This notice explains how Zpoa Inc (“ZPOA”, “we”, “us”) handles personal data in connection with Thoshika, the business software suite at thoshika.com, and this website. It is written for the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it.
1. Our two roles
When a company uses Thoshika, that company (our customer) decides why and how the personal data of its employees, customers, vendors and other people is processed. The customer is the Data Fiduciary for that data, and ZPOA processes it on the customer’s behalf as a Data Processor, under our agreement with the customer. If you are an employee or contact of a Thoshika customer, please send requests about your data to that company first. We will help them respond.
For our own purposes, such as running this website, managing customer accounts and billing, and replying to people who write to us, ZPOA is the Data Fiduciary.
2. What we collect as Data Fiduciary
- Contact details you send us by email: name, work email, phone number, company and the content of your message.
- Account and billing details of customer administrators and billing contacts: name, email, company name, GSTIN, billing address and invoices.
- Sign-in and security records for people who use Thoshika: email address, sign-in times, method, IP address and device information, used to keep accounts secure.
- Website: this site does not use advertising or analytics cookies. It stores your colour theme and the pricing country you choose in your own browser. Our hosting provider keeps standard server logs, such as IP address and pages requested, for security.
3. Why we use it
- To reply to you, give demos and prepare quotes, on the basis of your request.
- To provide the service, send invoices and meet our legal and tax obligations, under our contract.
- To keep Thoshika secure, prevent fraud and investigate misuse.
- To send product news, only where you have agreed. You can withdraw consent at any time, as easily as you gave it.
We do not sell personal data, and we do not use customer data inside Thoshika to advertise to anyone.
4. Where data is stored
Thoshika is hosted on OVHcloud infrastructure in the United States; India hosting is being set up. Data processing follows DPDP Act 2023 obligations, including the conditions on transfer of personal data outside India. Some service providers we rely on, such as email delivery, may process limited data in other places.
5. Who we share it with
We use service providers for hosting, email delivery and similar services. They process personal data only on our instructions and under contracts that require them to protect it. We may disclose data where the law requires it, for example to a court or a government authority with legal power to ask.
6. How long we keep it
We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires (for example, tax records). Customer data in Thoshika is kept for the term of the customer’s agreement and then deleted or returned as that agreement says.
7. Security
We take reasonable security safeguards to protect personal data, described on our security page. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act requires, or help our customer do so where they are the Data Fiduciary.
8. Your rights
Under the DPDP Act you may:
- ask for a summary of the personal data we hold about you and how we use it;
- ask us to correct, complete, update or erase it;
- withdraw consent you have given;
- nominate another person to exercise your rights if you die or become unable to; and
- raise a grievance with us, and then with the Data Protection Board of India.
We will reply within the time set by the DPDP rules.
9. Children
Thoshika and this website are meant for businesses and are not directed at children. We do not knowingly collect personal data of children.
10. Grievance officer
For any question, request or complaint about personal data, write to our grievance officer at privacy@zpoa.com. Please say which company or account your request relates to.
11. Changes
We may update this notice. We will change the date at the top and, for significant changes, tell customer administrators by email.