Privacy Policy
How Quiamo Digital Market Services LLP collects, uses, and protects your personal data.
Contents
1. Who we are
VynDeal is a B2B Customer Relationship Management (CRM) platform operated by Quiamo Digital Market Services LLP, a Limited Liability Partnership incorporated in India, registered office at Bavdhan, Pune, Maharashtra 411021, India.
For the purposes of UK GDPR and EU GDPR, we act as a data controller for personal data of our website visitors and customers, and as a data processor for personal data that customers upload into the VynDeal application (which is governed by our Data Processing Agreement).
For the purposes of the India DPDP Act 2023, we act as a Data Fiduciary for the same scope.
2. Data we collect
2.1 Information you provide
| Category | Examples |
|---|---|
| Account data | Name, business email, company name, job title, password (hashed), phone number |
| Billing data | Billing address, GST/VAT number, payment instrument identifiers (we do not store card numbers — see Razorpay below) |
| Communications | Emails, support tickets, chat messages with our team |
| Marketing preferences | Newsletter subscription status, communication consent |
2.2 Information collected automatically
| Category | Examples |
|---|---|
| Usage data | Pages visited, features used, time of access, click patterns within the application |
| Device & technical data | IP address, browser type and version, operating system, device identifiers, screen size |
| Authentication logs | Login times, login IP addresses, failed login attempts, password reset events |
| Cookies and similar | See our Cookie Policy |
2.3 Data customers upload (processor scope)
Our customers (your employer or business contact) may upload personal data about you into VynDeal — typically business contact information such as your name, work email, work phone, job title, and notes about business interactions. We process this data on behalf of our customer under our DPA. If you have questions about this data, please contact the customer (the data controller) first; we will assist on request.
3. Why we use your data (purposes and lawful bases)
| Purpose | Lawful basis (UK/EU GDPR) | Lawful basis (India DPDP) |
|---|---|---|
| To provide the VynDeal service to you or your employer | Contract performance (Art 6(1)(b)) | Performance of contract |
| To send transactional emails (account creation, password reset, security alerts) | Contract performance / legitimate interests (Art 6(1)(b)/(f)) | Performance of contract |
| To respond to your support enquiries | Legitimate interests (Art 6(1)(f)) | Legitimate uses (s7) |
| To improve the service (analytics, troubleshooting) | Legitimate interests (Art 6(1)(f)) | Legitimate uses (s7) |
| To send marketing communications (newsletters, product updates) | Consent (Art 6(1)(a)) or soft opt-in | Consent (s6) |
| To prevent fraud, abuse, and security incidents | Legitimate interests (Art 6(1)(f)) | Legitimate uses (s7) |
| To comply with legal obligations (tax, accounting, regulator requests) | Legal obligation (Art 6(1)(c)) | Compliance with law (s7) |
If we ever rely on consent, you can withdraw it at any time without affecting prior processing.
4. Who we share your data with
We share personal data only with the following categories of recipients:
- Sub-processors (service providers we use to deliver VynDeal). The current list, including their location and the data protection mechanism, is at /policies/subprocessors.html.
- Professional advisors (lawyers, accountants, insurers) under confidentiality.
- Authorities where required by law (e.g., a valid court order or regulator request).
- Buyers in the event of a sale, merger, or restructuring of Quiamo, with notice to you and the same level of protection.
We do not sell personal data, and we do not share it for advertising purposes.
5. International transfers
VynDeal data is primarily processed in India. Our sub-processors may be located in the United States, the EEA, or other countries. Where we transfer personal data of UK/EEA-based individuals outside the UK or EEA, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914/EU);
- The UK International Data Transfer Addendum (IDTA) issued by the UK ICO; or
- An adequacy decision where one applies (e.g., the EU-US Data Privacy Framework for certified US recipients).
You may request a copy of the transfer mechanism by emailing privacy@vyndeal.com.
6. How long we keep your data
| Data category | Retention period |
|---|---|
| Active customer account data | For the duration of the subscription, plus 30 days post-termination |
| Marketing data (newsletters, prospect contacts) | Until you unsubscribe, or 2 years of inactivity |
| Authentication logs (login events, IP) | 90 days, then anonymised |
| Transactional records (invoices, GST records) | 8 years (Indian Income Tax / GST law) |
| Support tickets | 3 years from resolution |
| Backups | 30 rolling days |
Where you exercise your right to erasure (see section 8), we delete data within 30 days, except where we are required by law to retain it.
7. Security
We implement technical and organisational measures appropriate to the risk, including:
- HTTPS/TLS for all data in transit
- Bcrypt password hashing
- Multi-factor authentication for administrator accounts
- Account lockout after repeated failed login attempts
- Application security headers (helmet.js)
- Rate limiting on authentication endpoints
- Backup encryption
- Role-based access on a least-privilege basis
- Logging of authentication events for at least 90 days
Full technical and organisational measures are listed in Schedule 2 of our DPA. No system is perfectly secure; if you believe your account has been compromised, contact us at security@vyndeal.com immediately.
8. Your rights
Under UK GDPR, EU GDPR, and the India DPDP Act, you have the following rights:
| Right | What it means |
|---|---|
| Access | Receive a copy of personal data we hold about you |
| Rectification / correction | Have inaccurate data corrected |
| Erasure / deletion | Have your data deleted (subject to legal retention) |
| Portability | Receive your data in a structured, machine-readable format |
| Restriction | Restrict processing in certain circumstances |
| Objection | Object to processing based on legitimate interests, including marketing |
| Withdraw consent | Withdraw consent at any time without affecting prior processing |
| Complain | Lodge a complaint with the UK ICO, your local EU supervisory authority, or the India Data Protection Board |
To exercise any right, see our Data Subject Rights page or email privacy@vyndeal.com. We will respond within 30 days. We may need to verify your identity before responding.
UK: Information Commissioner's Office — ico.org.uk — 0303 123 1113
EU: Find your supervisory authority at edpb.europa.eu
India: Data Protection Board of India (when established under DPDP Act).
9. Cookies and similar technologies
We use a small number of cookies and similar storage. Full details, your choices, and the consent banner are described in our Cookie Policy.
10. Children
VynDeal is a B2B service not directed at children. We do not knowingly collect personal data from individuals under 18. If you believe a child's data has been provided to us, contact us at privacy@vyndeal.com and we will delete it promptly.
11. India DPDP Act 2023 specific notices
For Data Principals located in India:
- Grievance officer. Email: grievance@vyndeal.com. Postal: Quiamo Digital Market Services LLP, Bavdhan, Pune, Maharashtra 411021, India. We will acknowledge complaints within 7 days and resolve within 30 days where reasonable.
- Consent withdrawal. You may withdraw any consent at the same level of ease as it was given. Use the unsubscribe link in marketing emails or email privacy@vyndeal.com.
- Verifiable parental consent. We do not knowingly process children's data; if you believe we have, please contact us.
- Significant Data Fiduciary. We do not currently meet thresholds to be classified as a Significant Data Fiduciary; if that changes, we will publish additional disclosures here.
12. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via email to active customers and via banner on our website at least 30 days before they take effect. The version and effective date are at the top of this page.
13. How to contact us
- General privacy questions: privacy@vyndeal.com
- Data subject rights requests: privacy@vyndeal.com or via /policies/gdpr-rights.html
- Security incidents: security@vyndeal.com
- India grievance officer: grievance@vyndeal.com
- Postal: Quiamo Digital Market Services LLP, Bavdhan, Pune, Maharashtra 411021, India