Privacy policy

ViXR India Private Limited, CIN [CIN], with its registered office at 7 & 8, 2nd Floor, 27th Main, HSR Sector 1, Bengaluru, Karnataka 560 102 ("we", "us"), operates PermitWiseAI. Under the Digital Personal Data Protection Act, 2023 ("DPDP Act") we act in two different capacities:

• As Data Fiduciaryfor personal data we collect for our own purposes: visitors to this website, people who request access, and the contact details of the people who manage our customers' accounts.
• As Data Processor for everything our customers put into PermitWiseAI: permits, workforce records, isolation evidence, incident reports and the like ("Customer Data"). The customer organisation, usually your employer or the site owner, is the Data Fiduciary for that data and decides why and how it is processed. We process it only on their documented instructions.

If you use PermitWiseAI through your employer or a site you work at, please send requests about your Customer Data to that organisation first. We will help them respond.

• Access requests: your name, work email, company, and, if you give them, your phone number, job title, number of sites and message.
• Account data: name, email address, role, department, profile photo and sign-in history for each user an organisation invites.
• Operational records within Customer Data: names and roles recorded on permits, approvals and rejections with their reasons, time-stamped progress entries, gas-test readings, photographs taken as isolation or work evidence, and incident and near-miss reports, which may include descriptions of injuries.
• Technical data: IP address, browser and device information, and security and audit logs of actions taken in the service.

• To respond to your access request and set up your organisation, based on your consent.
• To provide, secure and support the service for the customer that invited you.
• To keep the audit trail that makes a permit record trustworthy.
• To send service messages such as invitations, approval requests and expiry reminders.
• To comply with law, court orders and directions from authorities, which are legitimate uses under section 7 of the DPDP Act.

We do not sell personal data, and we do not use Customer Data to advertise to anyone.

• Authorised users of the same organisation, according to the roles the organisation assigns.
• Service providers who host the service, store files and deliver email for us, bound by contract to process data only on our instructions and to protect it. [List of sub-processors, or a link to it.]
• Authorities, where the law requires it, for example an accident report a customer is obliged to file.

Data is stored in India. If data is transferred outside India, it will only go to countries not restricted by the Central Government under section 16 of the DPDP Act, and under safeguards no weaker than those described here.

• Access requests that do not become customers are deleted [12 months] after our last contact.
• Customer Data is kept for the subscription term and deleted within [90 days] after it ends, unless the customer asks us to export it first. Customers remain responsible for any statutory period they must keep safety records for.
• Security logs are kept for at least 180 days, as required by the CERT-In directions of 28 April 2022.
• Where you withdraw consent, or the purpose is no longer served, we erase the data unless the law requires us to keep it.

We apply reasonable security safeguards as required by section 8(5) of the DPDP Act, including encryption in transit, single sign-on, role-based access checked on the server for every action, separation of each organisation's data, and audit logging.

If a personal data breach occurs, we will notify the Data Protection Board of India and the affected people as the DPDP Act and its rules require, notify CERT-In within six hours of noticing a reportable cyber incident, and support our customers with their own notifications.

Under the DPDP Act you can:

• ask for a summary of the personal data we process about you and who we shared it with;
• ask us to correct, complete, update or erase it;
• withdraw your consent at any time, as easily as you gave it;
• nominate another person to exercise your rights if you die or become incapacitated;
• have your grievances addressed by our Grievance Officer.

Withdrawing consent does not affect processing that already took place. For data held as Customer Data, we will pass your request to the organisation responsible for it.

PermitWiseAI is a workplace tool and is not meant for anyone under 18. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

Privacy questions: info@permitwiseai.cloud

Grievance Officer: [Name of Grievance Officer], info@permitwiseai.cloud, 7 & 8, 2nd Floor, 27th Main, HSR Sector 1, Bengaluru, Karnataka 560 102. We respond within the period prescribed under the DPDP Rules. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We will post any change on this page and update the date at the top. If a change affects how we use data you consented to, we will ask for your consent again. See also our cookie policy and terms and conditions.