Privacy Policy

1. Introduction and Scope

Pomodore Software Solutions LLP ("we", "our", "us") is committed to protecting your personal data. This Privacy Policy is our notice under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and the rules made under them, as in force from time to time. It explains what personal data we process, why, and what rights you have, when you visit our website or use Pomodore, our practice management, task and team management platform.

By using our website or Pomodore, or by giving us your consent where we ask for it, you agree to this Privacy Policy. If you do not agree, please do not use our service.

2. Our Role: Data Fiduciary and Data Processor

• 2.1 As Data Fiduciary: For the personal data of our own users and website visitors, such as account holders, enquirers and subscribers, we decide why and how it is processed and act as the Data Fiduciary.
• 2.2 As Data Processor: Firms that use Pomodore may enter personal data of their own clients, staff and contacts. For that data, the firm is the Data Fiduciary and we process it only on the firm's behalf and instructions as a Data Processor. Requests about that data should first be sent to the firm concerned; we will assist the firm in responding.

3. Personal Data We Collect

• 3.1 Account and contact data: Name, email address, phone number, firm name, designation, billing details (including GST number) and login credentials, provided when you register, subscribe or contact us.
• 3.2 Customer Data: Information entered into the platform by you or your team, such as client names and contact details, tasks, notes, documents, deadlines and communication history.
• 3.3 Usage and device data: Login times, features used, session duration, IP address, browser and device type, and pages visited.
• 3.4 Cookies and similar technologies: We use cookies and similar technologies that are necessary to keep you signed in and the service secure. Any non-essential cookies or analytics are used only with your consent, which you can give or withdraw through your browser settings or any cookie preference option we provide.
• 3.5 Payment data: Payments are collected by third-party payment processors. We receive confirmation and transaction references but do not store your full card, UPI PIN or bank account credentials.

4. Notice, Consent and Lawful Grounds

• 4.1 Consent: Where we rely on consent, it is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the purposes stated in this policy or in the notice shown when we collect the data.
• 4.2 Withdrawing consent: You may withdraw consent at any time, as easily as you gave it, by writing to hello@pomodore.in or using the settings in your account. Withdrawal does not affect processing done before it, but we will stop the processing based on that consent and, unless retention is required by law, erase the related data. Withdrawing consent may mean we can no longer provide parts of the service.
• 4.3 Other lawful uses: Where permitted by the DPDP Act, we may also process personal data without fresh consent for certain legitimate uses, for example where you voluntarily provided your data for a purpose and have not objected, to perform a legal obligation, to comply with a court order or a lawful request of a government authority, or to respond to a medical emergency or a threat to life.

5. Purposes: How We Use Your Data

• 5.1 Provide the service: To create and manage your account, operate Pomodore, process subscriptions and payments, issue invoices and provide support.
• 5.2 Communicate with you: To send service-related messages such as security alerts, renewal and billing notices and product updates. We send promotional messages only with your consent and you can opt out at any time.
• 5.3 Security and improvement: To protect the platform against fraud and misuse, fix errors and understand usage so we can improve features.
• 5.4 Legal compliance: To meet obligations under tax, accounting and other laws and to respond to lawful requests from courts and authorities.
• 5.5 Purpose limitation: We collect only the personal data needed for these purposes and do not use it for any other purpose without giving you a fresh notice and, where required, obtaining your consent.

6. Storage, Security and Retention

• 6.1 Security safeguards: We take reasonable security safeguards to prevent a personal data breach, including encryption in transit and at rest where applicable, role-based access controls, authentication, backups and monitoring. No system is completely secure, so we cannot guarantee absolute security.
• 6.2 Retention: We keep personal data only for as long as needed for the purpose it was collected for, while your subscription is active, and afterwards for the period needed to meet legal, tax, accounting and dispute-resolution requirements. Once the purpose is served and retention is no longer required by law, we erase the data or make it anonymous. We retain traffic and processing logs for at least one year, as required by the DPDP Rules.
• 6.3 Inactive accounts: If an account stays inactive for an extended period, we will notify you before erasing the associated personal data, unless the law requires us to keep it.

7. Sharing and Disclosure

• 7.1 No sale of personal data: We do not sell or rent your personal data.
• 7.2 Service providers: We engage trusted third-party Data Processors such as cloud hosting, payment, email and support providers. They may process personal data only on our instructions under a contract that requires appropriate security and confidentiality, and we remain responsible for that processing.
• 7.3 Legal requirements: We may disclose information if required by law, court order or a competent government authority, or to protect our rights, users or the public.
• 7.4 Business transfers: If we are involved in a merger, acquisition or sale of assets, your data may be transferred to the successor, which will be bound by this policy, and we will notify you.

8. Transfers Outside India

Your personal data may be processed or stored on servers located outside India by our service providers. We transfer personal data outside India only as permitted by section 16 of the DPDP Act, that is, not to any country or territory the Central Government has restricted by notification, and we apply the same safeguards to it. Stricter transfer requirements under any other Indian law that applies to you will continue to be followed.

9. Children's Data

Pomodore is intended for professional use by adults. We do not knowingly collect personal data of anyone under 18 years of age. We do not track or monitor the behaviour of children or direct advertising at them. If you believe a child's data has been provided to us, contact hello@pomodore.in and we will delete it. If we ever need to process a child's data, we will first obtain verifiable consent of the parent or lawful guardian as required by section 9 of the DPDP Act.

10. Your Rights as a Data Principal

• 10.1 Access: You can request a summary of the personal data we process about you, the processing activities carried out, the identities of the other Data Fiduciaries and Data Processors with whom it has been shared, and the description of the data shared.
• 10.2 Correction, completion and updating: You can ask us to correct inaccurate or misleading data, complete incomplete data, and update it. You can also do this in your account settings.
• 10.3 Erasure: You can ask us to erase your personal data, unless we need to retain it for a specified purpose or to comply with law.
• 10.4 Grievance redressal: You have the right to have your grievance about our acts or omissions, or about the exercise of your rights, readily addressed (see section 13).
• 10.5 Nomination: You can nominate another individual to exercise your rights in the event of your death or incapacity. Write to us at hello@pomodore.in with the nominee's details.
• 10.6 How to exercise your rights: Send your request from your registered email address to hello@pomodore.in. We may verify your identity before acting. We aim to respond within 30 days, and in any case within the period prescribed by law. There is no charge for making a request.
• 10.7 Customer Data: If your data was entered into Pomodore by a firm, we may refer your request to that firm, which is the Data Fiduciary for that data.

11. Your Duties as a Data Principal

As required by section 15 of the DPDP Act, you must comply with applicable laws, not impersonate another person, not suppress material information when giving us your data, not make a false or frivolous grievance or complaint, and furnish only verifiably authentic information when exercising your right to correction or erasure.

12. Personal Data Breach

If a personal data breach occurs, we will, as required by the DPDP Act and the rules made under it, inform the Data Protection Board of India and each affected person without delay, describing the nature and extent of the breach, its likely consequences and the measures taken. Where the breach affects Customer Data that we process for a firm, we will notify the firm without undue delay so that it can meet its own obligations.

13. Grievance Officer and Complaints

For any question, concern or complaint about how your personal data is handled, or to exercise your rights, contact our Grievance Officer at Pomodore Software Solutions LLP, Ernakulam, Kerala, India, email: hello@pomodore.in, phone: +91 73569 32335. We will acknowledge your request within 48 hours and resolve it within the time prescribed by law, which is not more than 90 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India, but only after you have first used our grievance redressal process.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes in law or in our services. The "Last updated" date above shows the latest version. We will notify you of significant changes by email or within the platform, and where the change needs fresh consent we will ask for it.

15. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at hello@pomodore.in.