Privacy Policy

Worksmith Solutions Private Limited (CIN U62013TS2026PTC221259), a company incorporated under the Companies Act, 2013 and having its registered office at Flat No 207, ND 1, Puppalaguda, Myscape Rd, Gachibowli, Seri Lingampally, K.V. Rangareddy – 500032, Telangana, India (“Worksmith”, “we”, “us”, “our”) operates the website at worksmith.tech (the “Website”).

This Privacy Policy explains how we collect, use, disclose, retain and protect personal data of visitors to the Website and of persons who contact us through it, and describes the rights available to you under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made thereunder.

Scope limitation. This Privacy Policy governs personal data processed through the Website only. It does not govern data processed in the course of a client engagement. Where we are engaged to perform diagnostic, reconciliation, automation or advisory services, the treatment of client data — including any personal data contained within accounting records, ledgers, invoices, payroll files, contracts or systems to which we are given access — is governed exclusively by the engagement agreement and the data processing terms executed with that client, and not by this Privacy Policy.

In respect of personal data processed through the Website, Worksmith acts as a Data Fiduciary within the meaning of the DPDP Act. In respect of personal data processed on a client’s instructions during an engagement, Worksmith ordinarily acts as a Data Processor for that client, who remains the Data Fiduciary.

Effective date: [insert date]. Version: [1.0].

Terms used in this Privacy Policy which are defined in the DPDP Act carry the meaning given to them in that Act. In particular:

1. (a)“Personal Data” means any data about an individual who is identifiable by or in relation to such data.
2. (b)“Data Principal” means the individual to whom the Personal Data relates.
3. (c)“Data Fiduciary” means the person who alone or in conjunction with others determines the purpose and means of processing Personal Data.
4. (d)“Data Processor” means a person who processes Personal Data on behalf of a Data Fiduciary.
5. (e)“Processing” means any operation performed on Personal Data, including collection, storage, use, sharing, alteration, retention or erasure.

We collect only what we need, and we collect it in three ways:

We do not knowingly seek, and ask that you do not send us through the Website, any financial records, ledgers, client data, or sensitive personal information. See Clause 9 of the Terms of Use regarding unsolicited submissions.

We process personal data collected through the Website for the following specified purposes, and for no other purpose without obtaining fresh consent:

1. (a)to respond to your enquiry and to correspond with you about it;
2. (b)to assess whether a prospective engagement falls within our service scope and client profile;
3. (c)to prepare for and conduct discussions, proposals and, if agreed, an engagement;
4. (d)to operate, secure, maintain and improve the Website, including diagnosing faults and preventing misuse, fraud or unauthorised access;
5. (e)to send you information about our services where you have separately consented to receive it, with an unsubscribe facility in every such communication; and
6. (f)to comply with applicable law, and to establish, exercise or defend legal claims.

Lawful basis. We process personal data collected through the Website on the basis of your consent, obtained at the point of collection through a clear affirmative action, or on the basis of legitimate uses permitted under Section 7 of the DPDP Act where applicable.

We do not sell personal data. We do not use personal data collected through the Website for automated decision-making producing legal effects, and we do not use it to train machine-learning models.

Commercial communications. Any promotional communication we send by telephone, SMS or messaging application is sent in accordance with the Telecom Commercial Communications Customer Preference Regulations, 2018 and the preferences you have registered with your access provider. Every promotional email we send carries an unsubscribe facility, and we act on an unsubscribe request without charge and without undue delay.

Where we rely on your consent, that consent is sought through a clear, specific and unambiguous affirmative action, accompanied by a notice describing the personal data to be collected and the purpose of processing.

You may withdraw your consent at any time, with the same ease with which it was given, by writing to contact@worksmith.tech with the subject line “Withdrawal of Consent”.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Following withdrawal, we will cease processing within a reasonable period and will erase the relevant personal data unless retention is required under Clause 8.

Notice at the point of collection. This Privacy Policy is a general statement of our practices and does not by itself constitute the notice required under Section 5 of the DPDP Act. Wherever we collect personal data on the basis of consent, a separate, itemised notice is presented to you at or before the point of collection, describing the specific personal data sought, the specific purpose for which it will be processed, the manner in which you may exercise your rights, and the manner in which you may complain to the Data Protection Board of India. That notice is available in English and, on request, in any language specified in the Eighth Schedule to the Constitution of India.

Cookies are small text files placed on your device. We use only the following categories:

A full list of cookies in use, their provider, purpose and duration is maintained at [link to Cookie Policy]. You may withdraw or change your cookie preferences at any time through the cookie settings link in the Website footer, and you may block or delete cookies through your browser settings.

We do not use cookies for cross-site behavioural advertising.

We do not disclose personal data collected through the Website except as set out below:

1. (a)Service providers. To vendors who process personal data on our behalf and on our documented instructions — for example website hosting, email, customer-relationship and analytics providers. Each such provider is engaged under a written contract imposing confidentiality and security obligations, and is prohibited from using the data for its own purposes.
2. (b)Professional advisers. To our lawyers, auditors, accountants and insurers, each of whom is bound by professional duties of confidentiality.
3. (c)Legal and regulatory. Where disclosure is required by law, by a court of competent jurisdiction, or by a regulatory or governmental authority acting within its powers.
4. (d)Corporate transactions. To a proposed acquirer, investor or successor in the event of a merger, acquisition, restructuring or sale of assets, subject to confidentiality undertakings, and provided the recipient is bound to treat the data in accordance with this Privacy Policy.

Cross-border transfer. Certain of our service providers may store or process personal data outside India. We transfer personal data outside India only to countries not restricted by the Central Government under Section 16 of the DPDP Act, and only where the recipient is bound by contractual obligations providing a comparable standard of protection. A list of the jurisdictions in which your personal data may be processed is available on request.

We retain personal data only for as long as is necessary for the purpose for which it was collected, or for such longer period as is required by law.

On expiry of the applicable period, or on withdrawal of consent where no other basis for retention exists, we erase the personal data and require our processors to do the same, save where retention is necessary for compliance with law or for the establishment, exercise or defence of legal claims.

We implement reasonable security safeguards designed to prevent personal data breach, appropriate to the nature of the data and the risk involved. These include encryption in transit, access controls on a need-to-know basis, authentication requirements, logging, and contractual security obligations on our processors.

No system is entirely secure. While we take the measures described above, we do not and cannot warrant that the Website or any transmission to it is immune from unauthorised access, and any transmission of information over the internet is undertaken at your own risk. Nothing in this Clause limits our obligations under the DPDP Act, which are not capable of being contracted out of.

In the event of a personal data breach affecting personal data for which we are the Data Fiduciary, we will intimate each affected Data Principal without delay, through the mode of communication registered with us.

We will also intimate the Data Protection Board of India without delay upon becoming aware of the breach, and will furnish the detailed particulars required under the DPDP Rules within seventy-two (72) hours of becoming aware, or within such longer period as the Board may on request allow.

Our intimation will describe, so far as known, the nature, extent and timing of the breach, its likely consequences, the measures we have taken to mitigate risk, the safeguards you may take to protect your interests, and the contact point for further information.

Subject to the DPDP Act, you have the following rights in respect of personal data we hold about you:

1. (a)Right to access. To obtain a summary of the personal data being processed, the processing activities undertaken, and the identities of any other Data Fiduciaries or processors with whom it has been shared.
2. (b)Right to correction and erasure. To have inaccurate or misleading personal data corrected, incomplete data completed, data updated, and data erased where it is no longer necessary for the purpose for which it was collected.
3. (c)Right to withdraw consent. As set out in Clause 5.
4. (d)Right of grievance redressal. To a readily available means of registering a grievance with us, as set out in Clause 13.
5. (e)Right to nominate. To nominate another individual to exercise your rights in the event of your death or incapacity.

To exercise any right, write to contact@worksmith.tech, or use the facility provided on the Website. We will act on a valid request without undue delay and in any event within thirty (30) days of receipt. We may ask you for information reasonably necessary to verify your identity before acting on a request, and may decline a request only where permitted by law, giving reasons.

You are responsible for the accuracy of the information you furnish to us, and for not impersonating another person or furnishing false particulars when exercising a right. The DPDP Act provides for penalties against Data Principals who raise false or frivolous grievances.

The Website is intended for business users and is not directed at children. We do not knowingly collect personal data of any individual below the age of eighteen years.

We do not undertake tracking, behavioural monitoring or targeted advertising directed at children. Where we become aware that we hold personal data of a child without verifiable consent of a parent or lawful guardian, we will erase it promptly.

Where personal data of a person with disability who has a lawful guardian is to be processed, we will process it only with the verifiable consent of that guardian.

Any grievance concerning our processing of your personal data, or the exercise of your rights, may be addressed to:

Grievance Officer

Grievance Officer, Worksmith Solutions Private Limited

Email

contact@worksmith.tech

Telephone

+91 90309 99860

Address

Flat No 207, ND 1, Puppalaguda, Myscape Rd, Gachibowli, Seri Lingampally, K.V. Rangareddy – 500032, Telangana, India

We will acknowledge every grievance on receipt and will respond to it within ninety (90) days of receipt, that being the maximum period prescribed under the DPDP Rules. We will ordinarily respond substantially sooner.

You must exhaust this grievance mechanism before approaching the Data Protection Board of India. If you are not satisfied with our response, or if we fail to respond within the period stated above, you may complain to the Data Protection Board of India in accordance with the DPDP Act.

We may amend this Privacy Policy from time to time. The version in force is the version published on the Website, and the effective date appears at Clause 1.5.

Where an amendment materially changes the purposes for which we process personal data collected on the basis of your consent, we will seek fresh consent before applying the change to that data.