Privacy Policy

1. Introduction

Hubcheck (“we”, “our”, or “us”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, store, process, and protect your information when you visit our website, use our services, or communicate with us.

This policy is designed to comply with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and other applicable data protection regulations.

2. Data Fiduciary

For the purposes of the DPDP Act, 2023, Hubcheck acts as a Data Fiduciary. We determine the purpose and means of processing your personal data.

3. Personal Data We Collect

We collect the following categories of personal data based on your interaction with us:

• Contact Information: Name, email address, phone number, company/organization name, and job title.
• Professional Information: Resume/CV, work experience, education details, and professional references (for job applications).
• Service Data: Warehouse locations, operational logs, stock records, and facility information required to execute audit scopes.
• Technical Data: IP address, browser type, device information, operating system, and interaction history on our website.
• Communication Data: Messages, inquiries, and correspondence sent through our website forms.

4. Purpose of Data Collection

We process your personal data for the following purposes, each supported by valid legal bases under the DPDP Act:

• Service Delivery: To provide warehouse audit, stock verification, collateral monitoring, and due diligence services (Contract Performance).
• Communication: To respond to inquiries, service requests, and provide technical support (Legitimate Interest).
• Employment: To process job applications and evaluate candidates (Consent).
• Compliance: To meet legal and regulatory obligations, including ISO 27001 and SOC 2 compliance (Legal Obligation).
• Security: To ensure platform security, prevent fraud, and protect against operational risks (Legitimate Interest).

5. Legal Basis for Processing

Under the DPDP Act, 2023, we process your personal data based on:

• Consent: Where you have given explicit, informed, and free consent for specific purposes (e.g., job applications, marketing communications).
• Contract Performance: Where processing is necessary to fulfill a contract with you or your organization.
• Legitimate Interest: Where processing is necessary for our legitimate business interests, such as improving our services and ensuring security.
• Legal Obligation: Where processing is required by applicable laws, regulations, or court orders.

You may withdraw your consent at any time by contacting us at Support@brightoindia.com.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Inquiry Data: Retained for 12 months from the date of submission or until the inquiry is resolved, whichever is later.
• Job Application Data: Retained for 24 months from the date of application. Unsuccessful applications are deleted after this period.
• Service Data: Retained for the duration of the service contract plus 7 years as required by Indian law.
• Technical Data: Retained for 12 months for security purposes.

7. Data Security (ISO 27001 & SOC 2 Compliance)

As an ISO 27001-certified and SOC 2 audited company, Hubcheck implements stringent administrative, physical, and technical safeguards:

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Access is restricted exclusively to authorized personnel on a need-to-know basis.
• Regular security audits, penetration testing, and vulnerability assessments are conducted.
• Multi-factor authentication (MFA) is enforced for all internal systems.
• Incident response procedures are in place to address any data breaches within 72 hours.

8. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. Information is shared only:

• With client-approved financial institutions (banks, NBFCs) as specified in engagement contracts.
• With trusted service providers who assist in our operations (hosting), bound by Data Processing Agreements.
• Where required under applicable laws, regulations, or court orders.

Third-Party Services Used:

• Hostinger VPS: Website hosting and deployment. Data processed: Usage data, IP addresses. Stored in: Global CDN.

9. Your Rights Under the DPDP Act

As a Data Principal under the DPDP Act, 2023, you have the following rights:

• Right to Access: You may request a copy of all personal data we hold about you.
• Right to Correction: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data when it is no longer necessary for the purpose it was collected.
• Right to Withdraw Consent: You may withdraw your consent at any time, and we will cease processing your data.
• Right to Grievance Redressal: You may file a complaint with our Grievance Officer if you believe your data protection rights have been violated.
• Right to Nominate: You may nominate another individual to exercise your rights in the event of your death or incapacity.

10. Cookies and Tracking

Our website uses only essential cookies required for core website functionality. We do not use any analytics, advertising, or tracking cookies.

• Essential Cookies: Required for core website functionality and security.

You can manage or disable cookies through your browser settings.

11. Data Deletion

You may request deletion of your personal data at any time by:

• Emailing us at Support@brightoindia.com with subject line “Data Deletion Request”.
• Include your full name, email address, and the specific data you wish to have deleted.

We will process your deletion request within 30 days and confirm completion via email. Some data may be retained if required by applicable law.

12. Grievance Officer

In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000, the name and contact details of our Grievance Officer are:

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. Material changes will be communicated via email or prominent notice on our website.