Legal

Data Privacy and DPDP Notice

Effective 17 October 2026. Applies to all Vyntez products.

This notice is given under section 5 of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and Rule 3 of the Digital Personal Data Protection Rules, 2025. It tells you, in clear terms, what personal data Vyntez processes, for what purpose, how to withdraw consent, how to use your rights and how to complain to the Data Protection Board of India. It also sets out the Data Processing Terms that apply when businesses use our Services to handle their own people's data. Read it with the Privacy Policy.

1. Data Fiduciary

Vyntez Solutions Private Limited, Sindhora Road, Varanasi, Uttar Pradesh 221001, India, is the Data Fiduciary for the personal data it processes for its own purposes. Vyntez has not been notified as a Significant Data Fiduciary; if it is, it will appoint a Data Protection Officer based in India and publish the details here.

2. Itemised data and purposes

Account details (name, email, phone, password hash): to create and secure your account and contact you about the Services.
Billing details (billing name, address, GSTIN, payment status): to bill you, issue GST invoices and meet tax law.
Usage and device data (IP address, device, logs): to keep the Services secure, fix problems and prevent fraud.
Content you submit (emails, messages, posts, files, AI prompts, bookings, health records): to provide the specific feature you use.
Location, selfie and face template in Vyntez People: to confirm attendance for your employer, only when your employer has turned these checks on.
Marketing preferences: to send updates you asked for.
We collect only what each purpose needs (data minimisation), and we do not use your data for a new purpose without telling you and, where needed, asking for consent again.

4. Your rights as a Data Principal

Right to information (section 11): a summary of the personal data we process and the processing activities, and the identities of other Data Fiduciaries and Processors we have shared it with, with a description of what was shared.
Right to correction and erasure (section 12): correction of inaccurate or misleading data, completion of incomplete data, updating, and erasure of data no longer needed for the purpose, unless the law requires us to keep it.
Right to grievance redressal (section 13): a response from our Grievance Officer within 90 days at the latest; we aim to resolve complaints within 15 days.
Right to nominate (section 14): you may nominate another person to exercise your rights if you die or become unable to act. Send the nominee's name and contact details to the Grievance Officer.
How to make a request: email the Grievance Officer from your account email, or use the in-product privacy settings. We may ask for information to verify your identity. If an employer or other business manages your data in our Services, we forward your request to it and support its response.
Your duties (section 15): comply with the law, do not impersonate anyone, do not suppress material information, and do not file false or frivolous complaints; the Board may impose a penalty of up to ₹10,000 for breach of these duties.

5. Grievance Officer and the Data Protection Board

Grievance Officer, Vyntez Solutions Private Limited, Sindhora Road, Varanasi, Uttar Pradesh 221001, India. Email: grievance@vyntez.com (Monday to Friday, 10:00 to 18:00 IST).
If you are not satisfied with our response, you may complain to the Data Protection Board of India through its website or app once you have used our grievance process.

6. Children and persons with disability

We process the personal data of a child (under 18) only with the verifiable consent of a parent or lawful guardian, checked in the manner the DPDP Rules, 2025 provide (for example against reliable identity and age details already available, or a virtual token from an authorised entity such as DigiLocker). We do not track or monitor children's behaviour or target advertising at them.
For a person with disability who cannot take a legally binding decision even with support, we obtain consent from their lawful guardian, after verifying the guardian's appointment.

7. Biometric data in Vyntez People

If an employer turns on selfie attendance, the first selfie registers a face template that later selfies are matched against, and each punch records a selfie and approximate location. A face template is biometric data and "sensitive personal data" under the SPDI Rules, 2011.
It is used only to confirm that the right person punched in, is visible only to the employee and the employer's HR and Owner roles, is never used for any other purpose or shared with any other organisation, and is not sold.
The employer must tell employees about it and obtain their consent where the law requires, and must offer another way to mark attendance if an employee does not consent or the match fails. Templates are deleted when the employer resets registration, turns selfie checks off, or closes the employee's record.

8. Security safeguards and breaches

We apply reasonable security safeguards as Rule 6 of the DPDP Rules, 2025 requires: encryption, masking or tokenisation where suitable; access control; logs and monitoring to detect unauthorised access, kept for at least one year; backups for continuity; and contracts requiring the same from our processors.
If a personal data breach happens, we tell each affected person without delay, in plain language, what happened, the likely consequences, what we are doing and what they can do, and give a contact. We tell the Data Protection Board without delay and send it a detailed report within 72 hours.

9. Retention and erasure

We erase personal data when the purpose is served or consent is withdrawn, unless the law requires us to keep it, and ask our processors to do the same. The retention periods are in the Privacy Policy. For consumer platforms (for example Vyntez Social, Vyntez Buddy, Vyntez Travels), data of users inactive for three years is erased after 48 hours' notice, as the DPDP Rules, 2025 require.

10. Data Processing Terms for business customers

These terms apply when a business customer (the "Customer") uses Vyntez People, VyntezMail, VyntezConnect, VyntezCare, VyntezCare ACA or another Service to process personal data of its employees, patients, customers or others. The Customer is the Data Fiduciary (controller) and Vyntez is the Data Processor, as section 8(2) of the DPDP Act and Article 28 of the GDPR contemplate.
Vyntez processes that data only on the Customer's documented instructions (the Terms, the product settings the Customer chooses, and written requests), only to provide the Services, and not for its own purposes.
Vyntez ensures its staff with access are bound by confidentiality, applies the safeguards in section 8 above, and assists the Customer, taking into account the nature of the processing, in responding to Data Principals' requests, in breach notifications and in any data protection impact assessment.
Vyntez tells the Customer of a personal data breach affecting its data without undue delay, and in any case within 24 hours of becoming aware of it, with the information the Customer needs to notify the Board and affected people.
Sub-processors: the Customer authorises the categories of sub-processor listed in the Privacy Policy (hosting, email delivery, notifications, payment and payout partners, AI model providers). Vyntez imposes equivalent data protection obligations on them, remains responsible for them, and gives at least 15 days' notice of a new sub-processor, during which the Customer may object.
At the end of the subscription, the Customer can export its data for 30 days; Vyntez then deletes it from live systems, and from backups within a further 90 days, unless the law requires retention.
Vyntez makes available information reasonably needed to show compliance, and allows audits by the Customer or an independent auditor on reasonable notice, at the Customer's cost, not more than once a year unless a breach has occurred.
For transfers of EU or UK personal data, the Standard Contractual Clauses (Module 2 or 3) and the UK Addendum are incorporated by reference. A countersigned Data Processing Agreement is available on request from the Grievance Officer.
The Customer is responsible for having a lawful basis and giving notice to its Data Principals, for the accuracy of data it enters, and for statutory obligations that are its own (for example an employer's PF, ESI, PT and TDS deposits and returns).

11. Laws outside India

If you are in the EU, UK or Switzerland, the GDPR rights in the Privacy Policy apply and you may contact your supervisory authority. If you are in California, the CCPA/CPRA rights in the Privacy Policy apply. Other local laws may give you additional rights; we honour them where they apply to us.

Grievance Officer

Grievance Officer
Vyntez Solutions Private Limited, Sindhora Road, Varanasi, Uttar Pradesh 221001, India
Email: grievance@vyntez.com (Monday to Friday, 10:00 to 18:00 IST)
For privacy, content, account, billing and consumer complaints about any Vyntez product. We acknowledge within 24 hours and aim to resolve within 15 days.