1.Who we are
PrimoERP is made by QalbIT Infotech Pvt Ltd, a private limited company registered in India (corporate identity number U72900GJ2022PTC132898). In this policy, “we”, “us” and “our” mean QalbIT Infotech Pvt Ltd, and “you” means anyone whose personal data we handle.
Our office is at C-109, Siddhi Vinayak Towers, near Kataria Arcade, opp. S.G. Highway, Makarba, Ahmedabad 380051, India.
We decide why and how the personal data described here is used. That makes us its data fiduciary under India’s Digital Personal Data Protection Act 2023, and its controller under the EU and UK General Data Protection Regulation (GDPR).
Afzal Ali is our privacy officer. He is our grievance officer for India and our data protection officer for the GDPR, and he answers any question about how we handle your personal data. You can write to him at [email protected].
2.What this policy covers
This policy covers the personal data we collect when you:
- visit primoerp.com;
- ask for early access, apply to become a partner or book a demo;
- call, email or WhatsApp us; or
- become our customer, or use PrimoERP as one of our customers’ users.
PrimoERP is still being built
The PrimoERP application isn’t available yet, so today this policy is mostly about this website and our conversations with you. We will update it before the app launches.
What it does not cover
It does not cover the business data our customers keep in PrimoERP, such as their own customers’, suppliers’ and employees’ details. For that data, the customer decides how it is used and we act only on its instructions, as our data processing agreement explains. If your details are in a PrimoERP customer’s records, please contact that business first.
Other websites we link to, such as WhatsApp, have their own privacy policies.
3.The personal data we collect
What you give us
- Early-access form: your name, work email, phone number with its country code, company, country, and anything you write in the note.
- Partner application: the same, plus how you want to partner with us.
- Demo booking: what you enter on our booking page, such as your name, email, phone, the time you pick and what you would like to see.
- Calls, emails and WhatsApp messages: your name, your number or address, and what you tell us.
- As a customer: your company’s details, the names and contact details of its billing contacts and users, and your invoices, payments and support requests.
What we collect automatically
- The page you sent a form from.
- Your IP address and browser details, when you send a form. Cloudflare Turnstile uses them to check that you are not a robot, and our server keeps your IP address in memory for 10 minutes to stop the same address sending too many forms.
- With Analytics on: the pages you view, the buttons you press, your approximate location, your device and browser, and the site that brought you here, through Google Analytics. Our cookie policy has the details.
- Our host’s server logs: your IP address, browser, the page requested and the time, which Hostinger keeps so we can keep the site secure and working.
What others give us
If a PrimoERP partner or one of your colleagues refers you to us, they may give us your name, company and work contact details.
What we don’t ask for
This website never asks for sensitive data such as health information, bank or card details, passwords or government ID numbers. Please don’t put them in a form or a message.
You don’t have to give us your details. But we need a name, email, phone number, company and country to reply to a form.
4.Why we use it
We use your personal data only for the purposes below, and only the data each one needs. For each purpose we also give its legal basis: what India’s DPDP Act and, for people in the EU, the EEA, the UK and Switzerland, the GDPR allow.
Reply to you and arrange early access, a demo or a partnership
- What we use
- What you send in a form, book on our booking page or tell us by email, phone or WhatsApp
- Legal basis
- India: the consent you give when you send it, which you can withdraw at any time. EU and UK: steps you ask us to take before a contract, and our legitimate interest in answering enquiries.
Tell you when PrimoERP is ready for you
- What we use
- Your name, email, phone and company, if you asked for early access
- Legal basis
- The same consent and request as above. Every message lets you say “no more”, and we stop.
Provide PrimoERP, bill you and support you, once you are a customer
- What we use
- Your company’s contact, account and billing details, and your support conversations
- Legal basis
- India: you give us these details to receive the service, a use the DPDP Act allows. EU and UK: our contract with you.
Keep our forms and systems safe
- What we use
- Your IP address and browser details, and our security logs
- Legal basis
- India: part of handling the form you choose to send, and the security duties the law puts on us. EU and UK: our legitimate interest in protecting our website and team from spam and misuse.
Understand how people use this website
- What we use
- Google Analytics data: the pages you view, the buttons you press, your approximate location, your device and browser
- Legal basis
- EU, EEA, UK and Switzerland: only with your consent. Elsewhere it is on by default and you can switch it off at any time in Cookie settings.
Meet our legal duties and protect our rights
- What we use
- The records the law makes us keep, and what we need to answer a lawful request or defend a claim
- Legal basis
- India: the legal uses the DPDP Act allows. EU and UK: legal obligation and legitimate interest.
What we don’t do
We don’t sell your personal data. We don’t use it for targeted advertising, and we don’t make decisions about you by automated means alone. We don’t use it for any new purpose without telling you first and, where the law requires, asking for your consent.
6.Where your data is stored
We are based in India, and we handle your personal data in India.
Some of our service providers store or process it in other countries. This website and its forms are hosted by Hostinger in [Hostinger data centre location], our email by Zoho Mail in India, and our customer records in LiftUp CRM are hosted in [LiftUp CRM hosting location]. Cloudflare runs a worldwide network, and Google may process analytics data in the United States and other countries.
Indian law lets personal data go abroad except to countries the Government of India restricts. We will follow any restriction it sets.
If you are in the EU, the EEA, the UK or Switzerland, please note that India has no “adequacy” decision from the European Commission or the UK. Where those laws require a safeguard for a transfer, we rely on the European Commission’s Standard Contractual Clauses (with the UK addendum), which our providers include in their data processing terms. You can ask us for a copy.
7.How long we keep it
We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law makes us keep it. Then we delete it or make it anonymous.
- Early-access requests, partner applications and demo bookings that don’t lead further: 24 months after our last contact with you.
- Emails, calls and WhatsApp conversations: 24 months after our last contact with you, unless they are part of a customer’s records.
- Customer records: for as long as you are a customer, then for as long as Indian tax and company law requires us to keep accounting and tax records.
- Security and access logs: one year, unless we need them longer to investigate an incident or the law asks for longer.
- The IP address our server checks for repeat sends: 10 minutes.
- Google Analytics data: 14 months.
- Your cookie choice: 12 months, in your browser.
If you ask us to delete it
We delete your data when you withdraw your consent or ask us to, unless the law makes us keep some of it. If we must keep part of it, we tell you what and why, and use it for nothing else.
8.How we protect it
We protect personal data with reasonable security safeguards: every page and form on this website uses an encrypted connection (HTTPS), only the people who need your details can see them, and we keep logs that help us spot and look into misuse. Our security page has more detail.
If something goes wrong
If a personal data breach affects you, we will tell you without delay, in plain words: what happened and when, what it may mean for you, what we are doing about it, what you can do to protect yourself, and who to contact.
We will also report it as the law requires: to CERT-In, India’s cybersecurity agency, within 6 hours of noticing a reportable incident; to the Data Protection Board of India; and, where the GDPR applies, to the relevant regulator, normally within 72 hours.
9.Your rights
Wherever you are, you can ask us to:
- tell you what personal data we hold about you, how we use it, and who we have shared it with;
- correct, complete or update it;
- delete it, unless the law makes us keep it;
- stop using it for a purpose you agreed to: withdrawing consent is as easy as giving it, and doesn’t affect what we did before;
- let someone you nominate use these rights for you if you die or can no longer act yourself; and
- deal with a complaint about how we have handled your data.
In the EU, the EEA, the UK and Switzerland
You can also ask us to restrict how we use your data, object to our using it for our legitimate interests, and receive the data you gave us in a format you can take elsewhere.
You can complain to the data protection authority where you live or work. In the EU and the EEA, the European Data Protection Board lists them. In the UK, it is the Information Commissioner’s Office. We would be glad of the chance to put things right first.
In California and other US states
You can ask what we hold about you, ask us to correct or delete it, and opt out of its sale or sharing. We don’t sell or share personal data as those laws define it, and we honour Global Privacy Control as an opt-out. We won’t treat you differently for using your rights.
How to use your rights
Email [email protected], ideally from the address we have for you, and tell us what you would like. We may ask you to confirm who you are before we act. It is free.
We acknowledge every request within 2 working days and reply in full within 30 days. If a request is complex and the law allows more time, we tell you why within those 30 days.
To withdraw your consent to cookies, use Cookie settings at the foot of any page.
In India, if you are not satisfied with our answer, you can complain to the Data Protection Board of India, which takes complaints online, once you have used our grievance process. This applies from 13 May 2027, when that part of the law takes effect.
You can ask for this policy in English or in any language listed in the Eighth Schedule to the Constitution of India.
10.Children
PrimoERP is a service for businesses, and this website is meant for adults. Under India’s law a child is anyone under 18. We don’t knowingly collect personal data from children, and we don’t track or target adverts at them.
If you think a child has sent us their details, write to [email protected] and we will delete them.
12.Changes to this policy
We update this policy when what we do with personal data changes, or the law does. We will update it before the PrimoERP app launches, and before we start serving customers in the UAE, to cover the UAE’s data protection law (Federal Decree-Law No. 45 of 2021).
The date at the top shows when it last changed. If a change matters to you, such as a new use of your data, we will tell you before it takes effect, by email if we have your address and with a notice on this website. Where a change needs your consent, we will ask for it.
13.Contact us
Write to our privacy officer with any question, request or complaint about your personal data. We acknowledge it within 2 working days and reply in full within 30 days. You can also write to us at QalbIT Infotech Pvt Ltd, C-109, Siddhi Vinayak Towers, near Kataria Arcade, opp. S.G. Highway, Makarba, Ahmedabad 380051, India.
Privacy officer: Afzal Ali
Email: [email protected]