Privacy Policy
Last updated: 16 October 2026 · Version 2.1
This Policy explains how Simpro Software Solutions Private Limited collects, uses, discloses, retains and protects personal data when you visit our website, contact us, or use any product or service we provide. Please read it alongside our Terms of Service.
1. Introduction
This Privacy Policy (“Policy”) applies to your use of https://simprosoftware.in, any software product, application or service we make available (collectively, the “Services”), and any interaction you have with us by email, telephone or in person.
The terms “we”, “our” and “us” refer to Simpro Software Solutions Private Limited, a company incorporated under the Companies Act, 2013 (CIN U62013TN2025PTC177018), with its registered office at No. 118, Kattur, SIDCO Women Industrial Estate, Thirumullaivoyal, Chennai - 600062, Tamil Nadu, India. “You” refers to any individual whose personal data we process.
“Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
2. Our Two Roles: Fiduciary and Processor
We handle personal data in two distinct capacities, and your rights differ depending on which applies. This distinction matters, so we set it out before anything else.
| Capacity | When it applies | Who you contact |
|---|---|---|
| Data Fiduciary | Data you give us directly — website enquiries, demo requests, sales correspondence, and the administrative and billing contacts of our customer organisations. We decide why and how this data is processed. | Us, using the details in this Policy |
| Data Processor | Data that a customer organisation — such as a cooperative society, Nidhi company, finance institution or school — enters into our products about its own members, clients, students or staff. We process it only on the documented instructions of that organisation. | The organisation that holds your records |
If you are a member of a cooperative society, a customer of a Nidhi company or finance institution, or a student or parent at a school that uses our software or services, that organisation is the Data Fiduciary for your records. We do not decide how that data is used, and we cannot amend or delete it on your instruction. Please raise such requests with that organisation directly. We will support them in responding to you.
3. Information We Collect
We limit collection to what is necessary for the purposes described in Section 4.
3.1 Enquiry and Contact Information
- Full name
- Email address
- Telephone or mobile number
- Organisation name, role and location
- The content of any message, enquiry or demo request you send us
3.2 Customer Account and Billing Information
Where your organisation purchases a product or service from us, we collect:
- Authorised contact names, designations, email addresses and telephone numbers
- Organisation registration details, billing address and GST identification number
- Purchase orders, order forms, invoices and payment records
- Transaction references, payment status and settlement reports received from our payment gateway partner
We do not collect or store complete card numbers, CVV codes, UPI PINs, net-banking credentials or any other payment authentication data. These are captured and processed directly by our payment gateway partner on infrastructure certified to the Payment Card Industry Data Security Standard (PCI DSS).
3.3 Product Login Credentials
- Username and password, stored only as a salted cryptographic hash and never in readable form
- One-time passwords issued for verification, retained only for the period they remain valid
- Session tokens and login timestamps
3.4 Customer Data Held on Behalf of Clients
Our products store records that our customer organisations enter and control. Depending on the product, these may include member, depositor, borrower, client, student or employee records, financial and accounting entries, documents and assessment data. Where a customer engages our IT-enabled services, this also includes the identity documents we process for KYC and CKYC work — such as Aadhaar, PAN and photographs — and the financial records needed to prepare a tax return or support an audit. We process this category strictly as a Processor under Section 2, and we do not use it for any purpose of our own.
3.5 Information Collected Automatically
- IP address, approximate region and browser type
- Device identifiers and operating system
- Pages viewed, referring page and navigation path
- Session duration, timestamps and diagnostic error logs
We use this to operate and secure the Services and to understand aggregate usage patterns. Individuals are not identified from aggregated statistics.
4. How We Use Your Information
We process personal data only for the following purposes:
- Responding to your enquiries, demo requests and support requests
- Providing, operating, maintaining and improving the Services
- Provisioning access, issuing licences and delivering the products your organisation has purchased
- Processing payments, issuing invoices and receipts, and maintaining financial records
- Sending service communications such as renewal notices, security advisories and policy updates
- Detecting, investigating and preventing fraud, abuse and unauthorised access
- Meeting our obligations under applicable law, including tax, accounting and audit requirements
- Enforcing our Terms of Service and establishing or defending legal claims
If we ever wish to use your personal data for a purpose materially different from those listed above, we will seek your consent first.
5. Legal Basis for Processing
Under the DPDP Act we process personal data on one of the following bases:
| Basis | Applies to |
|---|---|
| Consent | Website enquiries, demo requests, marketing communications, and any optional information you choose to provide |
| Legitimate use — performance of contract | Account provisioning, service delivery, billing, support and renewals for a subscribing organisation |
| Legal obligation | Retention of financial and tax records, and disclosures required by law or a competent authority |
| Processor instruction | Customer data held inside our products, processed on the documented instructions of the customer organisation |
Where processing rests on consent, you may withdraw it at any time using the contact details in Section 18. Withdrawal does not affect processing carried out before withdrawal, and may mean we can no longer provide part or all of the Services.
6. Information Sharing
We do not sell, rent or trade personal data to any third party. We share it only as set out below.
6.1 Categories of Recipient
| Recipient | Purpose | Data shared |
|---|---|---|
| Payment gateway partner | Processing payments, refunds and settlement reconciliation | Name, email, telephone, billing address, order reference and amount |
| Cloud infrastructure providers | Hosting, storage, backup and disaster recovery | Data stored within the Services, encrypted in transit and at rest |
| Communication service providers | Delivery of transactional email, SMS and notifications | Name, email address, mobile number and message content |
| Professional advisers | Accounting, audit, tax and legal advice under duties of confidentiality | Only what is necessary for the engagement |
| Professional service partners | A firm of chartered accountants that reviews a tax return or conducts an audit at the customer's request | Only the records needed for that return or audit |
| Statutory registries and portals | Uploading KYC records to the Central KYC Records Registry, or filing a return with the Income Tax Department, on the customer's instructions | Only what that registry or portal requires |
| Customer organisation | Where you are a user within a customer account, its administrators can access records relating to you | Records held in that organisation account |
| Government and regulatory authorities | Where disclosure is required by law | Only what is legally mandated |
Every provider we engage is bound by contractual obligations of confidentiality and security, and may process personal data only on our instructions.
6.2 Legal Disclosures
We may disclose personal data where we have a good-faith belief that doing so is reasonably necessary to:
- Comply with a law, regulation, court order, subpoena or lawful request from a competent authority
- Investigate or take action regarding suspected fraud or illegal activity
- Enforce our Terms of Service or this Policy
- Protect the rights, property or safety of our users, our personnel or the public
6.3 Business Transfers
If we are involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred as part of that transaction. We will notify affected individuals and ensure the recipient remains bound by protections no less stringent than those in this Policy.
7. Data Security
We implement reasonable security safeguards appropriate to the nature of the data we hold, including:
- Encryption of data in transit using industry-standard TLS
- Encryption at rest for sensitive fields and stored documents
- Passwords stored only as salted cryptographic hashes, never in readable form
- Role-based access control, so personnel can access only what their role requires
- Audit logging of access to sensitive records
- Regular backups with tested restoration procedures
- Confidentiality obligations binding our employees and contractors
No method of transmission or storage is completely secure. While we work to protect your personal data, we cannot guarantee absolute security, and any transmission is at your own risk.
In the event of a personal data breach, we will notify the Data Protection Board of India and affected individuals as required under the DPDP Act and the rules made under it.
8. Data Retention
We retain personal data only for as long as necessary for the purpose it was collected, or as required by law.
| Data category | Retention period |
|---|---|
| Website enquiries and demo requests | 24 months from last contact, unless a customer relationship begins |
| Customer account and contact records | Duration of the contract, plus 3 years |
| Invoices, payment and tax records | 8 years from the end of the relevant financial year, as required under the Companies Act, 2013 and applicable tax law |
| Customer data held inside products | As instructed by the customer organisation; deleted or returned on termination per the applicable agreement |
| Application and access logs | 12 months |
| Backups | Rolling 90-day cycle, then overwritten |
Where you ask us to erase your data, we will do so within 30 days except to the extent we are required to retain it by law, in which case it is retained only for that purpose and then deleted.
9. Your Rights
Subject to the DPDP Act and other applicable law, you have the following rights in relation to personal data for which we act as Data Fiduciary:
| Right | How to exercise it |
|---|---|
| Access | Email support@simprosoftware.inwith the subject “Data Access Request” |
| Correction and updating | Email support@simprosoftware.inwith the subject “Data Correction Request” |
| Erasure | Email support@simprosoftware.inwith the subject “Data Deletion Request” |
| Withdraw consent | Use the unsubscribe link in any marketing email, or write to us |
| Nominate | Nominate another individual to exercise your rights in the event of death or incapacity, by written request |
| Grievance redressal | Contact our Grievance Officer as set out in Section 14 |
We respond to all such requests within 30 days. We may need to verify your identity before acting, to ensure we do not disclose data to the wrong person.
11. Children and Student Data
Our website and commercial Services are directed at organisations and are not intended for use by children. We do not knowingly collect personal data directly from children through our website.
Certain products are licensed to schools and may hold records relating to students, including those below 18 years of age. In every such case the school is the Data Fiduciary and is responsible for obtaining verifiable parental consent where the DPDP Act requires it. We process that data solely on the instructions of the school, and we do not use it for tracking, behavioural monitoring or targeted advertising directed at children.
12. Data Location and Transfers
We host the Services on infrastructure operated by established cloud service providers. The storage location applicable to a given product or deployment is specified in the relevant order form or agreement, and is available on request from support@simprosoftware.in.
Where personal data is transferred outside India, we do so only in accordance with Section 16 of the DPDP Act and any restrictions notified by the Central Government, and under contractual safeguards requiring the recipient to maintain equivalent protection.
13. Communications and Preferences
| Type | Examples | Can you opt out? |
|---|---|---|
| Transactional | One-time passwords, invoices and receipts, renewal and expiry notices, security alerts, policy change notifications | No — these are necessary to provide the Services |
| Support | Responses to tickets, incident and maintenance notices | No, while an active engagement exists |
| Marketing | Product announcements, newsletters, event invitations | Yes — unsubscribe in any such email, or write to us |
14. Grievance Redressal
If you have a complaint about how we handle your personal data, please contact our Grievance Officer, appointed under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act:
Vijay Krishna
Head of Support · Grievance Officer
Simpro Software Solutions Private Limited
No. 118, Kattur, SIDCO Women Industrial Estate
Thirumullaivoyal, Chennai - 600062
Tiruvallur District, Tamil Nadu, India
Email: support@simprosoftware.in
| Stage | Timeline |
|---|---|
| Acknowledgement of your complaint | Within 24 hours |
| Substantive response | Within 15 days |
| Resolution | Within 30 days |
If you remain dissatisfied, you may escalate your complaint to the Data Protection Board of India under the DPDP Act.
15. Regulatory Compliance
This Policy is designed to comply with:
- The Digital Personal Data Protection Act, 2023
- The Information Technology Act, 2000
- The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
- The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
- The Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020
- Applicable Reserve Bank of India directions on payment data, as implemented by our payment gateway partner
16. Changes to This Policy
We may update this Policy to reflect changes in our practices, the Services, or the law. Where a change is material, we will give prior notice by email or a prominent notice on the website, and seek fresh consent where the law requires it. Other changes take effect when published.
Each version carries a version number and date at the top of this page. Continuing to use the Services after a change takes effect signifies your agreement to the updated Policy.
17. Governing Law
This Policy is governed by the laws of India. Subject to the dispute resolution provisions of our Terms of Service, the courts at Chennai, Tamil Nadu have exclusive jurisdiction over any dispute arising out of it.
18. Contact Us
For any question about this Policy or about how we handle your personal data, write to support@simprosoftware.in or admin@simprosoftware.in, or use the details in Section 14.
Simpro Software Solutions Private Limited · CIN U62013TN2025PTC177018 · GSTIN 33ABPCS2910L1Z4