Privacy Policy

1. Introduction

Hire Synchronization Pvt Ltd (“Company”, “we”, “our”, “us”) operates AssetX, a platform designed to manage enterprise assets, procurement, finance, and related business operations. We are committed to protecting your privacy and ensuring that your personal and organizational data is handled responsibly and securely.

This policy complies with the Digital Personal Data Protection Act, 2023 (India), the Information Technology Act, 2000, IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and, where applicable, the General Data Protection Regulation (EU) 2016/679.

By using AssetX (the “Platform”), you agree to the practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Platform.

2. Information We Collect

We may collect the following categories of information:

a) Information You Provide Directly

• Personal Information: Name, email address, phone number, role/designation, login credentials, and billing details.
• Business Information: Company name, GST number, addresses, contracts, invoices, procurement data, and asset data.
• Contact Form Submissions: Name, email, phone number, company name, and message content submitted through our website contact or demo request forms.
• Waitlist Information: Email address and name when you sign up for product waitlists or early access.

b) Information Collected Automatically

• Usage Data: Log files, IP addresses, browser type, operating system, device identifiers, referring URLs, pages visited, and user activity within the Platform.
• Cookies & Tracking Technologies: Session cookies, analytics cookies (Google Analytics 4), and other tracking technologies to improve user experience and measure Platform performance.
• reCAPTCHA Data: Hardware and software information collected by Google reCAPTCHA to verify that you are not a bot when using our forms.

c) Information From Third Parties

• Analytics Providers: Aggregated and anonymized usage data from Google Analytics 4.
• Authentication Providers: Identity information when you use single sign-on (SSO) or third-party authentication to access the Platform.
• Business Partners: Information shared by your employer or organization when provisioning enterprise accounts.

3. How We Use Your Information

We use collected information for the following purposes and lawful bases:

• Provide, operate, and maintain the Platform — Lawful basis: Performance of contract (GDPR Art. 6(1)(b)); Consent (DPDP Act).
• Manage user accounts, subscriptions, and authentication — Lawful basis: Performance of contract (GDPR Art. 6(1)(b)).
• Process payments and invoices — Lawful basis: Performance of contract (GDPR Art. 6(1)(b)); Legal obligation (GDPR Art. 6(1)(c)).
• Improve performance, features, and user experience — Lawful basis: Legitimate interest (GDPR Art. 6(1)(f)).
• Website analytics via Google Analytics 4 (GA4) — We use GA4 to understand how visitors interact with our website. GA4 may collect anonymized usage data, including pages visited, session duration, and traffic sources. Lawful basis: Legitimate interest (GDPR Art. 6(1)(f)); Consent where required by applicable law.
• Bot protection via Google reCAPTCHA — We use Google reCAPTCHA on our forms to prevent spam and abuse. reCAPTCHA may collect hardware and software information, including device and application data, and send it to Google for analysis. Use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service. Lawful basis: Legitimate interest (GDPR Art. 6(1)(f)).
• Ensure compliance with applicable laws and regulations — Lawful basis: Legal obligation (GDPR Art. 6(1)(c)).
• Communicate with you regarding updates, security, and support — Lawful basis: Legitimate interest (GDPR Art. 6(1)(f)); Consent for marketing communications.
• Respond to your inquiries and contact form submissions — Lawful basis: Consent (GDPR Art. 6(1)(a)); Consent (DPDP Act).

4. Data Sharing & Disclosure

We do not sell or rent your personal data. We may share data only with:

• Service Providers: Cloud hosting, payment processors, communication tools, and analytics providers who process data on our behalf.
• Regulatory Authorities: Where legally required by government or law enforcement agencies.
• Business Transfers: In case of merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Specific Third-Party Processors

We use the following third-party service providers who may process your data:

• Google Analytics (GA4): Website analytics and usage tracking. Data may be processed in the United States and other countries where Google operates.
• Google reCAPTCHA: Bot detection and form spam prevention. Data is processed by Google LLC.
• Cloudflare: Content delivery network (CDN), DDoS protection, and DNS services. Data may be processed in Cloudflare's global network of data centres.
• Microsoft Azure: Cloud infrastructure and hosting services. Data is stored in Azure data centres as per our hosting configuration.

Cross-Border Data Transfers

Some of our third-party processors operate outside India and/or the European Economic Area (EEA). Where personal data is transferred to countries that may not provide an equivalent level of data protection, we ensure adequate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions by the European Commission, where applicable.
• Compliance with the data localization and cross-border transfer requirements under the DPDP Act, 2023, and any rules notified by the Central Government of India thereunder.

5. Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or misuse. These measures include, but are not limited to:

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest using industry-standard encryption algorithms.
• Access Control: Role-based access control (RBAC) ensures that only authorized personnel can access personal data, on a need-to-know basis.
• Secure Storage: Data is stored on secure cloud infrastructure (Microsoft Azure) with regular security assessments.
• Network Security: Firewalls, intrusion detection systems, and DDoS protection (via Cloudflare) safeguard our infrastructure.
• Regular Audits: We conduct periodic security reviews, vulnerability assessments, and penetration testing.
• Incident Response: We maintain a data breach response plan to promptly detect, report, and remediate any security incidents in compliance with applicable laws.

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. The specific retention periods are as follows:

• Contact Form Submissions: 2 years from the date of submission, unless you become a customer, in which case the data is retained as part of your customer record.
• Enterprise Customer Data: Duration of the contract plus 7 years thereafter, in compliance with the Companies Act, 2013 and other applicable statutory requirements.
• Analytics Data (GA4): 26 months (Google Analytics 4 default retention period). Anonymized and aggregated analytics data may be retained indefinitely.
• Waitlist Emails: Until product launch or 1 year from the date of sign-up, whichever is earlier. You may unsubscribe at any time.
• Cookies: Session cookies expire when you close your browser. Analytics cookies (e.g., _ga, _gid) are retained for up to 2 years. See the Cookies Policy section below for details.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymized. You may request earlier deletion of your data by contacting us at privacy@i-assetx.com.

7. Your Rights Under the Digital Personal Data Protection Act, 2023 (India)

If you are a Data Principal (as defined under the DPDP Act, 2023), you have the following rights:

• Right to Access Personal Data: You have the right to obtain a summary of the personal data being processed and the processing activities undertaken with respect to such data.
• Right to Correction of Inaccurate Data: You have the right to request correction of inaccurate or misleading personal data, and completion of incomplete personal data.
• Right to Erasure (Right to be Forgotten): You have the right to request erasure of your personal data where it is no longer necessary for the purpose for which it was collected, subject to applicable legal obligations.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw such consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal.
• Right to Grievance Redressal: You have the right to have your grievances addressed by our Grievance Officer. If unsatisfied with the resolution, you may file a complaint with the Data Protection Board of India.
• Right to Nominate: You have the right to nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.

How to exercise your rights: Submit your request by emailing privacy@i-assetx.com with the subject line “DPDP Rights Request”. Please include sufficient information to verify your identity.

Response time: We will respond to your request within 30 days of receipt.

8. Your Rights Under the General Data Protection Regulation (GDPR — EU/EEA Residents)

If you are located in the European Union or European Economic Area, you have the following rights under the GDPR:

• Right of Access (Art. 15): You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access the personal data and related information.
• Right to Rectification (Art. 16): You have the right to request rectification of inaccurate personal data and to have incomplete data completed.
• Right to Erasure (Art. 17): You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent.
• Right to Restriction of Processing (Art. 18): You have the right to request restriction of processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
• Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to Object (Art. 21): You have the right to object to the processing of your personal data based on legitimate interests, including profiling. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement.

How to exercise your rights: Submit your request by emailing privacy@i-assetx.com with the subject line “GDPR Rights Request”. Please include sufficient information to verify your identity and specify the right(s) you wish to exercise.

Response time: We will respond to your request within 30 days of receipt. In exceptional cases involving complex or numerous requests, this period may be extended by a further 60 days, in which case we will notify you of the extension and the reasons for the delay.

9. Cookies Policy

We use cookies and similar tracking technologies to enhance user experience, analyse performance, and understand how our Platform is used. Below is a detailed overview of the cookies we use:

a) Necessary Cookies

These cookies are essential for the Platform to function correctly. They enable core functionality such as authentication, session management, and security. These cookies cannot be disabled.

b) Analytics Cookies

We use Google Analytics 4 (GA4) to collect anonymized data about how visitors interact with our website. The following cookies are set by GA4:

• _ga: Used to distinguish unique users. Expires after 2 years.
• _ga_*: Used by GA4 to maintain session state. Expires after 2 years.
• _gid: Used to distinguish users. Expires after 24 hours.

c) Functional Cookies

These cookies enable enhanced functionality and personalization, such as remembering your language preference or region. They may be set by us or by third-party providers whose services we have added to our pages.

d) reCAPTCHA Cookies

Google reCAPTCHA may set cookies to verify that you are not a bot when interacting with forms on our Platform. These cookies are governed by Google's Privacy Policy.

Google Consent Mode v2

We implement Google Consent Mode v2 to adjust the behaviour of Google tags (including GA4) based on your cookie consent preferences. When you decline analytics cookies, Google tags will operate in a restricted mode that does not read or write cookies for analytics purposes, while still allowing basic, cookieless pings for modelling purposes in compliance with applicable regulations.

Managing Cookie Preferences

You can manage your cookie preferences at any time through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may limit the functionality of the Platform. You may also manage your preferences via our on-site cookie consent banner where available.

10. Third-Party Links

Our Platform may contain links to third-party websites or services. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party services you access through our Platform.

11. Children's Privacy

AssetX is a B2B platform intended for business use only. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have inadvertently collected personal data from a child under 18, we will take prompt steps to delete such data. If you believe that a child under 18 has provided us with personal data, please contact us at privacy@i-assetx.com.

12. Data Protection Officer / Grievance Officer

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Officer to address your concerns regarding the processing of your personal data.

Grievance Officer (DPDP Act / IT Act)

Name: Grievance Officer, Hire Synchronization Pvt Ltd
Email: privacy@i-assetx.com
Address: A708 ATS Bouquet, Sector 132, Noida, Uttar Pradesh - 201304, India
Response Time: Acknowledgment within 48 hours of receipt; resolution within 30 days.

If you are not satisfied with the resolution provided by the Grievance Officer, you may escalate your complaint to the Data Protection Board of India (under the DPDP Act, 2023) or to the appropriate supervisory authority in your jurisdiction.

13. Updates to Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, legal requirements, or other factors. Any material changes will be notified via email or Platform alerts, with the revised policy posted on our website. We encourage you to review this Privacy Policy regularly. Your continued use of the Platform after any changes constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

For questions, concerns, or privacy-related requests, please contact us:

Hire Synchronization Pvt Ltd

Registered Address:
K 14A, Balmiki Kunj, GZB, Ghaziabad Road, Ghaziabad, Uttar Pradesh, India

Corporate Address:
A708 ATS Bouquet, Sector 132, Noida, Uttar Pradesh - 201304, India

General Inquiries: connect@i-assetx.com
Privacy Requests: privacy@i-assetx.com
Phone: +91 8285559158