1. WHO WE ARE
Gretis India Private Limited provides managed ERP/ERP-related services, ERP implementation/configuration, payroll services delivered through the ERP environment, ESS/mobile application services supplied with that environment, website and mobile application development, software development, graphic/design services and consulting.
2. SCOPE
This Policy applies to personal data processed through Gretis websites, Portal, applications, support systems, project systems, billing processes and related services. It does not replace a Customer-specific DPA for personal data processed on behalf of a Customer.
3. OUR ROLE
Gretis may process some data for its own purposes, including account administration, billing, support, security, fraud prevention, legal compliance and operation of its services. Where a Customer uses Gretis to host or operate an ERP or other system containing employee, customer or business records, Gretis may process that data on the Customer’s behalf. The Customer determines the relevant business purposes and instructions for such Customer-controlled processing. Gretis personnel do not routinely inspect Customer records for their own purposes; access may occur where reasonably necessary for support, troubleshooting, security, maintenance, service delivery, legal compliance or an authorised Customer request.
4. DATA WE MAY PROCESS
Depending on the service: name, username, employee ID, contact details, account/authentication information, company/billing/tax data, projects, files, communications, support tickets, ERP records including HR/payroll/attendance/financial/customer/supplier/document records, location information where enabled, device/browser/OS/IP/log/crash/performance information, push tokens, dependent/nominee information and other data entered by Customers or Users.
5. PAYMENT DATA
Payments may be processed by Razorpay or another payment provider. Gretis does not intentionally store full card numbers, CVV, UPI PINs or other payment-instrument credentials on its own systems. Payment providers process payment information under their own terms and notices.
6. PURPOSES
We use personal data to provide Services; create accounts; process orders and payments; issue invoices; provide support; troubleshoot; maintain security; prevent fraud; send service, billing and security communications; improve reliability; comply with law; enforce agreements; and perform purposes disclosed at collection or otherwise permitted by applicable law. Where the Digital Personal Data Protection Act, 2023 and applicable provisions apply, Gretis will process personal data in accordance with the lawful basis and obligations applicable to the relevant role and activity.
7. CUSTOMER-CONTROLLED DATA
Customer Data is processed under Customer instructions and the DPA where applicable. Gretis does not sell Customer Data or use it for unrelated advertising.
8. LOCATION
Where enabled, Gretis applications may collect latitude, longitude, accuracy and timestamps for attendance/geofence or work events. Periodic location tracking, if enabled, is governed by the applicable service and Customer policy.
9. CHILDREN AND DEPENDANTS
Gretis does not intentionally market workforce-management services directly to children. Customer records may nevertheless contain information about children/dependants, such as nominees for employment benefits, insurance, tax or administrative purposes. Customers are responsible for lawful submission and any required consent/authorisation. Gretis processes such information only for the agreed Service or legal compliance.
10. COOKIES
Websites and the Portal may use cookies or similar technologies for authentication, security, preferences, analytics and service operation. Where consent is required, appropriate controls will be provided.
11. SHARING
Data may be shared with infrastructure/technology providers, payment providers such as Razorpay, service providers acting under instructions, authorised Customers, professional advisers, and authorities where legally required. Gretis does not sell personal data.
12. INFRASTRUCTURE AND LOCATION OF DATA
Gretis may use providers such as Hostinger and may use AWS or other providers in the future. Data may therefore be processed in jurisdictions determined by the selected provider and architecture. Gretis will apply contractual and organisational safeguards appropriate to the processing and applicable law.
13. SECURITY
Current architecture may include Ubuntu/Linux, Docker, CloudPanel, HTTPS/TLS, access controls, firewalling, monitoring and Cloudflare services, including Cloudflare Tunnel where appropriate. Controls may evolve. No system guarantees absolute security.
14. RETENTION
Retention depends on purpose and service. Customer Data is generally retained for the Service period, Customer instructions, legal obligations and the termination process. Customer-controlled data is generally available for export for 14 days after termination, subject to the DPA and Order. Legal, accounting, security and backup retention may continue where required or reasonably necessary.
15. RIGHTS
Subject to applicable law and the processing role, individuals may have rights concerning access, correction, updating, consent withdrawal, erasure and grievance redressal. Requests concerning Customer-controlled employment data should normally be directed first to the Customer/employer.
16. CONSENT WITHDRAWAL
Where processing is based on consent and withdrawal is legally available, contact support@gretisindia.com or use the method provided at collection. Withdrawal does not affect lawful processing already completed and may affect service availability.
17. INCIDENTS
Gretis maintains incident-response procedures. Processor incident notification and cooperation are governed by the DPA. Gretis will comply with legal notification obligations applicable to processing for which it is the responsible Data Fiduciary.
18. GRIEVANCE OFFICER
Designated Grievance Officer
Designation: Support Executive
Email: support@gretisindia.com
Postal address: Gretis India Private Limited, SCO 95, Sector 3, 134109, Panchkula, Haryana, India.
Privacy grievances may be submitted in writing to this contact. Gretis will handle grievances within periods required by applicable law.
19. DPA
Where required, Gretis and Customer will be bound by the Gretis DPA covering processing instructions, categories of data and data subjects, security, subprocessors, incident cooperation, export and deletion.
20. CHANGES
Gretis may update this Policy to reflect changes in law, services, security or processing. The effective date of each version will be stated and material changes will be communicated where required.
21. CONTACT
Gretis India Private Limited
SCO 95, Sector 3, 134109, Panchkula, Haryana, India