Sundior Technologies

1. INTRODUCTION & REGULATORY FRAMEWORK

This Privacy Policy (“Policy”) governs the collection, receipt, storage, processing, disclosure, transfer, and protection of personal data and sensitive personal information collected by Sundior Technologies Private Limited (“Company”, “Sundior”, “we”, “us”, or “our”) through our mobile application Sundior (available on Google Play Store under package name com.sundior.crm), web dashboards, application programming interfaces (“APIs”), and related software services (collectively, the “Platform” or “CRM”).

This Policy is formulated in strict compliance with the prevailing legal framework governing information technology, data protection, and cybersecurity in the Republic of India, specifically:

1. The Digital Personal Data Protection Act, 2023 (“DPDPA 2023”) and rules enacted thereunder;
2. The Information Technology Act, 2000 (“IT Act”), specifically Sections 43A, 69, 72A, and 79;
3. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”);
4. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“IT Intermediary Rules 2021”);
5. The directions issued by the Indian Computer Emergency Response Team (“CERT-In”) under Section 70B(6) of the IT Act regarding cybersecurity incident response; and
6. Google Play Developer Program Policies on User Data, Permissions, and Scoped Storage.

By downloading, installing, registering on, accessing, or utilizing the Sundior CRM, you (the “User”, including Channel Partners, Associates, Administrators, and authorized personnel) acknowledge that you have read, understood, and consented to the data practices outlined herein. If you do not agree with any terms of this Policy, you must refrain from installing, accessing, or using the Platform.

2. DEFINITIONS

For the purposes of this Privacy Policy, capitalized terms shall have the meanings attributed below, consistent with the DPDPA 2023 and the SPDI Rules:

3. CATEGORIES OF DATA WE COLLECT

Sundior CRM is a dedicated B2B enterprise workflow platform. We collect only such data as is adequate, relevant, and strictly limited to the operational fulfillment of solar EPC lead management, partner onboarding, and project stage tracking.

A. Information Provided Directly by Registered Users

1. User Identity & Passwordless Authentication Data:
   • Full legal name, professional email address, mobile phone number.
   • One-Time Password (OTP) Authentication: Sundior CRM operates a secure passwordless authentication system. Users do not set or store static passwords. Authentication during sign-up and login is performed via ephemeral, single-use One-Time Passwords (OTPs) transmitted to the user's registered mobile number or email. OTPs expire within minutes and are invalidated immediately upon first use or timeout; no persistent passwords or password hashes are stored on our servers.
   • Role designation (admin, subadmin, partner, or associate).
2. Channel Partner Business & KYC Information:
   • Registered entity name, Goods & Services Tax Identification Number (GSTIN), Permanent Account Number (PAN).
   • Registered business address, city, state, and postal pincode.
   • Business credentials: team strength, years of experience, annual turnover bracket, past solar projects completed, capacity of biggest project completed, and core area of expertise.
   • Government certificates, company registration documents, and profile pictures uploaded via the system file picker.
3. Associate Profile & Remittance Data:
   • Full name, mobile number, email address, postal address (state, city, pincode).
   • Bank account details, IFSC code, UPI ID, or PAN for statutory Tax Deducted at Source (TDS) under Section 194H of the Income Tax Act, 1961, and processing verified commission payouts.

B. Information Processed Regarding Customer Leads (End Clients)

When Channel Partners or Associates register a solar lead on the Platform, they submit data regarding the prospective solar buyer:

• Customer / Contact person name and designation.
• Customer telephone / mobile contact number and email address.
• Site installation address (complete street address, city, state, postal code).
• Proposed solar plant capacity (in kW/MW), utility tariff details, electricity consumer number, or electricity bills.
• Structural roof photographs, site survey reports, single-line electrical diagrams, and engineering feasibility documents.

C. Automatically Collected Technical & Device Data

When you access the CRM via our Android application or web portal, our servers automatically log technical metadata:

• Device & Connection Details: Device manufacturer, hardware model, operating system version (e.g., Android 12, 13, 14, 15), unique device identifiers, network operator, and Internet Protocol (IP) address.
• App Usage & Diagnostic Logs: API request timestamps, latency, HTTP error codes, crash stack traces, and session tokens.
• Security Audit Trails: Timestamped records of user logins, role actions, phase approvals, query replies, and lead deletions.

4. MOBILE DEVICE PERMISSIONS & JUSTIFICATIONS

In accordance with Google Play Developer Policies and Scoped Storage principles, Sundior requests the minimum device permissions required for business operations:

5. PURPOSE AND LAWFUL BASIS OF PROCESSING

Under Section 4 and Section 6 of the DPDPA 2023, Sundior processes personal data strictly for lawful, explicitly notified purposes:

1. Authentication & Identity Verification: Verifying partner identities, conducting business KYC audits, and preventing multi-accounting or fraudulent registrations.
2. Lead Lifecycle Management: Facilitating lead review, project feasibility checks, phase updates (Survey, Design, BOQ, Negotiation, Execution, Quality Audit, Commissioning, and Handover).
3. Partner Assignment & Operations: Enabling assigned EPC partners to review installation sites, schedule site visits, and upload engineering deliverables.
4. Financial Accounting & Commission Payouts: Computing referral payouts, generating commercial invoices, deducting applicable statutory withholding taxes (TDS), and disbursing partner commissions.
5. System Notifications & Commercial Comms: Sending essential transactional SMS, emails, push alerts, and query updates regarding lead statuses or approval reviews.
6. Statutory & Legal Compliance: Adhering to applicable Indian accounting, taxation (GST, Income Tax), corporate (Companies Act, 2013), and cyber incident guidelines (CERT-In).

6. DISCLOSURE AND SHARING OF PERSONAL DATA

Personal data is disclosed only under the following strictly controlled circumstances:

1. Role-Based Internal Access:
   • Administrators & Sub-administrators: Full operational access to audit, assign, approve, or reject leads and manage financial commissions.
   • Assigned Channel Partners: Granted access only to leads officially assigned to them for site engineering, survey, and physical installation.
   • Originating Associates: Permitted visibility only into the progress status, query history, and commission calculations for leads they submitted.
2. Vetted Cloud & Infrastructure Service Providers (Data Processors):
   • Cloud Infrastructure: Cloud servers, serverless compute, and databases hosted via Amazon Web Services (AWS) in the Asia Pacific (Mumbai) region (ap-south-1), within the sovereign territory of the Republic of India.
   • Communication Gateways: Indian TRAI-compliant SMS gateways and transactional email delivery networks operating under non-disclosure and processing agreements.
3. Mandatory Compliance with Law Enforcement & Judicial Authorities:
   • We may disclose data where mandated by a formal written requisition issued under Section 69 or Section 91 of the Code of Criminal Procedure, 1973 (or Bharatiya Nagarik Suraksha Sanhita, 2023), IT Act orders, court subpoenas, or competent tax authority notices (GST/Income Tax).
   • In the event of a verified cybersecurity incident, metadata may be reported to CERT-In pursuant to Rule 12 of the CERT-In Rules, 2013.

7. DATA STORAGE, CROSS-BORDER TRANSFERS & RETENTION

A. Data Residency (Stored in India)

All personal data, customer lead archives, partner credentials, and uploaded project documentation are physically stored on encrypted cloud infrastructure hosted in Mumbai, India (ap-south-1). In full compliance with Section 16 of the DPDPA 2023, personal data is processed within India and will not be transferred to any foreign country or territory blacklisted or restricted by the Central Government of India.

B. Security Architecture & Safeguards (Section 43A IT Act)

We implement comprehensive technical, operational, and physical controls conforming to ISO/IEC 27001 standards and Rule 5 of the SPDI Rules:

• Encryption in Transit: All network transactions between the Sundior mobile app, web dashboard, and API servers are encrypted using Transport Layer Security (TLS 1.2 / TLS 1.3) with strong cipher suites.
• Encryption at Rest: Sensitive database tables, partner financial details, and document object stores utilize AES-256 bit encryption.
• Authentication: Stateless, role-based JSON Web Tokens (JWT) with automated session expiry and cryptographic signature verification.
• Access Controls & Principle of Least Privilege: Access to production databases is restricted to authorized systems engineers via multi-factor authentication (MFA) and audited VPN tunnels.
• Input Sanitization & Vulnerability Audits: Protection against SQL Injection, cross-site scripting (XSS), insecure direct object references (IDOR), and parameter tampering.

C. Data Retention Schedule

We retain personal data only for as long as necessary to fulfill the operational business purposes set out in this Policy:

• Active Accounts: Retained for the duration of the commercial relationship and subscription.
• Closed / Rejected Leads: Retained for a period of twelve (12) months for historical audit trails, after which they are permanently purged unless tied to financial disputes.
• Financial & Taxation Records: Project invoices, commission payout receipts, GST logs, and TDS declarations are retained for a minimum statutory period of eight (8) financial years to satisfy the mandatory retention requirements under the Income Tax Act, 1961, and Goods and Services Tax Act, 2017.

8. DATA PRINCIPAL RIGHTS (DPDPA 2023 COMPLIANCE)

Under Chapter III of the Digital Personal Data Protection Act, 2023, you and your prospective solar leads possess enforceable legal rights regarding personal data:

1. Right to Access Information (Section 11): You have the right to obtain a summary of personal data being processed, a list of third-party processors involved, and any other relevant processing details.
2. Right to Correction and Erasure (Section 12):
   • You may request correction of inaccurate, misleading, or outdated personal data.
   • You may request completion of incomplete personal data.
   • You may request erasure of personal data that is no longer necessary for the purpose it was collected or where consent is withdrawn, subject to statutory tax and accounting retention mandates.
3. Right to Grievance Redressal (Section 13): You have the right to register complaints regarding data privacy violations with our designated Grievance Officer and receive an expeditious resolution within statutory timelines.
4. Right to Nominate (Section 14): You have the right to designate any individual who, in the event of your death or incapacity, shall exercise your privacy rights under the Act.
5. Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time through account settings or by emailing it@sundiortechnologies.com. Withdrawal of consent does not affect the lawfulness of processing undertaken prior to such withdrawal.

How to Request Account & Data Deletion

In compliance with Google Play Store User Data Deletion requirements:

• In-App Account Deletion Trigger: Authenticated users can tap the “Delete Account” button located at the bottom of the Partner Profile and Associate Profile screens in the Sundior mobile app to view deletion instructions or launch their registered email client.
• Direct Email Request: Users can submit an account deletion request by emailing it@sundiortechnologies.com (or support@sundior.in) from their registered email address with the subject line: “Account Deletion Request”.
• Verification & Query Resolution: Upon receipt of an email request, our support and IT team will verify user credentials, review any active solar EPC commitments or open administrative queries, and coordinate with the user. If the user ultimately confirms that account closure is desired, the account, partner credentials, and associated personal data will be permanently deleted.
• Processing Time & Statutory Exceptions: The deletion process is completed within fifteen (15) business days. Non-financial profile data is permanently purged from active databases. Records required to satisfy statutory Indian tax, GST, and corporate accounting laws (under the Income Tax Act, 1961, and CGST Act, 2017) are retained strictly as required by law.

9. PROTECTION OF CHILDREN'S PERSONAL DATA

Sundior CRM is strictly a Business-to-Business (B2B) enterprise application engineered for solar professionals, contractors, and corporate associates.

In strict adherence to Section 9 of the DPDPA 2023:

• We do not knowingly solicit, collect, or process personal data from any person below eighteen (18) years of age (“Child”).
• We do not engage in behavioral tracking, profiling, or targeted marketing directed at minors.
• If we become aware that personal data of an individual under 18 has been inadvertently submitted, we will immediately take steps to purge such data from our servers.

10. GRIEVANCE REDRESSAL MECHANISM & GRIEVANCE OFFICER

Pursuant to Rule 5(9) of the SPDI Rules, 2011, Rule 3(2) of the IT Intermediary Rules, 2021, and Section 13 of the DPDPA 2023, Sundior Technologies Private Limited has appointed a designated Grievance Redressal Officer to handle data protection inquiries, security incidents, and user grievances:

Redressal Process & Timelines:

11. CYBERSECURITY INCIDENT MANAGEMENT & CERT-In COMPLIANCE

In adherence to Section 70B of the IT Act, 2000, and the directions issued by CERT-In:

• Sundior monitors system logs, API traffic, and server infrastructure for cybersecurity incidents, unauthorized intrusion, DDoS attempts, and data exfiltration.
• In the event of a verified cybersecurity incident or personal data breach affecting Indian users, Sundior shall notify CERT-In within six (6) hours of becoming aware of the incident, as mandated by CERT-In Directions 2022.
• Notice will simultaneously be served to affected Data Principals and the Data Protection Board of India with mitigation advisories, as required by Section 8(6) of the DPDPA 2023.

12. AMENDMENTS TO THIS PRIVACY POLICY

We reserve the right to amend, update, or modify this Policy periodically to reflect technological advancements, evolving legal requirements under the DPDPA 2023 rules, or modifications in our business workflow.

When material changes occur:

• We will update the “Last Updated” date at the top of this document.
• We will provide an in-app notice, banner alert, or email notification to registered users prior to the changes taking effect.
• Your continued access or use of the Platform after the effective date of an amended Policy signifies your formal acknowledgment and acceptance of the revised terms.

13. CONTACT & NODAL COMMUNICATION

For any questions, clarifications, legal notices, or feedback concerning this Privacy Policy, please communicate with us at: