Privacy Policy

This Privacy Policy explains how UR Technology & Computers Pvt Ltd (“we”, “us”, “our”) collects, uses, stores, shares and protects personal data when you visit our website at kuzhu.in (the “Website”) or use the Kuzhu human resource management platform, including its web application and mobile apps (together, the “Service”).

We have written this policy to comply with the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Please read it together with our Terms of Use, Cookie Policy and Refund & Cancellation Policy.

1. Who we are, and our role

We play two roles, and which one applies depends on whose data it is:

• As a Data Fiduciary (controller). For people who visit the Website, request a demo, contact us, sign up for an account, or pay for a subscription, we decide why and how that data is used, and we are responsible for it.
• As a Data Processor. For the employee and HR data that a customer organisation (“Customer”) puts into its Kuzhu workspace, the Customer is the Data Fiduciary. We process that data only on the Customer’s instructions and under our agreement with them. If you are an employee using Kuzhu through your employer, your employer decides what is collected about you and why.

2. What personal data we collect

2.1 Data you give us on the Website

• Demo and contact requests: name, work email, phone number, company name, company headcount and any message you write.
• Account sign-up: name, email, phone number, company name, the workspace address you choose, and a password (stored only as a one-way hash).
• Billing: billing contact, billing address, GSTIN and invoice history. Card, UPI and bank details are entered directly with our payment gateway; we do not see or store full card numbers.
• Support: the contents of emails, tickets and calls you send us, and any attachments.

2.2 Data collected automatically on the Website

• Technical data: IP address, browser type, device type, operating system, pages visited, referring page and the date and time of the visit.
• Anti-spam data: our forms use Google reCAPTCHA to tell people from bots. reCAPTCHA collects hardware and software information and sends it to Google for analysis, under Google’s Privacy Policy and Terms of Service.
• Cookies: described in our Cookie Policy. We do not use advertising cookies or cross-site tracking.

2.3 Data Customers put into the Service

Depending on the modules a Customer uses, their workspace may hold data about their employees, candidates and contractors, including:

• Identity and contact: name, employee ID, photograph, date of birth, gender, personal and work contact details, address, emergency contacts.
• Employment: designation, department, reporting line, joining and exit dates, job history, performance records, letters and documents.
• Payroll and statutory: salary, deductions, bonuses, reimbursements, bank account details, PAN, Aadhaar (where the Customer chooses to record it), UAN, ESIC number, tax declarations and payslips.
• Attendance and leave: check-in and check-out times, leave balances and requests, shift rosters.
• Recruitment: CVs, application details, interview notes, offers.

Some of this, such as financial information and bank account details, is “sensitive personal data or information” under the 2011 Rules. We process it only to provide the Service to the Customer.

2.4 Data collected by the Kuzhu mobile app

• Location: if your employer turns on location-based attendance, the app reads your device location at the moment you check in or out so the check-in can be verified. The app asks for permission first, and you can withdraw it in your device settings. We do not track your location in the background.
• Camera and photos: used only when you choose to take or attach a picture, for example a profile photo or a receipt for a reimbursement claim.
• Notifications: if you allow them, we store a push-notification token for your device so we can send you alerts such as leave approvals and payslip availability. Notifications are delivered through Google Firebase Cloud Messaging.
• Device and diagnostic data: app version, device model, operating system version and crash reports, used to keep the app working and to tell you when an update is required.

3. Why we use it, and on what basis

What we do not do: we do not sell personal data. We do not use Customer data for advertising. We do not use Customer or employee data to train artificial-intelligence models or to build products for anyone else.

4. Who we share it with

We share personal data only with the following, and only what each one needs:

• Service providers (sub-processors) who help us run the Service, under written contracts that require them to protect the data and use it only for us:
  • Cloud hosting and storage — AWS, Hostinger
  • Email delivery — Twilio, Zoho
  • SMS and WhatsApp messaging — JioCX SMS, Twilio, Meta, Fast2SMS
  • Payment processing — Razorpay
  • Push notifications and spam protection — Google (Firebase Cloud Messaging, reCAPTCHA)
• Your own organisation. Data in a workspace is visible to the users the Customer has given access to, according to the roles and permissions the Customer sets.
• Authorities. Government bodies, courts or law-enforcement agencies, when the law requires it. Where the law allows, we will tell the affected Customer first.
• A buyer or successor. If our business is merged, acquired or sold, personal data may pass to the new owner, who will remain bound by this policy.

A current list of sub-processors is available on request from hello@kuzhu.in.

5. Where it is stored

Personal data is stored on servers located in India. Each Customer’s workspace has its own separate database, rather than sharing tables with other Customers. Some of our service providers (for example Google, for notifications and spam protection) may process limited data outside India. Where that happens, we transfer data only to countries not restricted by the Government of India under Section 16 of the DPDP Act, and with contractual safeguards in place.

6. How long we keep it

• Demo and contact enquiries: 2 years from your last contact with us, unless you ask us to delete them sooner.
• Customer workspace data: for as long as the subscription is active, and for 90 days after it ends so that an accidental cancellation can be reversed and the Customer can export their data. After that it is permanently deleted, including from backups on their normal rotation.
• Billing records and invoices: 8 years, as required by Indian tax and accounting law.
• Security logs: up to 1 year, unless needed longer to investigate an incident.

Within a workspace, the Customer may set its own retention periods, for example for attendance location data. Those settings apply to that Customer’s data.

7. How we protect it

• All traffic to the Website and the Service is encrypted in transit using TLS (HTTPS).
• Passwords are stored only as salted one-way hashes. Integration credentials and other secrets are encrypted at rest.
• Each Customer’s data sits in its own database, separated from every other Customer.
• Access inside a workspace is controlled by roles and permissions the Customer sets, with optional multi-factor sign-in.
• Access to production systems is limited to the staff who operate them, and that access is logged.
• Data is backed up regularly.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and the affected Data Principals as the DPDP Act requires, and report to CERT-In where the law requires it. For Customer data, we will tell the affected Customer without undue delay so they can meet their own obligations.

8. Your rights

Under the DPDP Act you have the right to:

• Access: get a summary of the personal data we hold about you and how we use it, and the identities of those we have shared it with.
• Correction and completion: have inaccurate or incomplete data corrected, and outdated data updated.
• Erasure: have your data deleted when it is no longer needed, unless we must keep it by law.
• Withdraw consent: where we rely on your consent, withdraw it at any time. This is as easy as giving it, and does not affect anything we lawfully did before.
• Grievance redressal: complain to our Grievance Officer (section 11), and, if you are not satisfied, to the Data Protection Board of India.
• Nominate: name another person to exercise these rights for you in the event of your death or incapacity.

To use any of these rights, write to hello@kuzhu.in. We may need to verify your identity first. We will respond within 30 days.

If you are an employee of one of our Customers, your employer controls your HR data. Please send your request to your HR team first. If you contact us directly, we will pass your request to your employer and help them action it.

9. Children

The Website and the Service are meant for businesses and working adults. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a child has given us personal data, contact us and we will delete it. Where a Customer lawfully employs or engages someone under 18, the Customer is responsible for obtaining verifiable parental consent as the DPDP Act requires.

10. Links to other websites

The Website may link to websites we do not run. This policy does not cover them. Please read their privacy policies before giving them any personal data.

11. Grievance Officer

In line with the Information Technology Act, 2000, the rules made under it, and the DPDP Act, our Grievance Officer is:

Bishwjeet Kumar
Chief Technical Officer (CTO)
UR Technology & Computers Pvt Ltd
611, 6th Floor, City Centre, Udaipur, Rajasthan 313001, India
Email: grievance@kuzhu.in
Phone: +91 82093 73274 (Monday to Friday, 10:00–18:00 IST)

We will acknowledge a grievance within 24 hours, and resolve it within 15 days of receiving it.

12. Changes to this policy

We may update this policy as the Service or the law changes. We will change the “Last updated” date at the top. If a change materially affects how we use your personal data, we will tell Customers by email or in the product at least 30 days before it takes effect. Where a change needs your consent, we will ask for it.

13. Contact us

For any question about this policy or your personal data, write to hello@kuzhu.in, and a person will reply.

UR Technology & Computers Pvt Ltd
611, 6th Floor, City Centre, Udaipur, Rajasthan 313001, India
Udaipur, Rajasthan, India
CIN: U62011RJ2023PTC089580