Privacy Policy

Foreword

We at CluCloud Innovations Private Limited ("Clu") are committed to protecting the information that you share with us and explaining how we collect, process, and share that information. When you use our services, you're trusting us with your information. We understand this is a big responsibility and work hard to protect your information and keep it secure.

We provide you with insight into the privacy practices employed here at Clu.

Background

This Policy provides an overview of how Clu's information of "data subjects" (hereinafter referred to as "You" or "Your") personal data is collected, handled, and protected. In this policy, "we", "us", and "our" refer to CluCloud Innovations Private Limited or its subsidiaries and affiliates.

Services Provided by Clu

The Clu platform is designed to help small and medium enterprises manage their operations consistently and efficiently. We offer an end-to-end solution enabling businesses with a platform for all required services, including workflow management, auditing, and operational tools.

What Data Do We Collect?

Clu collects the following data:

• Personal identification information (name and email address).
• Business contact details such as phone number, job title, and company name.
• Usage data including IP addresses, device identifiers, browser type, and application activity logs.
• Precise location data (GPS), where you have granted permission via your device settings, to support location-enabled service features.
• Camera and photo library access, where you have granted permission, for user-initiated document or image uploads.
• Any other personal data collected from auditors for auditing purposes will be obtained with the individual's explicit consent.

How Do We Collect Your Data?

You or your employer directly provide Clu with the data we collect. We collect and process data when you:

• Register online or avail of our products or services.
• Use or navigate the Clu application or website.
• Contact us for support or submit feedback.

Clu does not currently receive your data indirectly from third-party sources.

How Will We Use Your Data?

Clu collects your data so that we can:

• Provide the Service and manage your account.
• Authenticate users and maintain account security.
• Send real-time alerts and operational notifications relevant to your organization.
• Improve and develop the Service through usage analytics.
• Comply with applicable legal obligations, including India's Digital Personal Data Protection Act, 2023 ("DPDP Act").

Clu is a B2B platform and does not use your data for third-party advertising or marketing. We do not sell or rent your personal data.

What Are Cookies?

Cookies are text files placed on your computer to collect standard internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. For further information, visit the cookie information page.

How Do We Use Cookies?

Clu uses only a session variable to keep you signed in to the application. We do not use cookies for third-party behavioral advertising, profiling, or tracking across external websites.

How Do We Store Your Data? (Data Residency)

Clu is committed to data sovereignty. Personal Data is processed and stored within the jurisdiction of the Client (the Business Customer), or as otherwise specified in the Master Service Agreement, to comply with local data localization requirements and client-specific security mandates.

Clu will retain your personal data for as long as the Service is availed. Once the service period has expired, we will delete your data by scrubbing all personally identifiable information (PII) within one month of Service Termination.

International Data Transfers

Aligned with our data residency policy, Clu does not transfer Personal Data across international borders unless explicitly authorized by the Business Customer or required for cross-border service functionality. Any such transfers are governed by strict contractual safeguards, such as Standard Contractual Clauses (SCCs), in compliance with applicable laws including the DPDP Act 2023.

Data Breach Response Process

If Clu becomes aware of an unauthorized access or Personal Data breach, we follow a structured response protocol:

• Incident Assessment: Immediate forensic review to identify the scope and nature of the breach.
• Notification: Where required by the DPDP Act 2023 or other applicable laws, we will notify affected individuals and the relevant regulatory authority without undue delay. Notifications will include the nature of the breach, expected consequences, and measures taken.
• Remediation: We will implement corrective technical and organizational measures to mitigate harm and prevent future occurrences.

Marketing

Clu is a B2B service and does not engage in third-party marketing or advertising using your personal data. We may send you service-related communications and operational updates. If you no longer wish to be contacted for such communications, you can opt out by emailing us at support@clucloud.com.

What Are Your Data Protection Rights?

Clu would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

• The right to access You have the right to request Clu for copies of your personal data.
• The right to rectification You have the right to request that Clu correct any information you believe is inaccurate or complete information you believe is incomplete.
• The right to erasure You have the right to request that Clu erase your personal data, under certain conditions.
• The right to restrict processing You have the right to request that Clu restrict the processing of your personal data, under certain conditions.
• The right to object to processing You have the right to object to Clu's processing of your personal data, under certain conditions.
• The right to withdraw consent You may withdraw consent for data processing at any time through your account or device settings, without affecting the lawfulness of processing before withdrawal.
• The right to nominate Under the DPDP Act 2023, you may nominate another individual to exercise your rights in the event of death or incapacity.

If you make a request, we have one month to respond to you. To exercise any of these rights, please contact our Data Protection Officer:

Data Protection Officer (DPO) and Their Responsibilities

DPO Contact Information

DPO Roles and Responsibilities

• Create, implement, and supervise the organization's privacy policies and processes, ensuring compliance with applicable data protection regulations including the DPDP Act 2023.
• Ensure compliance with data protection laws and regulations.
• Act as the organization's primary point of contact for personal data processing issues.
• Ensure that the various audits are performed within the required time range.
• Conduct frequent audits to monitor data processing processes, identify risks, and conduct Data Protection Impact Assessments (DPIAs) to evaluate and reduce data protection risks.
• Ensure that the Records of Processing Activities (RoPA) are completed whenever the organization collects and processes personal data.
• Inform and advise the organization and its personnel who process personal data on their obligations under applicable data protection regulations.
• Educate and train employees on data protection policies and practices, fostering a culture of awareness and compliance within the organization.
• Conduct risk assessments related to data processing activities, considering the nature, scope, circumstances, and purposes of processing.
• Provide timely responses to individuals whose data is processed (workers, clients, or any other data subject) on any problems concerning the processing of their personal data and the exercise of their rights.

Consent Management

Obtaining Consent

Our privacy policy transparently details the purposes of data processing, the affirmative actions required for consent, and the granularity of choices, ensuring individuals have clear control over their data.

Modification of Consent

Users can conveniently modify consent preferences through accessible account settings, with notifications for changes, and comprehensive documentation maintained for all modifications.

Withdrawal of Consent

Clear instructions on withdrawing consent are provided in this privacy policy, ensuring no negative consequences for withdrawal. A detailed record-keeping process is maintained for transparency and compliance.

Children's Privacy

The Clu platform is not intended for use by children. Clu does not knowingly collect personal information from anyone under 18 years of age. Product access is granted only to employees of our client companies, who are assumed to be above 18 years of age. In case of any exceptions, data is collected only with verifiable parental consent.

Privacy Policies of Other Websites

The Clu website may contain links to other websites. Our privacy policy applies only to our website and Service. If you click on a link to another website, you should read their privacy policy independently.

Changes to Our Privacy Policy

Clu keeps its privacy policy under regular review and places any updates on this page. Where required by applicable law, we will provide additional notice or obtain consent before material changes take effect. This privacy policy was last updated on June 2024.

How to Contact Us

If you have any questions about Clu's privacy policy, the data we hold on you, or if you would like to exercise one of your data protection rights, please contact us:

How to Contact the Appropriate Authority

Should you wish to report a complaint or if you feel that Clu has not addressed your concern satisfactorily, you may contact the relevant data protection authority in your jurisdiction. For users in India, this is the Data Protection Board of India as established under the DPDP Act 2023.

Enforcement

We expect all employees to comply with this policy and any related policies, standards, processes, procedures, and guidelines. Failure and/or refusal to abide by this policy may be deemed a violation. Compliance with the policies will be a matter of periodic review by the Information Security Officer / Information Security Team. Any employee found to have violated this policy may be subject to disciplinary action, as deemed appropriate by management and Human Resources policies.

• Monitoring: The company employs appropriate technology solutions to monitor policy and procedure compliance.
• Self-Assessment: The CEO/CTO are required to conduct self-assessments within their areas of control to verify compliance with this policy and procedure.

Special Circumstances and Exceptions

All exceptions to this policy and procedure will require a waiver explicitly approved by one of Clu's CEO or CTO.