Privacy Policy

1.Summary

• We collect the personal data we need to run your account, bill subscriptions, keep the service secure and answer your questions.
• Business records that an organization puts into Qlomack BM belong to that organization. We process them only to provide the service.
• We do not sell personal data, and we do not use advertising or analytics trackers.
• You can see and correct your account details, ask us to delete them, and export your organization’s data at any time.
• Questions and grievances go to our Grievance Officer at support@qlomack.com.

2.Who we are and our role

Qlomack Business Manager (“Qlomack BM”) and our website are provided by Qlomack Global Technologies LLP (“Qlomack”, “we”, “us” or “our”). Our company details are listed at the end of this page.

When we decide how data is used. We are responsible, as the data fiduciary under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and as the controller under the EU and UK General Data Protection Regulation (“GDPR”), for personal data about people who create or are invited to accounts, visitors to our website, people who contact us, the billing contacts of our customers, and security records.

When we act for our customers. Business records that an organization enters into Qlomack BM, such as details of its employees, customers, suppliers and tenants, attendance, invoices and uploaded documents (“Customer Data”), are controlled by that organization. We process Customer Data on the organization’s behalf, as its data processor, under our Data Processing Terms. If a business holds your personal data in Qlomack BM, for example your employer or a supplier, please contact that business about it. We will help it respond.

3.Personal data we collect

Account data

Your name, email address and password (which we store only as a one-way hash), and any profile details you add. If you are invited to an organization, the person who invites you gives us your email address and the role they intend you to have. We also keep your organization memberships, roles and branch access.

Two-factor authentication data

If you turn on two-factor authentication, the secret shared with your authenticator app (stored encrypted) and your recovery codes (stored only as hashes).

Organization and billing data

Your organization’s name, legal name, tax registration number (for example a GSTIN or VAT number), address, country, currency and contact details; the plan, modules and billing cycle chosen; and the status of payments and the customer and subscription references that Razorpay or Stripe give us. Card and bank details are entered on the payment provider’s pages. We do not receive full card numbers or bank credentials.

Security and usage data

For each sign-in session: the IP address, the browser and device type (user agent), and when the session started and was last used. We also keep records of sign-in attempts and security events, an audit trail of actions taken in each organization (who did what, and when), and server logs of requests, which include IP addresses, for security and troubleshooting.

Communications

When you use our contact form, the name, email address, company, phone number, subject and message you give us, together with a keyed hash of your IP address (not the address itself) used to detect abuse. We also keep emails and messages you send us, notes of support calls, and delivery records of the emails we send you.

Website visits

Our website does not use analytics or advertising cookies. Our servers record standard technical information about requests, such as IP address, browser type and the page requested. If you choose a currency on the pricing page, that choice is stored only in your browser.

Customer Data

Whatever an organization chooses to enter into Qlomack BM. We process it only as described in our Data Processing Terms. We do not ask for sensitive personal data. If an organization chooses to store it, the organization is responsible for doing so lawfully.

4.How we use personal data, and our legal bases

Under the DPDP Act, we process your personal data on the basis of the consent you give after reading this notice (for example when you create an account, accept an invitation or send us the contact form), or for a legitimate use that the Act permits, such as where you have voluntarily given us data for a specific purpose, or where we must comply with a law, judgment or order. You can withdraw consent at any time by contacting us. This does not affect processing already carried out, but we may then be unable to provide the service to you.

Marketing. We do not currently send marketing emails. If we start, we will ask for your consent where the law requires it, and every marketing email will include a way to unsubscribe. Service emails are needed to run your account; you can choose which notification emails you receive in your settings.

We do not sell personal data, do not use it for advertising, and do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5.How we share personal data

We share personal data only in the following ways.

Service providers

We use service providers, under written agreements, to run the service. They may process personal data only on our instructions.

We will give you the names and locations of our current service providers on request at support@qlomack.com.

Payment providers

Subscription payments are processed by Razorpay (payments in Indian rupees) and Stripe (payments in other currencies). They receive the details you enter on their payment pages and the organization and plan details needed for the payment. They handle payment data under their own privacy policies, as independent data fiduciaries or controllers.

Within your organization

Other members of an organization you belong to can see your name, email address, role and your actions in the audit trail, depending on their permissions.

Integrations

If an organization connects a third-party service or sets up webhooks, data is sent to that service on the organization’s instructions.

Legal reasons and business changes

We may disclose personal data where required by law or by a valid request from a court, regulator or law enforcement authority, or where necessary to protect the rights, property or safety of our customers, our users, the public or us. We may also share it with our professional advisers under confidentiality obligations, and with a successor in a merger, acquisition or sale of our business, in which case this policy will continue to apply to your data.

6.International transfers

We are based in India. Personal data is stored with our hosting and storage providers and may be processed in India and in other countries where we or our service providers operate. We will tell you where your data is hosted on request at support@qlomack.com.

Transfers of personal data out of India are made in line with the DPDP Act, including any restrictions on transfers to particular countries that the Government of India notifies.

If you are in the European Economic Area, the United Kingdom or Switzerland, your personal data may be transferred to countries, including India, that are not recognised as providing an adequate level of protection. Where the law requires it, we use appropriate safeguards for these transfers, such as the European Commission’s standard contractual clauses and the UK addendum to them. You can ask us for a copy.

7.How long we keep personal data

We keep personal data only for as long as we need it for the purposes described in this policy, or as the law requires.

8.How we protect personal data

We use technical and organisational measures appropriate to the risk, including:

• Encryption in transit. The website, the application and the API are served over HTTPS (TLS), and sign-in cookies are sent only over secure connections.
• Passwords. Passwords must be at least 12 characters and are stored only as one-way Argon2id hashes, never in readable form. Sign-in attempts are rate limited, with a progressive lockout after repeated failures.
• Two-factor authentication. Every user can turn on two-factor authentication with an authenticator app. Authenticator secrets are stored encrypted, and recovery codes are stored only as hashes.
• Sessions. Sessions use long random tokens, of which we store only a hash. They end after a period of inactivity and after a maximum lifetime. Users can see their active sessions and sign out other devices, and resetting a password signs out every device.
• Tenant isolation. Each organization’s data is kept separate from every other organization’s. Every request is checked against the user’s membership of the organization, and the database enforces row-level security, so a query without the correct organization context returns no data.
• Access control. Within an organization, access follows role-based permissions, with optional limits to particular branches, set by the organization’s owners and admins.
• Audit trail. Significant actions in an organization are recorded in an append-only audit log, written together with the change itself.
• Private document storage. Uploaded documents, generated reports and data exports are kept in private storage and can be downloaded only through short-lived links issued after a permission check.
• Protected credentials. Credentials for integrations that an organization connects are stored encrypted.
• Backups. The database is backed up every night, each backup is checked when it is made, and backups are kept for 14 days by default. Restores are tested.
• Limited staff access. Platform administration does not give access to organizations’ business data by default. Our staff access Customer Data only where needed to provide support you ask for, to keep the service secure, or where the law requires it.

No system is completely secure, and we cannot guarantee that personal data will never be accessed without authorisation. If a personal data breach occurs, we will notify affected customers and users, the Data Protection Board of India and other authorities as the law requires.

9.Your rights

You can view and update your account details in your account settings at any time. Organization owners and admins can export their organization’s data themselves.

Rights under the DPDP Act (India)

• to obtain a summary of the personal data we process about you, the processing activities, and the other data fiduciaries and processors with whom it has been shared;
• to have your personal data corrected, completed, updated or erased;
• to withdraw consent that you have given;
• to have your grievances addressed by our Grievance Officer; and
• to nominate another person to exercise your rights if you die or are unable to do so.

If you are not satisfied with how we handle your grievance, you may complain to the Data Protection Board of India.

Rights under the GDPR (EU and UK)

If you are in the European Economic Area or the United Kingdom, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing (including processing based on legitimate interests), to data portability, and to withdraw consent at any time. You can also complain to the data protection authority where you live or work, or, in the UK, to the Information Commissioner’s Office.

How to exercise your rights

Email support@qlomack.com from the email address linked to your account, or call +91 7337546393. We may need to confirm your identity before acting on a request. We respond within one month, or within any shorter period the law requires, and we do not charge for requests unless they are clearly unfounded or excessive.

If your request concerns Customer Data held by an organization, we will pass it to that organization, which decides how to respond, and we will help it do so.

10.Cookies

We use only cookies and browser storage that are needed to provide the service or to remember a choice you make. We do not use advertising or analytics trackers. Details are in our Cookie Policy.

11.Children

Qlomack BM is a service for businesses and is not intended for children. Accounts may be created only by people aged 18 or over, and we do not knowingly collect personal data from children. If we learn that a child has created an account, we will delete it.

Where an organization stores personal data about children in Qlomack BM, the organization is responsible for doing so lawfully, including obtaining verifiable parental consent where the DPDP Act requires it.

12.Grievance Officer

If you have a question or complaint about how we handle personal data, please contact:

• Grievance Officer, Qlomack Global Technologies LLP
• Email: support@qlomack.com (please include “Grievance” in the subject)
• Phone: +91 7337546393

We will acknowledge your grievance promptly and aim to resolve it within 30 days, and in any case within the time required by the DPDP Act and the rules made under it.

13.Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page shows when it last changed. If we make material changes, we will tell account holders by email or in the service before the changes take effect.

14.Contact

Questions about this policy can be sent to support@qlomack.com or raised by phone on +91 7337546393. Our company details are listed below.