Privacy Policy

Last Updated: [Date]

Avallark Services LLP ("we," "us," or "our") operates POSHready, a SaaS-based POSH (Prevention of Sexual Harassment) compliance portal accessible at poshready.org ("Service"). This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our Service.

1. Information We Collect

We collect and process the following categories of personal information:

• Employee Information: Name, email address, phone number, employee ID, department, designation, and training status
• Account Information: Login credentials, user roles, and access permissions
• Complaint Data: Information related to sexual harassment complaints, investigations, and case management as defined under the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013
• Training Records: POSH training completion status, certificates, and assessment results
• Technical Data: IP addresses, browser information, device identifiers, and usage analytics

2. Data Privacy and Access Controls

2.1 Organizational Data Privacy

All data stored on POSHready is strictly private and accessible only within your organization. We implement Role-Based Access Control (RBAC) to ensure that users can only access information relevant to their designated roles and responsibilities.

2.2 Complaint Data Confidentiality

In strict compliance with the POSH Act, 2013, complaint and case-related data is maintained with the highest level of confidentiality. Such information is accessible only to:

• Members of the Internal Complaints Committee (ICC)
• Authorized personnel directly involved in the complaint resolution process
• Individuals specifically designated by the ICC for case management purposes

2.3 Employee Data Access

Employee personal information, including names, email addresses, phone numbers, and training status, is visible only to:

• Company administrators with appropriate authorization
• HR personnel with designated access rights
• The individual employee regarding their own data

3. Data Usage and Purpose

We process your personal information for the following purposes:

• Facilitating POSH Act compliance and reporting requirements
• Managing sexual harassment complaints and investigations
• Conducting and tracking POSH training programs
• Generating compliance reports and analytics
• Maintaining audit trails as required by law
• Providing customer support and technical assistance

4. Data Sharing and Disclosure

We do not share, sell, or disclose your personal information to third parties, except in the following circumstances:

• Legal Requirements: When required to comply with applicable Indian laws, regulations, legal processes, or governmental requests
• POSH Act Compliance: When disclosure is mandated under the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013
• Court Orders: In response to valid court orders, subpoenas, or other legal processes
• Emergency Situations: To protect the rights, property, or safety of individuals or organizations

Any such disclosure will be limited to the minimum information necessary and will be conducted in accordance with applicable data protection laws.

5. Data Security

We implement comprehensive security measures to protect your personal information:

• Encryption: All data is encrypted both in transit and at rest using industry-standard encryption protocols
• Access Controls: Multi-factor authentication and role-based access controls restrict unauthorized access
• Security Monitoring: Continuous monitoring for security threats and vulnerabilities
• Data Backup: Regular encrypted backups stored in secure, geographically distributed locations
• Infrastructure Security: Secure cloud infrastructure with regular security audits and compliance certifications

6. Data Retention

In accordance with the POSH Act, 2013, we retain complaint and case-related data for a minimum period of three (3) years from the date of resolution. Other personal information is retained for the duration of your organization's subscription and for such additional period as may be required by applicable law.

Upon expiry of the retention period, data will be securely deleted unless:

• Extended retention is required by law
• Data is subject to ongoing legal proceedings
• Regulatory authorities require preservation of specific records

7. User Rights

Subject to applicable laws and regulatory requirements, you have the following rights:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Data Portability: Request transfer of your data in a structured, machine-readable format
• Objection: Object to processing of your personal information in certain circumstances

Please note that data deletion requests may be subject to legal retention requirements under the POSH Act and other applicable laws.

8. Cookies and Tracking Technologies

POSHready uses cookies solely for essential session management purposes. These cookies are necessary for the proper functioning of the Service and include:

• Session authentication tokens
• Security cookies for fraud prevention
• Functional cookies for user preference storage

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. Users can manage cookie preferences through their browser settings, though disabling essential cookies may affect Service functionality.

9. POSH Act Compliance

POSHready is designed to ensure full compliance with the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013. We strictly adhere to:

• Confidentiality requirements for complaint handling
• Prescribed timelines for complaint resolution
• Mandatory reporting and documentation standards
• Data protection obligations specific to sensitive personal information

10. Data Transfers

Your data is stored and processed within India or in jurisdictions that provide adequate data protection as recognized under Indian law. Any international data transfers are conducted with appropriate safeguards and in compliance with applicable data protection regulations.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify users of material changes through the Service interface or via email. Continued use of the Service after such notification constitutes acceptance of the updated Privacy Policy.

12. Children's Privacy

POSHready is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly.

13. Contact Information

For questions, concerns, or requests related to this Privacy Policy or your personal information, please contact us at:

Avallark Services LLP
Email: [email protected]
Subject Line: Privacy Policy Inquiry

We are committed to addressing your privacy concerns promptly and will respond to all inquiries within a reasonable timeframe as required by applicable law.

14. Governing Law

This Privacy Policy is governed by the laws of India, including but not limited to the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013.