calls `action: "verify_code"` (or `"choose_org"` if your email already manages multiple fiduciaries) and provisions your First-100 Free Pilot DPO Console seat.

Step 3 of 8

Confirm Notice Purposes & Grievance Contact POST /integrations/wix/answers

DPDP Star pre-populates your Records of Processing Activities (RoPA) and Rule 3 Consent Notice from the Wix scan. If any purpose or grievance redressal contact needs confirmation, the wizard asks plain-language questions right inside Wix.

Wix Onboarding Step 3: Notice questions and grievance contact — **3A. Plain-Language Notice Questions** Confirms the personal data fields collected, processing purposes, and the Grievance Officer email shown on your Rule 3 notice (90-day statutory SLA under Rule 14(3)).

Wix Onboarding: Needs answer state when new Wix app or tag is detected — **3B. Drift Alert: New Wix App Needs Answer** If a subsequent scan detects a new form or marketing tag on your Wix site, the card prompts you to confirm its purpose with one click.

Step 4 of 8

Turn On the DPDP Notice Banner (or Cookie-Banner Bridge Mode)

Enable the embedded DPDP Star script in Wix (or switch on Bridge Mode if your Wix site already displays a cookie banner that you want to keep while adding the mandatory DPDP Section 5 itemised notice layer).

Wix Onboarding Step 4: Turn on the DPDP Star consent banner — **4A. Standard Mode — Turn On DPDP Banner** Activates the WCAG AA light-mode Rule 3 consent notice and equal-weight Accept / Reject / Customize controls on your Wix storefront.

Wix Onboarding Step 4B: Turn on Cookie-Banner Bridge Mode — **4B. Bridge Mode — Existing Cookie Banner Detected** Listens to your existing cookie tool's accept/decline events while adding the statutory *Your data rights / DPDP notice* pill.

Wix Onboarding: Existing notice detected at bottom of site — **4C. Existing Notice Found (Bottom Bar)** Preview showing where an existing banner was detected on your live Wix storefront so banners never stack on top of each other.

Wix Onboarding: Existing notice detected at top of site — **4D. Existing Notice Found (Top Bar)** Automatic placement detection when your existing Wix banner is docked at the top of the viewport.

Step 5 of 8

Live Storefront Verification & Health States POST /integrations/wix/verify

Click Check live site. DPDP Star fetches your published Wix domain over HTTPS, confirms the embed script and site key are active, and monitors health continuously.

Wix Onboarding Step 5: Working and verified live state — **5A. Working (Live & Verified)** Green status confirming your Rule 3 consent notice is live on your Wix storefront and recording signed consent artifacts.

Wix Onboarding: Pending live site check — **5B. Pending Live Check** Shown after you configure your notice before you publish your Wix site or click *Check live site*.

Wix Onboarding: Notice turned off state — **5C. Paused / Turned Off** Shown when the embed toggle is switched off in Wix; click *Turn on* to resume consent collection immediately.

Wix Onboarding: Script not detected on published Wix site — **5D. Troubleshooting: Not Detected Yet** Shown if you saved changes in the Wix Editor but have not clicked **Publish** on your Wix site yet.

Wix Onboarding: Responsive narrow panel layout inside Wix Studio — **5E. Narrow / Side-Panel View in Wix Studio** The onboarding card adapts cleanly to narrow Wix Editor sidebars and mobile viewports with zero horizontal scroll.

Step 6 of 8 • DPO Console & Bhashini

DPO Console: RoPA Registry, Bhashini 22-Language Policies & 90-Day Grievances

From the Wix app card, click Send Console Invite (action: "invite_admin") to open the full DPDP Star DPO Console at https://star.dpdpa.support/login. Translate your Rule 3 notice into all 22 Eighth Schedule languages via MeitY Bhashini, review your auto-derived RoPA, and resolve Data Principal grievances.

DPDP Star DPO Console Dashboard (Light Mode) — **6A. DPO Compliance Dashboard** Real-time overview of active consents, RoPA coverage, DPIA assessments, and DSPM Rule 6 security posture.

DPDP Star Policy Authoring & Bhashini 22-Language Translation — **6B. Policy Publisher & Bhashini 22-Language Translation** Author your itemised policy once in English and translate into Hindi, Tamil, Telugu, Kannada, Malayalam, Marathi, Bengali, Gujarati, and all 22 scheduled languages.

DPDP Star DPO RoPA Register View — **6C. Records of Processing Activities (RoPA) Register** Every purpose discovered on your Wix site is mapped to its personal data categories, retention period, and processor list.

DPDP Star 90-Day SLA Grievance Tracker — **6D. Grievance Redressal Console (90-Day Statutory SLA)** Track and resolve Data Principal grievances within the statutory 90-day window under Rule 14(3).

Organisation Admin Connected Apps & Site Keys — **6E. Organisation Admin — Connected Apps & Site Keys** Manage your Wix store connection, downstream Data Processor apps, and publishable site keys.

My Privacy Dashboard for Data Principals — **6F. Data Principal "My Privacy Dashboard" (`/rights/`)** Your Wix visitors can inspect their signed Personal Consent Artifact (PCA), withdraw consent with one click, or request erasure.

Step 7 of 8 • Multi-Tenant RBAC

Strict Role-Based Access Control (`ADMIN`, `DPO`, `OPERATOR`)

DPDP Star enforces statutory separation of duties in AccessPolicy.java: Organisation Admins manage operators, billing, and domains; only the DPO can publish policies, approve DPIAs, sign off on purges, or apply a Section 8(1) legal hold.

DPO Role Console View — **7A. DPO Console View (`DPO` / `ADMIN_DPO`)** Full access to RoPA, Policy Publishing, DPIA, Grievances, Breach Notification, Legal Evidence Certificates, and Document Signing (`star-sign`).

Organisation Admin Role Console View — **7B. Organisation Admin View (`ADMIN`)** Manages operators, connected Apps, domain verification, and credit/seat billing without modifying DPO compliance attestations.

Operator Role Console View — **7C. Operator View (`OPERATOR`)** Scoped operational view for handling assigned tickets and purge tasks without administrative or DPO sign-off privileges.

Step 8 of 8 • Live Storefront & Blockchain Proof

Visitor Consent Lifecycle & Public Blockchain / RFC 3161 Proof Verification

What your Wix visitors see on their first visit, after accepting or rejecting, and how anyone can independently verify your organisation's daily Merkle-anchored audit trail at https://star.dpdpa.support/verify/.

First visit Rule 3 consent banner on storefront — **8A. First Visit — Itemised Rule 3 Consent Notice** Unticked consent checkboxes, itemised data fields per purpose, and equal-weight Accept / Reject buttons.

Storefront after visitor accepts consent — **8B. After Choice — Non-Intrusive Privacy Choices Link** Once a choice is saved, the banner collapses and leaves a persistent *Privacy choices* trigger for one-click withdrawal (Section 6(4)).

Storefront withdrawal confirmation — **8C. Instant Consent Withdrawal** Withdrawing consent immediately records a signed `CONSENT_WITHDRAWN` event and gates optional analytics/marketing scripts.

Public Blockchain & RFC 3161 Audit Trail Verification Page — **8D. Public Blockchain & RFC 3161 Verification (`/verify/`)** Matches your signed DPO Hash Report against the daily OpenTimestamps (Bitcoin) `.ots` and RFC 3161 `.tsr` proofs locally in the browser.

Wix Connector Native Java Endpoint Reference (`WixIntegrationServlet`)

All Wix connector requests are authenticated with X-DPDP-Timestamp + X-DPDP-Signature (HMAC-SHA256) and Wix App Instance proof.

Endpoint	Actions / Purpose	Security & Audit Events
`POST /integrations/wix/register`	Registers or updates the Wix `instance_id`, triggers an asynchronous site scan on `dpdp-star-scanner`, and stores detected apps/tags in `platform_connections`.	Verifies Wix App Instance signature & TokenInfo (`WIX_APP_ID`). Rejects unsigned/tampered payloads with `400`.
`POST /integrations/wix/connect`	Organisation & DPO Console lifecycle: • `create_org`, `resend_code`, `verify_code`, `choose_org` (`WixOnboarding`) • `verify_link_owner` (`WixLinkOwner`) • `console_status`, `invite_admin`, `console_reset`, `console_change_email` (`ConsoleLogin`)	Delivers 6-digit verification codes and single-use R2 console enrolment links via native Java `OnboardingMail` and `ConsoleMail`.
`POST /integrations/wix/answers`	Saves plain-language wizard answers, compiles the tenant's RoPA + Rule 3 Policy, and activates the publishable site key `pk_...`.	Logs `WIX_ANSWERS_SAVED` and publishes the multilingual notice for the Wix domain.
`POST /integrations/wix/verify`	Runs a live HTTPS check against the merchant's published Wix storefront to confirm the embed script is active.	Updates connection state to `active` and records `last_verified_at`.
`POST /integrations/wix/status`	Returns current onboarding step, scan findings, notice status, and console seat entitlement for the Wix dashboard card.	Enforces strict tenant isolation; `GET` requests are rejected with `403`.

Zero Data Collection & No Liability: This documentation page collects zero personal data, zero cookies, and zero analytics. All instructions and API specifications are provided “AS IS” as software documentation, not legal advice. Your organisation remains solely responsible for its Wix store configuration and statutory compliance under the DPDP Act, 2023.

Wix Customer & DPO Step-by-Step Onboarding Guide