Privacy notice

This draft is awaiting review by a lawyer. It is not yet in force. Items marked [TO CONFIRM] are for the lawyer or the company to settle.

1. Who we are

Dexta is a suite of eleven business apps for Indian companies: timesheets and leave, HR, payroll, expenses, accounting, reviews, helpdesk, recognition, referrals and skills. It is made and sold by [TO CONFIRM: legal name, CIN and registered office of the company that sells Dexta] (“we”, “us”).

Our privacy contact’s email address is on our Contact page. Write to it with any question about this notice or to use any of your rights below. [TO CONFIRM: whether to name a person as the contact under section 8(9) of the DPDP Act and rule 9 of the DPDP Rules, 2025, and a postal address.]

2. Two different roles

The Digital Personal Data Protection Act, 2023 (the “DPDP Act”) treats us differently depending on whose data it is.

• Our own website, sales and billing. When you visit this website, ask for a demo, write to us, or subscribe to Dexta Books, we decide why and how your data is used. For that data we are the data fiduciary, and sections 3 to 9 of this notice apply.
• Inside the Dexta service. When your employer uses Dexta to run HR, payroll, timesheets, expenses, its books, reviews, a helpdesk, recognition, referrals or a skills matrix, your employer decides why and how your data is used. Your employer is the data fiduciary and we are its data processor. Section 10 of this notice explains what that means for you.

3. What the website collects

When you just browse. The website is a set of static pages. It does not ask you to sign in and it sets no cookies of its own. See our cookie notice.

• Server logs. Like any web host, the company that serves this site records each request: your IP address, the page asked for, the time, and your browser’s description of itself. [TO CONFIRM: the web host’s name, where its logs are kept, and for how long.]
• Fonts. Our typefaces are served from our own website, so loading a page sends nothing to a font provider.
• Analytics, only if switched on. If we switch on visitor counts, we use Plausible Analytics. Plausible does not set cookies or keep your IP address; it counts visits, pages, referring sites, countries and device types in total. When analytics is off, nothing is counted. [TO CONFIRM: whether analytics is switched on at launch, and Plausible’s hosting location at that time.]

When you ask for a demo. The Book a demo form asks for the details you type in, such as your name, work email, phone number, company, company size and a message. [TO CONFIRM: the final list of form fields.] Until the form is connected to our sales system, it shows you our sales email address instead of sending anything.

When you write to us. We keep your email and our replies.

When you subscribe to Dexta Books, or sign in as a customer’s administrator. We keep the billing contact, company details and sign-in records needed to run your subscription and your account.

4. Why we use it, and on what ground

What	Why	Ground under the DPDP Act
Demo requests and emails	To reply, arrange a demo and follow up about Dexta	You gave it to us for that purpose (section 7(a)) [TO CONFIRM: or consent under section 6, if we also want to send news]
Billing and account details	To run your subscription, invoice you and keep tax records	The contract, and legal obligations such as GST and company law records (section 7) [TO CONFIRM]
Server logs	To keep the website running and secure	Legitimate use for security; CERT-In’s 2022 directions also require logs to be kept [TO CONFIRM]
Analytics totals, if on	To see which pages help visitors	No personal data is kept

We do not sell personal data, and we do not use it for advertising profiles. We send marketing email only if you ask for it, and every such email has a way to stop it.

5. Who we share it with

Only with service providers who handle it for us, under contract:

• the web host that serves this site [TO CONFIRM: name];
• our email provider [TO CONFIRM: name];
• our sales system (CRM), once the demo form is connected [TO CONFIRM: name];
• Plausible Analytics, only if analytics is switched on;
• Razorpay, for Dexta Books subscription payments.

We may also share data where the law requires it, for example with tax authorities or under a court order.

6. Where it is kept

[TO CONFIRM: where the website, email and CRM data is stored. If any of it is outside India, say where.] Transfers outside India are allowed under section 16 of the DPDP Act, except to countries the Government restricts. None had been restricted as of October 2026.

7. How long we keep it

• Demo requests and sales emails: [TO CONFIRM: for example, 24 months after our last contact, unless you become a customer].
• Billing records: as long as tax and company law require [TO CONFIRM: eight years for books of account].
• Server logs: [TO CONFIRM: at least the 180 days CERT-In requires, and not much longer].

8. Your rights

Under the DPDP Act you can:

• ask for a summary of the personal data we hold about you and how we use it;
• ask us to correct, complete, update or erase it;
• withdraw any consent you gave, as easily as you gave it (this does not undo what was done before);
• name someone to use these rights for you if you die or cannot act;
• make a complaint to us, and, if you are not satisfied, to the Data Protection Board of India.

Write to our privacy contact (address on the Contact page). We may need to confirm who you are first. We will reply within [TO CONFIRM: response time, no longer than the DPDP Rules allow].

9. Children

This website and Dexta are for businesses. They are not meant for anyone under 18, and we don’t knowingly collect children’s data through the website.

10. If your employer uses Dexta

Your employer is responsible for your data inside Dexta. It decides what is collected and why, and it gives you its own privacy notice in Dexta Hub’s Privacy page. That page is also where you see a summary of your data, ask for corrections or erasure, and manage your choices.

We act only on your employer’s instructions, under a written data processing agreement (see our data processing terms). We don’t use your data for our own purposes. If you write to us about data your employer holds, we will pass your request to your employer and help it answer.

Some data inside Dexta is also used by us as a fiduciary: the sign-in records of administrators, and data needed to bill your employer. Sections 3 to 8 cover that.

11. Security

We protect personal data with encryption, access controls, logging and backups. On our cloud, data is kept on servers in India, and backups are encrypted and copied to storage in India. More detail is on our security page. If a breach affects your data, we will tell the people we must tell, as the DPDP Act and the CERT-In directions require.

12. When the law applies

Most of the DPDP Act’s duties apply from 13 May 2027. Until then, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 also apply. [TO CONFIRM: whether this notice should also meet the 2011 Rules’ requirements expressly until May 2027.]

13. Changes to this notice

We will update this page when our practices or the law change, and change the date at the top. If a change affects how we use data you have already given us, we will tell you before it takes effect.