Privacy Policy
Effective Date: January 01, 2025 | Last Reviewed & Updated: October 24, 2026Official Digital Personal Data Protection Act, 2023 (DPDPA) Compliance Notice
GFT IT Software Solutions strictly adheres to the provisions of the Digital Personal Data Protection Act, 2023 (DPDPA) enacted by the Parliament of India. We respect your privacy and adhere strictly to the Digital Personal Data Protection Act (DPDPA). We do not store, sell, or compromise personal data unnecessarily. All digital personal data processed across our Attendance, HRMS, and IT SaaS suites is handled with verifiable lawful consent and strict purpose minimization.
1. Scope and Preamble
This Privacy Policy sets out the principles and statutory safeguards governing the processing of personal data by GFT IT Software Solutions ("Company", "We", "Us", or "Our"), having its principal office at GFT IT Software Solutions, Commercial Hub, Raipur, Chhattisgarh 492001, India. This policy applies to all Data Principals, clients, enterprise users, employees, and visitors interacting with our website, cloud attendance terminals, mobile applications, and enterprise IT platforms.
2. Digital Personal Data Protection Act (DPDPA, 2023) Compliance
In accordance with Section 4, Section 5, and Section 6 of the DPDPA 2023, GFT IT Software Solutions operates strictly as a responsible Data Fiduciary. We adhere to the following principles:
- Lawful Basis & Consent: We only process digital personal data based on explicit, free, specific, informed, and unambiguous consent given by the Data Principal, or for specified legitimate business uses permitted under Section 7 of the Act.
- No Unauthorized Retention: We do NOT retain your digital personal data beyond the time strictly necessary for fulfilling the specified enterprise purpose for which it was collected or to comply with statutory audit laws.
- Zero Data Selling: We never sell, rent, broker, or commercially distribute client or employee personal data to third-party advertising networks or external data brokers.
- Purpose Limitation & Minimization: Only data strictly necessary for providing HRMS services, geo-attendance verification, and IT support is requested and stored.
3. Categories of Data Processed
| Data Category | Specific Items | Purpose & Legal Basis |
|---|---|---|
| Identity & Contact Data | Full Name, Official Work Email, Mobile/Phone Number, Designation, Employee ID, Company Name. | User authentication, workspace tenancy, enterprise communications, and administrative account management. |
| Attendance & Telemetry Data | Punch timestamp, authorized geofence radius check (lat/long during punch only), device identifier. | Fulfilling employer-employee workforce attendance requirements with explicit organizational consent. |
| Company Compliance Data | Company PAN Card number, GSTIN, registered corporate address. | Statutory tax compliance, invoice generation, and verification of authorized business tenants. |
4. Statutory Rights of the Data Principal
Under Chapter III of the Digital Personal Data Protection Act, 2023, you as a Data Principal hold unequivocal rights regarding your personal data:
Right to Access
You have the right to obtain a summary of personal data being processed and the identities of all entities with whom it has been shared.
Right to Correction & Erasure
You have the right to request correction of inaccurate data, completion of incomplete records, and erasure of personal data no longer necessary for the original purpose.
Right of Grievance Redressal
You have the right to readily available grievance redressal mechanisms with our designated Data Protection Officer.
Right to Nominate
You may nominate an individual who, in the event of death or incapacity, shall exercise your rights as a Data Principal.
5. Technical & Security Safeguards
We implement enterprise-grade technical and organizational measures to prevent unauthorized data access, breach, or compromise, including:
- Encryption at Rest & Transit: Industry standard AES-256 encryption at rest and TLS 1.3 cryptographic protocols during transit.
- Automated IP Threat Firewall: Rapid brute force blocking (lockout after 5 failed attempts) and real-time SQL injection inspection.
- Role-Based Access Control (RBAC): Strict principle of least privilege enforced across multi-tenant database clusters.
6. Designated Grievance Officer & Data Protection Contact
If you have questions, wish to exercise your rights under DPDPA 2023, or have a grievance regarding personal data, please contact our designated office:
Office of the Data Protection & Grievance Officer
Company: GFT IT Software Solutions
Corporate Address: GFT IT Software Solutions, Commercial Hub, Raipur, Chhattisgarh 492001, India
Compliance & Grievance Email: dpo@gft-software.com
Response Turnaround: Within 48 hours for acknowledgment; resolved within statutory timelines.