ESTROME DAP LEGAL

Privacy Policy

This policy explains how Estrome Technologies (OPC) Private Limited handles personal data in connection with Estrome DAP. For Customer-controlled asset and workforce records, the Customer determines why the data is used and Estrome processes it to deliver DAP.

1. Data We Collect

• Registration and identity data, including name, business email, company and role.
• Subscription, invoice and payment references. Complete card or bank credentials are processed by the payment provider and are not stored by DAP.
• Account-security data, such as password hashes, MFA state, sessions, OTP verification records, acceptance evidence, IP address and user agent.
• Customer content, including asset, location, vendor, service, document and audit records entered by authorised users.
• Operational logs, diagnostic events and security alerts.

2. Why We Use Data

We use data to verify registration, create and administer isolated workspaces, provide subscribed functionality, authenticate users, prevent fraud and abuse, process billing, provide support, maintain auditability, secure the platform, comply with law and improve reliability.

3. Sharing

We disclose data only to authorised Customer users, vetted service providers needed for hosting, email, payments, mapping, support or security, professional advisers under confidentiality, and authorities where legally required. We do not sell personal data.

4. Retention

Account and Customer data is retained while the subscription is active. If workspace access is suspended for non-renewal after the 7-day grace period, company operational data is retained for six calendar months from the suspension date. Verified, activated renewal within that period restores access to the retained data. If renewal is not activated by the end of that period, operational data is scheduled for permanent deletion, with advance notices to the registered Company Admin and billing email. Subscription invoices, payment references and records needed for tax, audit, security, dispute resolution or legal obligations follow separate retention requirements. See the Subscription Terms for renewal and recovery details. Expired OTPs and temporary authentication records may be deleted sooner. Backup copies expire through controlled retention cycles.

Document Preservation And Archives

Original uploaded documents are preserved while the subscription is active. Older, closed records may be archived after 180 days without access; archived documents remain accessible to authorised users. Deleting an attachment moves it to a recovery bin for 30 days before it becomes eligible for permanent deletion. Retention holds prevent deletion. Abandoned temporary uploads are eligible for cleanup after 30 days only after confirming they are not referenced by saved records or retained evidence. Archive storage is separate from backups. Off-server storage is enabled only after the storage service is configured and verified. Retention expiry includes advance notices and a deletion review; tax, audit, dispute and legal holds take precedence.

5. Security And Tenant Separation

DAP uses role-based access, tenant-scoped database controls, encryption in transit, restricted administrative access, malware scanning, monitoring and backups. Customers must manage their users, roles and exported data responsibly.

6. Your Choices And Rights

Subject to applicable law and the Customer’s administrative authority, individuals may request access, correction, updating or erasure of their personal data, withdraw consent where consent is the basis of processing, or raise a grievance. Requests should identify the relevant Customer workspace and be sent to info@estrome.com. We may verify identity before acting.

7. International Processing

Service providers may process data from locations permitted by applicable law and contractual safeguards. Customers with specific localisation requirements should obtain written confirmation before uploading regulated data.

8. Children

DAP is a business service and is not intended for children. Customers must not use it to collect children’s personal data unless they have a lawful and documented basis.

9. Updates And Grievance Contact

Material updates will carry a new version and effective date. Privacy and grievance requests may be sent to info@estrome.com, Estrome Technologies (OPC) Private Limited, Sultanpur Road, Lucknow, Uttar Pradesh, India.