Privacy policy

Who we are

Genbays Software Private Limited is a company registered in India with its registered office in Tamil Nadu. For this website and for our own business contacts we are the Data Fiduciary under India's Digital Personal Data Protection Act 2023.

When we build or run software for a client, the client decides what is collected and why. For that data we are a Data Processor, and the data processing agreement applies instead of most of this policy. Using the site itself is covered by the terms of use.

Questions, requests and complaints about personal data go to [email protected] with the subject line Privacy request, or by post to the registered office.

What we collect and why

We collect as little as we can. Most visitors give us nothing.

We don't ask for or want special-category data (health, religion, biometrics and the like) through this site. If a client project involves it, the project's DPA and a written data map cover it before we see any.

We don't profile you, score you, or make automated decisions about you.

How long we keep it

If you ask us to delete your details earlier, we will, unless a law says we must keep a specific record. Then we keep only that record and tell you which one.

Messages and connected services

If you give us a phone number, we use it to reply about your enquiry on WhatsApp or by phone, and for nothing else. We don't add you to a broadcast list, and we don't message you about anything you didn't ask about.

Our WhatsApp messages go through the WhatsApp Business Platform, which Meta Platforms runs for businesses through its Cloud API. To carry a message, Meta handles your number, the message content and its delivery status on Meta's servers, under the WhatsApp Business Data Processing Terms. Messages are encrypted between your phone and Meta's servers. Meta says it deletes a message from its servers once it's delivered and holds an undelivered one for up to 30 days. Your own use of WhatsApp is covered by WhatsApp's privacy policy, which we don't control.

Meta lets us start a conversation only with a message it has approved in advance, and only with people who have given us their number. If you message us first, we can reply freely for 24 hours, after which we need an approved message to continue. Reply Stop to any message and we won't message you on WhatsApp again.

A copy of each conversation is kept in our own systems for the same 24 months as the enquiry it belongs to, so the person who takes your call has read what you wrote.

Other services we connect by API, such as the ones that send our email, book the workflow-review slot or take a payment, see only the data needed for that one task, and none of them get your data for their own use. Each is named on the sub-processor page with its purpose and region before it goes live.

Who we share it with

Nobody, for money. We don't sell personal data, we don't rent it, and we don't run advertising pixels.

We do use a short list of service providers to host this site, store form submissions, send email, carry WhatsApp messages and count visits. Each one is named on the sub-processor page with its purpose and the region where it holds data. Form submissions from this site go to a database in Mumbai, India.

We'd disclose data if a court or regulator with jurisdiction over us required it, and we'd tell you unless the law forbade it. If Genbays were ever sold or merged, your data would move with the business under this same policy.

India

This section is the notice required by the Digital Personal Data Protection Act 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.

You are the Data Principal. We are the Data Fiduciary for the data listed above. We process it for the purposes listed above and no others. Where we rely on your consent, you can withdraw it as easily as you gave it: send one email. Withdrawal doesn't affect what was done before it, and we'll stop within 7 days.

You have the right to know what we hold about you and how we've used it, to have it corrected, completed or updated, to have it erased once the purpose is served, to have a grievance heard, and to nominate a person who can exercise these rights for you if you die or are incapacitated. Your privacy choices says what to put in the email and how long each request takes.

We acknowledge every complaint within 48 hours and resolve it within 30 days. If you're not satisfied, you can complain to the Data Protection Board of India once it is taking complaints.

You can ask for this policy in any language listed in the Eighth Schedule to the Constitution. Write to us and we'll send a translation. For large print or another format, see the accessibility statement.

Children

This site is for businesses. We don't knowingly collect data from anyone under 18. If you think a child has sent us something, tell us and we'll delete it.

Some clients, such as schools, hold children's data in the software we build. There we act only on the client's instructions, the client obtains any parental consent the law needs, and the DPA names the safeguards. We don't use children's data for tracking, advertising or profiling, and we won't build software that does.

Security

Access to your data is limited to the people who need it for the work, under written confidentiality terms. Data is encrypted in transit and at rest with our providers. Accounts use multi-factor authentication. Our practices are described on the trust page, and we describe only what we do, not what we're planning.

If a breach affects your data, we'll tell you without delay, and in any case within 48 hours of confirming it, with what happened, what it means for you and what we're doing. We report to the Data Protection Board of India and other regulators within the windows they set.

Changes to this policy

Each version carries a number and a date at the foot of the page, and we keep earlier versions. If a change affects what we do with data we already hold, we'll email everyone it concerns before it takes effect. Small wording changes we just post. Every other policy we publish is listed on the legal page.