1.Who we are and what this notice covers
[Registered legal entity name] ("AOZO", "we", "us") runs the AOZO website and the AOZO apps: CRM, Helpdesk, Projects, Accounting, Teams (HRMS) and Hubble. Our registered office is at [Registered office address], India.
This notice is given under Section 5 of the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it. It explains what personal data we process, why we process it, how you can exercise your rights and how to complain.
We play two different roles, and it matters which one applies to you:
- Data Fiduciary: for personal data about visitors to our website, people who create an AOZO account, and people who contact us. We decide why and how that data is processed.
- Data Processor: for the content that our customers put into their workspaces, such as CRM contacts, helpdesk requesters, employee and payroll records. Our customer decides why and how that data is processed, and we process it only on their instructions. See the Data Processing Addendum.
This notice is available in English. You may ask us for a copy in any of the languages listed in the Eighth Schedule to the Constitution of India by writing to privacy@aozo.in.
2.Personal data we collect
We collect only what we need for the purposes in section 3. This is an itemised list of what that includes:
| Category | Examples | Where it comes from |
|---|---|---|
| Account and identity | Name, work email, phone number, password (stored in hashed form), workspace role | You, or the workspace admin who invites you |
| Sign-in and security | Two-factor settings, passkey public credentials, sign-in activity, IP address, device and browser type | You and your device, automatically |
| Organisation and billing | Organisation name, GSTIN, billing address, selected plans, invoices and payment status | You or your organisation admin |
| Support and communications | Messages you send us, tickets, call or meeting notes, partner or sales enquiries | You |
| Usage and device data | Pages visited, features used, error and performance logs | Automatically, through your use of the services |
We do not store full payment card numbers. Payments are handled by our payment service provider.
We do not ask for sensitive details such as biometric templates. If you use a passkey, your device performs the biometric check locally, and we only receive a public credential.
3.Why we process your data
We process personal data only for the specific purposes below, and only on a ground that the DPDP Act allows: your consent (Section 6) or a legitimate use (Section 7).
| Purpose | Ground under the DPDP Act |
|---|---|
| Create and run your account and workspace, and provide the apps you subscribe to | Consent given at sign-up; and legitimate use for data you voluntarily provide for this purpose (Section 7(a)) |
| Authenticate you and keep accounts secure, including detecting fraud and abuse | Consent; legitimate use where needed to prevent fraud or protect the service |
| Billing, GST invoicing, tax and accounting records | Legitimate use: compliance with a law in force (Section 7(c)); consent |
| Customer support and responding to your requests | Consent; legitimate use for data you voluntarily provide |
| Service notices, security alerts and policy updates | Legitimate use / consent |
| Product improvement, analytics and feedback | Consent, which you can refuse or withdraw |
| Product news, offers and marketing messages | Consent, which you can refuse or withdraw at any time |
| Respond to legal obligations, court orders and lawful requests | Legitimate use (Section 7) |
We will not use your data for a new purpose unless we tell you and, where the law requires, ask for your consent again.
4.Your consent and how to withdraw it
Where we rely on consent, we ask for it with a clear, affirmative action, such as an unticked checkbox. Consent is specific to a purpose, and we ask separately for optional purposes like marketing. Refusing an optional purpose will not stop you from using the core service.
You can withdraw consent at any time, and withdrawing is meant to be as easy as giving it:
- Change your preferences in your AOZO account settings, or use the unsubscribe link in any marketing message.
- Or write to privacy@aozo.in and we will act on it.
If you withdraw consent for something the service needs to work, we may no longer be able to provide that part of the service, and we will tell you so. Withdrawal does not affect processing we did lawfully before you withdrew. After withdrawal we stop processing and delete your data, unless the law requires us to keep it.
5.Customer content in workspaces
Workspace content, such as leads, tickets, project tasks, invoices, attendance and payroll records, belongs to the customer that created the workspace. We process it only to provide the services and on the customer's documented instructions.
That customer is responsible for having a valid ground to process the data and for giving its own notices to the people in it. We help our customers meet requests from those people, as described in the Data Processing Addendum.
7.Transfers outside India
Some of our providers may store or process data outside India. The DPDP Act allows this except to countries the Central Government restricts by notification. We will not transfer personal data to any restricted country, and we require our providers to apply appropriate safeguards.
8.How long we keep data
We keep personal data only while it is needed for the purpose it was collected for, and then erase it or make it anonymous.
- Account data: for as long as your account is active.
- After you close your account or withdraw consent: we delete it, except for what we must keep by law, such as invoices and tax records.
- Backups: deleted data leaves our backups on their normal rotation cycle.
- Inactive accounts: we may notify you and then delete the account after a reasonable period of inactivity.
9.How we protect your data
We apply reasonable security safeguards to prevent personal data breaches, as the DPDP Act requires. These include encryption of data in transit, role-based access control, optional two-factor sign-in (email OTP, authenticator app and passkeys), activity logs, and limiting staff access to what their work requires.
No system is perfectly secure. You can help by using a strong password, turning on two-factor sign-in and not sharing your credentials. See our Security page for more.
10.If something goes wrong
If there is a personal data breach affecting data we are responsible for, we will inform the Data Protection Board of India and the affected people in the form and time required by law. If it affects customer content, we will notify the customer without undue delay so that it can meet its own duties.
11.Children
AOZO is built for businesses and is not meant for anyone under 18. We do not knowingly collect a child's personal data. If a parent or guardian tells us we have, we will delete it.
Where a customer's workspace holds data about a child, the customer is responsible for getting verifiable parental or guardian consent as the DPDP Act requires. We do not track or monitor the behaviour of children, and we do not show targeted advertising to them.
12.Your rights
As a Data Principal, you have the right to:
- Access: get a summary of the personal data we process about you, the processing we do, and the other parties we have shared it with.
- Correction, completion and updating: have inaccurate or incomplete data fixed.
- Erasure: ask us to erase your data, unless we need to keep it for a lawful purpose.
- Withdraw consent: at any time, as explained above.
- Grievance redressal: have your complaint heard and answered.
- Nominate: name another person to exercise your rights if you die or become unable to do so.
To use any of these, write to privacy@aozo.in. We may need to verify who you are first. Full details, including how long we take and what to include, are on our Data Rights & Grievance page.
13.Grievances and complaints
If you have a concern, contact our Grievance Officer and Data Protection contact: [Name of Grievance Officer], at grievance@aozo.in, or by post to [Registered office address], India.
We will acknowledge your complaint promptly and resolve it within the time the DPDP Rules prescribe. If you are not satisfied, or do not hear from us in time, you may complain to the Data Protection Board of India. The Board will usually expect you to have used our grievance process first.
15.Changes to this notice
We may update this notice when our practices or the law change. We will post the new version here with a new date. If a change is significant, or if we need fresh consent, we will tell you directly before it applies.
16.Contact us
- Privacy and data requests: privacy@aozo.in
- Grievance Officer: [Name of Grievance Officer], grievance@aozo.in
- General: hello@aozo.in
- Post: [Registered legal entity name], [Registered office address], India