Privacy Policy

INTRODUCTION

This Privacy Policy ("Policy") governs the manner in which Sudha Software Solutions Private Limited, a company incorporated under the Companies Act, 2013, and having its registered office at:

("Company", "we", "our", "us") collects, stores, processes, handles, protects, and discloses personal information of its users ("you", "your", "User").

This Policy is drafted in compliance with:

• Information Technology Act, 2000
• IT (Reasonable Security Practices & Procedures and Sensitive Personal Data or Information) Rules, 2011
• The Digital Personal Data Protection Act, 2023 (DPDP Act)
• Indian Contract Act, 1872
• Bharatiya Nyaya Sanhita (BNS), wherever applicable to cyber offences
• General Data Protection Regulation (GDPR) for international users
• Industry best practices including ISO 27001 principles

Your use of our websites, mobile applications, software products, SaaS platforms, and related services ("Services") constitutes your consent to the terms of this Policy.

If you do not agree with any section of this Policy, you must discontinue using our Services immediately.

1. DEFINITIONS

For clarity and legal precision:

2. INFORMATION WE COLLECT

We collect information through:

• Direct submission
• Automated tools
• Cookies and tracking scripts
• Third-party integrations
• API-based interactions

3. PURPOSE OF DATA COLLECTION

Your data is processed strictly for legitimate and lawful purposes, including:

• Account creation and authentication
• Providing and improving our Services
• Verifying user identity to prevent fraud and cyber misuse
• Managing subscriptions, payments, invoices, GST compliance
• Technical troubleshooting & security monitoring
• Communicating service updates, notices, alerts
• Compliance with applicable laws and regulatory obligations
• Analytics, product enhancement, and performance optimization
• Responding to legal notices, disputes, and fraud prevention

We will not use your information for purposes beyond what is expressly stated without obtaining fresh consent.

4. LEGAL BASIS FOR PROCESSING

If you are a user from the EU/EEA, processing is based on:

• Contractual Necessity
• Legitimate Interests
• Explicit Consent
• Legal Obligations

5. HOW WE SHARE YOUR INFORMATION

6. DATA RETENTION POLICY

We retain data only as long as necessary:

• Account data: until you delete your account
• Transaction data: 8 years (mandatory under Indian tax laws)
• Logs: 90–365 days
• Backups: as per internal retention cycles

After the retention period, data is securely deleted or anonymised.

7. USER RIGHTS

Depending on the jurisdiction, you have the right to:

8. SECURITY MEASURES

We follow strong security protocols including:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• ISO 27001 aligned internal procedures
• Role-based access control
• Multi-factor authentication
• Regular security audits & VAPT
• Logging & monitoring
• Secure coding practices (OWASP)
• Least-privilege access policies

However, we disclaim responsibility for breaches beyond reasonable control such as:

• Zero-day vulnerabilities
• User negligence
• Attacks on third-party service providers
• Force majeure events

9. CHILDREN'S PRIVACY

Our Services are not intended for individuals under 18 years of age.

We do not knowingly collect personal information of minors.

10. CROSS-BORDER DATA TRANSFERS

Depending on service architecture, data may be stored or processed in:

• India
• Singapore
• USA
• Europe

Transfers follow:

• Standard Contractual Clauses (GDPR)
• Adequacy mechanisms
• Contractual safeguards

11. THIRD-PARTY LINKS

Our Services may contain links to third-party websites.

We are not responsible for their privacy practices or content.

12. DATA BREACH POLICY

In case of a data breach:

• We will investigate and contain the breach immediately.
• Notify affected users (if risk is significant).
• Notify authorities wherever legally required:
  • CERT-In (under IT Act)
  • DPDP Board (if applicable)
• Apply corrective measures.

We disclaim liability for breaches occurring due to:

• User negligence
• Compromised third-party networks
• Internet-wide attacks beyond our control

13. LIMITATION OF LIABILITY

To the fullest extent permitted by law:

• The Company shall not be liable for indirect, incidental, punitive, exemplary, or consequential damages.
• Total liability shall not exceed the amount paid by the user in the preceding 3 months, capped at ₹5,000, unless expressly agreed by separate contract.

14. INDEMNIFICATION

You shall indemnify and defend the Company, its directors, employees, and affiliates from losses, damages, or claims arising out of:

• Your breach of this Policy
• Unauthorized use of our Services
• Violation of applicable laws
• Misuse or fraudulent activity conducted using your account

15. CHANGES TO THIS POLICY

We reserve full rights to update or amend this Policy at any time.

Changes shall be posted with a "Last Updated" date.

Continued use of our Services signifies acceptance.

16. GRIEVANCE OFFICER

17. CONTACT INFORMATION

For queries or exercising your rights

18. GOVERNING LAW & JURISDICTION

This Policy shall be governed by the laws of India.

All disputes are subject to the exclusive jurisdiction of courts in Ranchi, Jharkhand.