Privacy Policy

1. What this covers

This policy explains what YantrAdhigam Labs Pvt Ltd does with personal data in connection with WON, under India's Digital Personal Data Protection Act 2023 and the Information Technology Act 2000, and, for people outside India, the EU and UK General Data Protection Regulation and the California Consumer Privacy Act.

2. Two kinds of data, and who answers for each

Account and usage data is data about you as a customer of ours: your name, work email, phone, your company's details, billing information, and how you use the product. For this we are the Data Fiduciary, which the GDPR calls the controller.

Workspace records are what you enter into WON: your job workers and their staff, your customers, your transporters and drivers, and every challan, job and stock movement between them. For these you are the Data Fiduciary and we are only your Processor. We handle them on your instructions to run the service and for no purpose of our own.

If your details appear in somebody else's WON workspace because you do job work for them, they are the Data Fiduciary for those records. Ask them, and we will help them answer you.

3. What we collect

We keep this deliberately short, because we collect deliberately little.

• Account data: your name, work email, phone if you give it, and your company's details.
• Consent records: which version of these documents you agreed to, when, and from which IP address, because consent has to be provable, not merely claimed.
• Usage data: sign-in times and the records you create, which is the service itself.
• Billing data, handled by our payment gateway. Card details are entered on the gateway's own page and never reach us.
• Support correspondence you send us.

4. What we do not do

We do not sell personal data and we do not share it for cross-context behavioural advertising. We do not use it to train machine-learning models. We run no advertising or analytics trackers on this website. The only thing stored in your browser here is whether you have dismissed the cookie notice.

The verification puzzle on our forms is solved by your own browser. No third party sees your visit.

5. Why we are allowed to hold it

For account and service data, because we need it to perform the contract with you. For consent and tax records, because the law requires us to keep them. For product news, because you have agreed and can withdraw that agreement at any time.

6. Who else sees it

Only the sub-processors listed on our sub-processors page, each of which is bound by a data processing agreement, and other companies in the YantrAdhigam group. We do not disclose your data to anyone else unless the law compels us, in which case we will tell you if we are permitted to.

7. Where it is held, and what happens when it crosses a border

WON is hosted in India, in the region assigned to your workspace. Tell us if you have a residency requirement before you sign up and we will confirm whether we can meet it.

Where personal data does cross a border, including to a sub-processor, we transfer it only to jurisdictions the Central Government has not restricted under the DPDP Act, and, for the EEA and the UK, under Standard Contractual Clauses or an adequacy decision. We will tell you which applies if you ask.

8. How long we keep it

For as long as your workspace exists, and for 30 days afterwards so that an accidental deletion can be undone. Consent, billing and tax records are kept for as long as the law requires, which for GST records is longer than the rest.

9. How we protect it, and what we do if that fails

Transport is encrypted with TLS 1.2 or better. Every workspace is isolated at the database itself rather than by application code, so one customer's query cannot reach another's rows even if the application is wrong. Access is role-based and every change to a record is written to an audit trail.

No system is perfectly secure. If personal data is breached we will notify the Data Protection Board of India and the people affected without undue delay and within the period the law allows, and the supervisory authority in the EEA or the UK where that applies.

10. Your rights

You can ask us for a copy of your data or a summary of what we hold, ask us to correct or complete it, ask us to delete it, or withdraw consent. Under the DPDP Act you may also nominate somebody to exercise these rights for you if you die or become incapable of doing so yourself.

Write to our grievance officer, whose name and address are on the grievance page, and we will respond within the statutory period: 30 days under the DPDP Act, one month under the GDPR. If we have not resolved your complaint you may escalate it to the Data Protection Board of India.

11. If you are in the EEA or the UK

You also have the rights to portability, to restriction, and to object to processing we carry out on the basis of our legitimate interests, including direct marketing, at any time. You may complain to your own supervisory authority.

12. If you are in California

You may ask to know, access, correct and delete your personal information, and you may opt out of any sale or sharing of it, although we do not sell or share it as those terms are defined. We honour Global Privacy Control signals sent by your browser, and we will not treat you differently for exercising any of these rights.

13. Children

WON is sold to businesses and is not directed at anybody under 18. We do not knowingly collect their data.

14. Changes to this policy

We may update this policy. If a change is material we will say so in the product or on this site, and the date at the top of this page will change. The version you agreed to is recorded against your account.