This Privacy Policy describes our processing of personal information for PIPRA websites, business relationships, PIPRA One customer-hosted deployments (including AWS Marketplace Bring Your Own Licence), and PIPRA-hosted software-as-a-service (SaaS) offerings, including Nija.
PIPRA Solutions Private Limited (“PIPRA”, “we”, “us” or “our”) is an Indian company with CIN U72900TG2017PTC120807 and its office at Fairmount Square, 413 & 414, 4th Floor, Ruby Block, Brundavan Colony, Kompally, Hyderabad, Telangana 500100, India.
This policy applies to personal information processed when you visit our websites; contact us, request a demonstration or download materials; engage with PIPRA in a commercial relationship; register, license or use a PIPRA product; or access a PIPRA-hosted SaaS service. Some products, contracts or features may have additional notices or terms. If these explain a particular processing activity more specifically, read them alongside this policy.
“Customer Data” refers to information a business customer or its authorised users provide to, store in, or generate through a PIPRA product. The way PIPRA handles Customer Data differs between customer-hosted deployments and PIPRA-hosted SaaS, as explained below.
For our own website, sales, accounts, billing, licensing, support administration and security information, PIPRA generally determines the purposes and means of processing and acts as a Data Fiduciary or controller, as applicable.
For Customer Data processed on a business customer’s instructions through a PIPRA-hosted SaaS service, the customer ordinarily determines the purposes of that processing and PIPRA ordinarily acts as a Data Processor or processor/service provider. The applicable customer agreement and any data-processing agreement govern those activities. The precise legal roles depend on the processing activity and applicable law, not solely on hosting arrangements.
Where a customer controls personal information about its employees, trading partners or end users, questions about that information may need to be addressed first to the customer. PIPRA assists customers with applicable requests as required by agreement and law.
The specific fields in any Nija authentication, verification or end-user flow depend on the customer configuration. PIPRA should provide any additional collection notice required at the point of collection, including for a public-facing product-verification experience.
As applicable, we use information to respond to enquiries; arrange demonstrations; provide requested marketing materials; create and manage business accounts; deliver and operate software and SaaS services; issue and validate licences; process orders and billing; provide support and updates; administer accounts and access rights; maintain availability, performance, security and auditability; prevent misuse; comply with law; and handle disputes or legal claims.
We use personal information for marketing where permitted and subject to applicable consent or opt-out requirements. We do not use Customer Data from a SaaS tenant for unrelated advertising or to disclose it to other tenants. Any use beyond providing the contracted services must have an appropriate lawful basis and, where required, customer authorisation or individual notice/consent.
Certain products, including PIPRA One offered through AWS Marketplace under Bring Your Own Licence (BYOL), may run within the customer’s own AWS account or other customer-controlled infrastructure. In that deployment model, the customer’s operational Customer Data stays in its environment and under its control. PIPRA does not ordinarily access that operational data unless the customer grants access, such as for support or a separately agreed service.
For BYOL licensing, the installed software communicates over HTTPS with PIPRA’s licensing service at licensing.pipra.solutions when it starts, approximately every six hours and following licence actions, as described in the applicable EULA. The licensing service receives the registered company name, GSTIN, administrator contact details, Server identifiers, Order/payment/grace-period details and licence-check and plugin-installation status in order to issue, validate, administer and support licences.
Licensing information is separate from the customer’s operational application database, although some licensing fields may be personal information. The customer is responsible for its AWS account, its system configuration, credentials, backup arrangements and lawful processing of personal information, without limiting any obligation PIPRA separately undertakes by law or contract.
Some PIPRA products are offered as cloud-hosted, multi-tenant SaaS services. In these services, PIPRA or its authorised hosting providers operate the service infrastructure and store and process Customer Data on behalf of subscribing organisations. Customer Data from different organisations may reside on shared infrastructure but is intended to be logically separated through tenant identification, access permissions and other controls appropriate to the service.
The subscribing customer controls which authorised users may access its tenant and is responsible for the lawful collection and permitted use of Customer Data it submits, including notices to its employees, business partners or end users where required. PIPRA processes that information to deliver, host, maintain, secure, support, back up and improve the reliability of the contracted service, as permitted by the customer agreement and applicable law.
PIPRA personnel or approved providers may require restricted administrative access for operations, security investigation, troubleshooting, backup/recovery or customer-authorised support. Such access should be limited to authorised purposes and persons and handled under access-control and confidentiality requirements.
If a SaaS customer chooses integrations, APIs or product-verification workflows that involve external systems or end users, relevant information may be exchanged as needed for the selected features. The customer agreement, configuration and any applicable point-of-collection notice should describe material additional data flows.
PIPRA does not represent that Customer Data for PIPRA-hosted SaaS remains in the customer’s AWS account. The hosting region, subprocessors, service commitments, data exports and contractual deletion process should be confirmed in the applicable SaaS documentation.
Customer Data remains subject to the customer’s rights under the applicable agreement. Customer-hosted deployments and PIPRA-hosted SaaS do not necessarily use the same data architecture. In either case, particular modules may use AI, computer vision, connected devices, external APIs or models. Data that those functions process or transmit depends on the feature and its configuration.
PIPRA will not describe Customer Data as being sent to external model providers unless such a transfer actually occurs. Where a feature involves transmission to a third-party AI, integration or infrastructure provider, the relevant product documentation or customer agreement should explain the purpose and applicable safeguards. PIPRA does not claim a blanket right to train general-purpose AI models on Customer Data.
AWS Marketplace and AWS services are separately operated by Amazon or its affiliates and are governed by their own terms and privacy notices. In the PIPRA One BYOL arrangement described in the EULA, the AWS infrastructure is provisioned in the customer’s account and AWS bills that infrastructure separately. PIPRA’s paid Product licences are ordered and paid for directly with PIPRA, ordinarily by bank transfer. PIPRA processes order, invoice and payment-confirmation details; the BYOL software is not intended to collect payment-card details.
Other sales channels or offerings may use different payment arrangements, in which case the applicable transaction information or specific notice should identify the relevant provider and data handling.
We may share information with authorised PIPRA personnel, affiliated personnel where applicable, and contracted providers supporting website forms, communications, customer relationship management, cloud hosting, licensing, identity/access management, SaaS operations, security monitoring, support, accounting and legal compliance. We share only information reasonably necessary for the relevant service and apply appropriate contractual and access restrictions where required.
PIPRA may disclose information when legally required, to protect rights or security, or as part of a bona fide corporate transaction, subject to applicable safeguards. We do not sell personal information to advertisers.
Depending on the service and provider arrangement, information may be processed in India or another jurisdiction. Transfers are subject to applicable legal restrictions and appropriate contractual, technical and organisational measures. A current list of material SaaS subprocessors and hosting locations may be provided in product or contractual documentation where required.
We use security measures appropriate to the nature of information and processing, which may include access control, authentication, role-based permissions, secure communications, logging, backups and administrative procedures. For multi-tenant SaaS, access restrictions and logical tenant separation are key controls. No platform or transmission method can be guaranteed completely secure.
Where we become aware of a security incident affecting personal information, we investigate and take steps to contain and address it and notify affected customers, individuals or authorities where required by applicable law or contract. Notification responsibilities may differ depending on whether PIPRA is acting on its own behalf or as a processor for a customer.
We keep personal information for as long as reasonably necessary for its disclosed purpose, provision of services, security, audit, accounting, statutory compliance and the establishment or defence of legal claims. Different categories, including invoices, licensing logs, support records, marketing contacts and SaaS tenant data, may require different retention periods. Where necessary, we will publish or make available more specific schedules or provide them contractually.
For customer-hosted deployments, expiration or suspension of a licence does not by itself delete Customer Data in the customer’s environment. For PIPRA-hosted SaaS, export, availability after cancellation, deletion of active tenant data, and any residual backup retention are subject to the customer agreement, applicable law and documented operational procedures. PIPRA should not promise immediate deletion from all backups unless that capability is verified.
Our website may use necessary cookies and similar technologies for functionality, security and sessions, and may use optional analytics or marketing technology when configured. Website forms may be operated by third-party form providers. Information submitted to these providers may also be subject to their privacy practices.
Where required, we seek consent for non-essential tracking and provide a means to manage preferences. You may adjust browser controls and unsubscribe from promotional communications using provided options or by contacting us. A separate cookie notice may identify specific tools and retention periods.
Subject to applicable law, individuals may have rights to receive information about processing, request access or a summary, correct or update personal information, request erasure, withdraw consent, raise a grievance, or make other requests (including nomination where applicable). Some requests may be limited by legal obligations or the role PIPRA plays for the relevant data.
For information PIPRA controls directly, contact support@pipra.solutions with “Privacy Request” in the subject line. We may verify your identity and ask for enough detail to locate the information. For Customer Data held in a SaaS tenant on the customer’s instructions, we may direct the request to the relevant customer and assist it in accordance with our obligations. Withdrawal of consent does not invalidate earlier lawful processing and may affect optional services that depend on that consent.
Our business websites and enterprise software services are not directed to children. If a customer configures a feature that is likely to process children’s personal information, the customer must ensure an appropriate legal basis and comply with applicable requirements; PIPRA will address its own obligations under the relevant agreement and law.
We may update this policy to reflect changes to products, hosting models, legal requirements and operating practices. We will publish the updated policy and effective date on our website and provide additional notice when legally required.
Privacy and grievance contact: support@pipra.solutions (subject: “Privacy Request”).
PIPRA Solutions Private Limited, Fairmount Square, 413 & 414, 4th Floor, Ruby Block, Brundavan Colony, Kompally, Hyderabad, Telangana 500100, India. Website: https://www.pipra.solutions.