This Privacy Policy explains how Spectra Outsource Solutions Private Limited ("Digiliance", "we", "us"), with its office at 243, 2nd Floor, Vipul Trade Center, Sector-48, Sohna Road, Gurugram, Haryana 122018, India, collects, uses, shares and protects personal data in connection with the Digiliance platform at https://app.digiliance.in (the "Service") and our website https://digiliance.in. It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the rules made under it as they come into force, and the Information Technology Act, 2000 and its rules.
1. Our two roles
| Data | Our role |
|---|---|
| Data that our customers (employers) and their Users upload about their employees, contract workers and others — for example names, dates of birth, addresses, wages, attendance, leave, Aadhaar, PAN, UAN, ESIC and bank details, photographs and signatures for statutory registers | The customer is the Data Fiduciary; we are its Data Processor and process the data only on the customer's instructions under our Terms of Service (Schedule A). Employees and workers should contact their employer first about this data. If you contact us, we will pass your request to the employer. |
| Data about people who use the Service or contact us — Users, company owners, administrators, makers, checkers, resellers and partners, and website visitors | We are the Data Fiduciary. The rest of this Policy mainly describes this processing. |
2. Personal data we collect
- Account data: name, email address, mobile number, role, company and entity, password (stored only as a secure one-way hash), preferences and email-notification choices.
- Customer and organisation data: company and entity names, addresses, contact persons, statutory registration details and employee counts entered during set-up.
- Usage and device data: IP address, browser and device information, sign-in times, pages and features used, and actions taken (for example submissions, approvals, downloads and "Login As" sessions), recorded in audit logs.
- Communications: support tickets, messages, attachments and emails you send us.
- Commercial data: subscription, billing contact and invoice details.
- Website data: information you submit through contact or demo forms on https://digiliance.in, and analytics data described in section 9.
We do not intentionally collect personal data of children for our own purposes. The Service is for use by adults acting for businesses.
3. Why we use it (purposes and lawful basis)
| Purpose | Basis |
|---|---|
| Creating and managing accounts, authenticating Users, providing the Service and its features, support | Your consent given when you accept our terms and use the Service, and processing for the specified purpose for which you provided the data |
| Security: preventing fraud and misuse, rate limiting, audit trails of access and "Login As", investigating incidents | Legitimate uses permitted by the DPDP Act and compliance with law |
| Service messages: password resets, account notices, compliance reminders, weekly and monthly reports | Providing the Service you asked for |
| Billing, accounting, tax and legal record-keeping | Compliance with law and our contract with the customer |
| Improving the Service, statutory content and features, using aggregated or de-identified data where possible | Consent / reasonable expectations of business users; anonymised data is not personal data |
| Marketing emails about our products | Only with your consent; you can withdraw it at any time (section 7) |
| Complying with law, court orders and requests of authorities; establishing, exercising or defending legal claims | Compliance with law and legitimate uses under the DPDP Act |
4. Who we share it with
We do not sell or rent personal data. We share it only as follows:
- Within your organisation: Users of the same customer see data according to their role (for example a checker sees what makers submit).
- Partners chosen by the customer: resellers or consultants who manage a customer's account with that customer's authority.
- Our sub-processors, who process data for us under contract:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Network security, DDoS protection and content delivery for the Service (traffic passes through it in encrypted form) | Global network; served from points of presence including India |
| SMTP2GO | Delivery of transactional emails (account, password reset, reports) | As per provider |
| Digiliance document service (operated by us) | Storage of uploaded documents and files | India |
| Google Analytics (website only) | Visitor statistics on https://digiliance.in, only with cookie consent; not used inside the Service | As per provider |
- Authorities: where required by law, court order or a lawful request of a government or regulatory authority.
- Business transfers: to a successor in a merger, acquisition, restructuring or sale of assets, subject to this Policy.
- Professional advisers (lawyers, auditors) under confidentiality.
5. Where your data is stored
The Service, its database, backups and our document service are hosted in India. Email delivery and website analytics providers may process limited data (such as email addresses and website usage) outside India. We transfer personal data outside India only as permitted under section 16 of the DPDP Act and any restrictions notified by the Government of India.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and customer data | For the duration of the subscription, then a 30-day export window, after which we delete or anonymise it, except what the law requires us to keep. You can also ask for deletion earlier by emailing [email protected]; deletion is carried out by our team after verifying the request |
| Statutory register data deleted during a subscription | Kept in an archive for up to 5 years to support statutory record-keeping, then permanently deleted, unless the customer asks for earlier deletion |
| Other deleted records (archives) | 180 days, to allow restoration, then permanently deleted |
| Audit and activity logs (including IP address and browser) | 2 years |
| Outgoing email log | 180 days; passwords and password-reset links are removed from stored emails once sent |
| Password-reset tokens | Deleted 7 days after expiry |
| In-app automatic notifications | 1 year |
| Billing and tax records | As required by tax and company law (generally 8 years) |
| Backups | Overwritten in the normal backup cycle |
We may keep data longer where required to comply with law, resolve disputes or enforce our agreements.
7. Your rights
Subject to the DPDP Act, you may:
- obtain a summary of your personal data we process and of the processing activities, and the identities of those we have shared it with;
- ask us to correct, complete or update inaccurate or incomplete data (most profile details can be updated directly in the Service);
- ask us to erase data that is no longer necessary for the purpose for which it was collected, unless we must keep it by law;
- withdraw consent at any time, with the same ease as it was given (withdrawal does not affect processing already done, and may mean we cannot continue to provide the Service);
- nominate another person to exercise your rights in case of death or incapacity;
- have your grievances addressed by our Grievance Officer (section 11).
How to make a request. Email [email protected] from the email address registered on your account (or with enough information for us to verify you). Requests, including requests to delete data, are handled by our team manually after verification, and we will confirm when they are completed.
If your employer uploaded your data to the Service, please send requests about it to your employer, who is the Data Fiduciary; we will forward requests we receive to the employer concerned. We may need to verify your identity before acting on a request. You also have duties under section 15 of the DPDP Act, including not to provide false information or file frivolous complaints.
8. Security
We use reasonable security safeguards appropriate to the nature of the data, including encrypted connections (HTTPS) for the Service, one-way hashing of passwords, role-based access control and isolation between customers, rate-limited sign-in, security headers, audit logging of sign-ins, "Login As" sessions and downloads of personal data, limited retention of logs, and access to documents only through the Service for authorised users. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential.
If a personal data breach occurs, we will inform the Data Protection Board of India and affected individuals as required by the DPDP Act and its rules, and, where we act as a processor, the customer concerned without undue delay.
9. Cookies
Inside the Service we use only cookies that are strictly necessary for it to work:
| Cookie | Purpose | Duration |
|---|---|---|
| digiliance_session | Keeps you signed in during a visit | Session / up to 2 hours of inactivity |
| digiliance_token | Secure sign-in token | Up to 24 hours |
| digiliance_csrf | Protects forms against cross-site request forgery | Session |
These cannot be switched off without stopping the Service from working. The Service does not use advertising or analytics cookies. Our website https://digiliance.in may use analytics and marketing cookies only with your consent through its cookie banner; you can change your choice there or in your browser settings.
10. Changes to this Policy
We may update this Policy. We will post the new version with its effective date and, for material changes, notify Users by email or in the Service, or ask them to review it at sign-in.
11. Contact and grievance officer
Email: [email protected] · Phone: +91 98113 96692
Address: 243, 2nd Floor, Vipul Trade Center, Sector-48, Sohna Road, Gurugram, Haryana 122018, India
We will acknowledge grievances promptly and respond within the period required by law, and in any case within 90 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.
12. Users outside India
The Service is designed for organisations operating in India and is governed by Indian law. If laws of another country (such as the EU or UK General Data Protection Regulation or California privacy laws) apply to your use, you may have additional rights, including access, correction, deletion, portability, objection and the right to complain to your local regulator; contact us at [email protected] to exercise them. We do not sell or share personal information for cross-context behavioural advertising.