India: notice under the Digital Personal Data Protection Act, 2023

1. Who we are, and our role

Data Fiduciary for our own website, account, billing and marketing data: Bhoral LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States.

Data Processor for customer data: when a company connects its databases, files or tools to Bhoral BI, that company is the Data Fiduciary and we process the data on its behalf under our Data Processing Agreement. If your data is in a customer's workspace, contact that company first. We will help it respond.

2. Personal data we process and why

• Account and profile data (name, work email, company, role, sign-in identity): to create and run your account and give you the service.
• Billing data (company name, billing address, tax ID, invoices): to bill, and to meet tax and accounting law. Card details are handled by our payment provider.
• Contact and marketing data (name, email, messages, newsletter subscription): to answer enquiries and, only if you consent, to send product updates.
• Usage and technical data (IP address, device and browser, timestamps, logs): to secure, operate and troubleshoot the service.

We process this data on the basis of your consent or for the legitimate uses the DPDP Act permits, such as performing what you asked for or complying with law. The full list, with retention periods, is in our Privacy Policy.

3. Your rights as a Data Principal

• Access: a summary of the personal data we process about you, what processing we do, and who we have shared it with.
• Correction and completion: to correct inaccurate or misleading data, complete incomplete data, and update it.
• Erasure: to have your data erased unless we need to keep it for the purpose you gave it for or to comply with law.
• Grievance redressal: to have a complaint about our handling of your data or rights answered (section 6).
• Nominate: to nominate another person to exercise your rights if you die or become incapable.

You also have duties under the Act, including not to impersonate another person, not to suppress material information when giving data, and not to file false or frivolous complaints.

4. How to exercise your rights and withdraw consent

Use the in-app export and erasure tools under Settings, then Privacy, or email privacy@bhoral.com. See Privacy requests for the steps and timing. You may withdraw consent at any time, as easily as you gave it: unsubscribe from any email, or write to us. Withdrawal does not affect processing done before, and we will stop processing and delete the data unless the law requires us to keep it.

5. Customer data: the customer comes first

Where we act as Data Processor, the customer as Data Fiduciary decides how your data is used and is your first point of contact for any right or complaint. If you write to us, we will pass your request to the customer and tell you so.

6. Grievance Officer

If you are not satisfied, contact our Grievance Officer:

We acknowledge grievances and aim to respond within 30 days.

Please use this process first. If it does not resolve your complaint, you may complain to the Data Protection Board of India once it is operational, as the Act provides.

7. Children

Bhoral is a business service for people aged 18 or over. We do not knowingly process the personal data of children and do not offer the service to them. If you believe a child's data has reached us, write to us and we will delete it.

8. Processing outside India

Your personal data may be processed outside India. Our providers currently process data in the United States and the European Union, as listed on our Subprocessors page. We transfer data only to countries and recipients that the Indian Government has not restricted, and with the safeguards described in our Privacy Policy.

9. Personal data breaches

If a personal data breach affects you, we will notify the Data Protection Board of India and affected Data Principals in the form and time the Rules require. For customer data, we will notify the customer without undue delay so it can meet its own duties.

10. Status of this notice

The DPDP Rules come fully into operation on 13 May 2027. Until then this notice is provided voluntarily as readiness, and we may update it as the Rules and our own arrangements settle.