| Legal entity | Drushtant Infoweb Private Limited |
|---|---|
| Registered office | 51, Kailash Complex-A, Near Gundala Gate, Gondal - 360311, Gujarat, India |
Interpretation. This document describes Bizmitra’s current service and current-law position as at the date above. Mandatory law prevails where it cannot lawfully be varied. Read it with the other Bizmitra legal documents referenced in it.
1. Who we are
Drushtant Infoweb Private Limited ("Drushtant", "Bizmitra", "we", "us" or "our") operates Bizmitra business software and related services. Our registered office is 51, Kailash Complex-A, Near Gundala Gate, Gondal - 360311, Gujarat, India.
Privacy: privacy@bizmitra.io | Grievance: grievance@bizmitra.io | Security reports: security@bizmitra.io | Phone: +91 72279 00879.
2. Scope and our roles
This Notice applies to Bizmitra websites, ERP, CRM, Workforce employee self-service, Tally-connected services, developer/API services, account administration, support and the public Bizmitra AI chat. It should be read with the Regional Privacy Supplements, Cookie Policy, Public AI Chat Notice and, for customer-controlled business data, the applicable customer agreement and Data Processing Addendum.
| Context | Who decides why data is processed | Bizmitra role |
|---|---|---|
| Bizmitra website, guest chat, account administration, billing, security and direct support | Drushtant / Bizmitra | Controller or equivalent responsible party |
| ERP, CRM and Workforce records uploaded, created or synchronised by a customer/employer | The Bizmitra customer / employer | Processor, service provider or equivalent acting on customer instructions |
If your personal data appears in an employer/customer Bizmitra tenant, that organisation is normally the first point of contact for access, correction, deletion or employment-related questions. Bizmitra assists it as processor and does not independently reuse its ERP/CRM/Workforce records for advertising.
3. Personal data we process
3.1 Account, website and support data
Name, business email, mobile number, organisation, role and authorised-user/account details.
Subscription, invoice, payment-status and support correspondence.
IP address, browser/device information, device/session identifiers, login events, consent records and security logs.
Analytics and advertising information on public marketing pages where the applicable consent choice/law permits it.
3.2 ERP and CRM records
Bizmitra customers may create or synchronise customer, vendor, ledger, contact and transaction records, including names, phone numbers, email addresses, business addresses, invoices, orders, receipts, payments and related accounting/CRM data. Tally-synchronised information is processed on the customer’s instructions. The standard ERP/CRM production database is hosted in Mumbai, India.
3.3 Workforce employee records
Workforce is a business-to-business employee self-service product. Employees do not self-register; their employer creates or authorises their account. Depending on the employer’s configuration, Workforce may process name, employee code, department, designation, work location, contact information, address/country, joining information, leave and attendance information, payslip/payroll information and statutory identifiers. Bank/payment details are processed only where a payroll/payment workflow actually requires them. A payslip may contain salary amount and other employment information even where Bizmitra does not process the salary transfer itself.
For the currently active Bahrain/Oman/UAE employee self-service configuration described to Bizmitra, the employer uses a separate payroll system for salary processing and salary transfer; bank details are not stored in Bizmitra for that configuration. Bizmitra is used for functions such as leave management and payslip access.
3.4 Device biometric unlock
If you enable fingerprint, Face ID or another device-supported biometric unlock in the Bizmitra mobile app, the biometric check is performed by the device operating system using its protected biometric system. Bizmitra does not receive or store your fingerprint image, face image, biometric template or biometric identifier, and the local biometric success/failure result is not uploaded to the Bizmitra server. The server may store ordinary device/session data and a boolean setting indicating whether biometric unlock is enabled.
3.5 Public AI chat at /vi/public_chat
The public AI chat is a guest service. You do not need to create a Bizmitra account or provide an email address or password. A session identifier and chat history are used to maintain the guest conversation. If you voluntarily type an email address, phone number or other personal information into the chat, it becomes part of the conversation content.
Chat messages and session context are routed through Drushtant infrastructure hosted by Hetzner in Germany and submitted to the OpenAI API for model inference.
Bizmitra chat history is retained on the German chat environment for up to 90 days, subject to shorter product settings, security investigations or legal holds.
Under standard OpenAI API controls, API inputs/outputs are not used to train OpenAI models by default and abuse-monitoring data may be retained for up to 30 days unless a different approved retention configuration applies.
OpenAI and authorised subprocessors may process API data in multiple published jurisdictions; OpenAI processing is not limited to Germany.
You should not place unnecessary payroll, health, government-ID, passwords, bank/card credentials, trade secrets or another person’s confidential information into the guest chat.
3.6 Limited sales forecasting
Bizmitra may send limited historical summary metrics consisting of month, year and total sales amount to a Hetzner-hosted environment in Germany to generate sales forecasts. The forecast payload is designed to exclude customer, vendor, ledger and employee names/contact information and does not include Workforce employee records.
4. Why we process personal data
To provide, operate, authenticate, secure and support Bizmitra services.
To process customer-controlled ERP, CRM and Workforce data on documented customer instructions.
To manage subscriptions, billing, transaction messages and customer support.
To prevent fraud, abuse, account compromise and security incidents.
To provide the guest AI chat when a visitor chooses to use it.
To provide limited sales forecasting using the summary data described above.
To comply with tax, accounting, legal, regulatory, security and dispute-resolution obligations.
To measure and market our public website where applicable consent and law permit.
The lawful ground depends on the jurisdiction and context. Where Bizmitra acts as processor, the customer/employer is responsible for identifying the lawful basis for its processing and for providing required notices/consents or obtaining required permits.
5. Data locations and international transfers
| Processing | Primary location / transfer |
|---|---|
| ERP / CRM production and ordinary backups | Mumbai, India - Akamai Connected Cloud / Linode infrastructure |
| Workforce production and ordinary backups | Mumbai, India - international transfer where the employee is outside India |
| Sales forecast summary | Limited month/year/total-sales metrics to Hetzner, Germany |
| Public guest AI chat | Drushtant/Hetzner, Germany + OpenAI API and authorised subprocessors in published processing locations |
| Transactional email / statutory / payment services | Provider infrastructure applicable to the feature invoked; see Subprocessor & Data Location List |
We use contractual, consent-based, adequacy, statutory or other transfer mechanisms required by the law that applies to the transfer. The relevant Regional Privacy Supplement and customer DPA describe additional country requirements.
6. Service providers and other recipients
We use hosting, email, statutory-integration, payment, analytics, advertising and AI providers for defined purposes. A provider may act as a processor/subprocessor, independent controller or other legally recognised recipient depending on the service. The current provider list and data locations are maintained in the Bizmitra Subprocessor & Data Location List.
We may also disclose information where required by applicable law, court order, regulator or lawful authority, or as part of a merger, acquisition, financing or sale subject to appropriate confidentiality and legal safeguards.
7. Retention
We retain personal data only for as long as reasonably necessary for the purpose, customer instructions, subscription administration, statutory recordkeeping, security, dispute resolution or legal hold. ERP/CRM/Workforce records controlled by a customer are retained according to the customer agreement and applicable legal/audit requirements. Backups are overwritten or deleted through ordinary backup rotation, subject to legal/security holds. Public guest-chat history is handled as described above.
8. Security
TLS-protected web and API traffic.
Role-based access controls and logical tenant separation.
Restricted production administration, firewalling, monitoring, patching and backups.
Application/security logs and accounting audit controls appropriate to the service.
Incident triage, containment and customer cooperation where Bizmitra acts as processor.
No internet-connected service can guarantee absolute security. Customers remain responsible for configuring permissions, protecting credentials/endpoints, removing former users and using the service lawfully.
9. Your rights
Your rights depend on the law that applies to the processing. Depending on jurisdiction, you may have rights to obtain information/access, correct inaccurate information, request deletion or restriction where legally available, object or withdraw consent where processing depends on consent, complain to a regulator, or receive information about international processing.
If Bizmitra controls the data, contact privacy@bizmitra.io. If the data is in an employer/customer tenant, contact that employer/customer first; Bizmitra will support its verified request as processor.
10. Children
Bizmitra is a business service and is not directed to children for independent consumer registration. A customer must not place a child’s data into Bizmitra unless it has lawful authority and satisfies any guardian/consent or other child-data requirements that apply.
11. Cookies and marketing technologies
Necessary cookies/session technologies are used to provide requested services. Non-essential analytics, advertising and personalisation technologies are governed by the Cookie Policy and the consent choices offered on the relevant site. We do not describe advertising cookies as “necessary” merely because they help marketing measurement.
12. Changes and policy history
We may update this Notice when our services, providers, data flows or applicable law change. Material changes will be highlighted or notified where required. Superseded versions are kept in the Bizmitra Privacy History. The privacy page at /privacy is the stable URL for the current version.
13. Contact
Privacy questions: privacy@bizmitra.io. Grievances: grievance@bizmitra.io. Security reports: security@bizmitra.io. Postal address: 51, Kailash Complex-A, Near Gundala Gate, Gondal - 360311, Gujarat, India. Phone: +91 72279 00879.