Privacy Policy
This Privacy Policy explains how ICCW India ("we", "us", "our") collects, uses, stores, and protects information when you use the Water Audit Tool ("Service"). By using the Service you agree to the practices described here.
1. Information We Collect
| Category | Examples | How collected |
|---|---|---|
| Account data | Name, email address, company name, password (hashed) | Registration form |
| Company profile | Industry type, location, number of areas, water sources | Setup wizard |
| Audit data | Water flow figures, node values, uploaded Excel files | Data upload & manual entry |
| Payment data | Plan type, payment date, PayU transaction ID | PayU payment gateway |
| Usage data | Pages visited, feature interactions, error logs | Server logs (automatic) |
We do not collect card numbers, bank account details, or UPI credentials — these are handled entirely by PayU and never reach our servers.
2. How We Use Your Information
- Provide, operate, and improve the Service
- Authenticate your identity and manage your account
- Process payments and send payment receipts
- Send transactional emails (OTP, password reset, plan expiry reminders)
- Respond to support enquiries
- Detect and prevent fraud, abuse, or security incidents
- Comply with legal obligations
We do not use your audit data to train machine learning models or sell it to any third party.
3. Legal Basis for Processing (GDPR / IT Act)
- Contract performance — processing necessary to provide the Service you signed up for
- Legitimate interests — security monitoring, fraud prevention, service improvement
- Legal obligation — compliance with Indian IT Act 2000 and applicable regulations
- Consent — marketing communications (you may withdraw at any time)
4. Data Sharing
We share data only with the following sub-processors, strictly for service delivery:
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway (Railway Corp.) | Application hosting & database | USA / EU |
| SendGrid (Twilio) | Transactional email delivery | USA |
| PayU | Payment processing | India |
We do not sell, rent, or share your personal data with advertisers or unrelated third parties.
5. Data Retention
- Account & audit data: retained while your account is active, deleted within 30 days of account deletion
- Payment records: retained for 7 years as required by Indian tax law
- Server logs: retained for 90 days, then automatically purged
6. Your Rights
Depending on your jurisdiction you may have the right to:
- Access — request a copy of the personal data we hold about you
- Correction — update inaccurate or incomplete data via Account & Billing
- Deletion — request erasure of your account and data (subject to legal retention)
- Portability — receive your audit data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — for any consent-based processing at any time
To exercise any right, email hip@iccwindia.org. We will respond within 30 days.
7. Cookies
We use only essential session cookies required for login and security. We do not use advertising or analytics cookies. A cookie preference notice is shown on your first visit.
8. Security
We protect your data using industry-standard measures including HTTPS encryption in transit, bcrypt password hashing, HMAC-verified webhook signatures, and rate-limited API endpoints. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.
9. Children's Privacy
The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided data, contact us and we will delete it promptly.
10. International Data Transfers
Your data may be transferred to and processed in countries outside India (e.g., USA for hosting and email). We ensure appropriate safeguards are in place through sub-processor agreements and standard contractual clauses where required.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email and display a notice on the Service at least 14 days before material changes take effect. The "Last updated" date at the top reflects the most recent revision.
12. Contact & Grievance Officer
For privacy-related questions, requests, or complaints:
ICCW India
Email: hip@iccwindia.org
We aim to respond within 30 days of receiving your request.