This Data Privacy and Data Protection describes how GaragePlug collects, uses and shares the information you provide to us and the information we collect in the course of operating our business and our applications
By accessing this application and/or by availing any of the services, you agree to the terms of this Data Privacy and Data Protection Policy.
1. Terms used in this policy
2. Our commitment towards protecting personal information
3. What data do we collect about you, and for what purpose?
4. Whom do we share your data with?
5. How long do we retain your data?
6. What are your rights regarding your data with us?
7. Contact us
In this Data Privacy and Data Protection Policy:
Your privacy is important to us. We will use your personal information only in the manner set out in this Policy. We act in accordance with the applicable data protection laws, including GDPR. We are committed to safeguarding the privacy of our application visitors, clients, prospects, and research participants. This Policy sets out how we deal with your personal information.
Our commitment towards protecting your personal information includes the following obligations:
The usage data may include your IP address, geographical location, browser type and version, operating system, referral source, as well as information about the timing, frequency and pattern of your Service use. The source of the usage data is our analytics tracking system. In addition, we may use third-party analytics tracking services such as Google Analytics and Facebook Pixel. This usage data may be processed for the purposes of analysing the use of the application and Services in order to improve our performance metrics, and for communicating with you. The legal basis for this processing is your consent. In some cases, the legal basis for this processing is our legitimate interests, namely monitoring and improving our application and Services.
The response data may include your name, area of residence, email address, your responses to the questions that we may ask you. The source of the response data is you. The response data may be processed for the purposes of providing our services, ensuring the integrity of our operations and processes, maintaining back-ups of our databases, and for communicating with you. The legal basis for this processing is your consent.
The profile data may include your name, address, telephone number, email address and employment details. The profile data may be processed for the purposes of enabling and monitoring your use of our application and services and for communicating with you. The legal basis for this processing is your consent. In some cases, the legal basis for this processing is our legitimate interests, namely the proper administration of our application and Services.
The service data may include your name, address, telephone number, email address. The source of the service data is you or your customers. The service data may be processed for the purposes of providing our Services, ensuring the security of our application and Services, maintaining back-ups of our databases, and for communicating with you. The legal basis for this processing is your consent. In some cases, the legal basis for this processing is our legitimate interests, namely the proper administration of our application and business. In some cases, the legal basis for this processing is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract.
The customer relationship data may include your name, your employer, your job title or role, your contact details, and information contained in communications between us and you or your employer. The source of the customer relationship data is you or your employer. The customer relationship data may be processed for the purposes of managing our relationships with customers, communicating with customers, keeping records of those communications, promoting our products and services to customers, and for communicating with you. The legal basis for this processing is your consent. In some cases, the legal basis for this processing is our legitimate interests, namely the proper administration of our application and business. In some cases, the legal basis for this processing is the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract.
The notification data may be processed for the purposes of sending you the relevant notifications and/or newsletters, and for communicating with you. The legal basis for this processing is your consent.
The correspondence data may include the communication content and metadata associated with the communication. Our application will generate the metadata associated with communications made using the application contact forms. The correspondence data may be processed for the purposes of communicating with you and record-keeping. The legal basis for this processing is your consent. In some cases, the legal basis for this processing is our legitimate interests, namely the proper administration of our application and business and communications with our business counterparts.
In addition to the specific purposes for which we may process your personal data set out in this Section, we may process any of your personal data identified in this Policy where necessary for:
We will not sell, share, rent or otherwise intentionally transfer your name, address, telephone number or e-mail address to market research companies, direct marketing companies or anyone else. The only exceptions when we may disclose your personal information to third parties are as follows:
Your personal data that we process for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. We will retain your personal data as follows:
In some cases, it is not possible for us to specify in advance the periods for which your personal data will be retained. In such cases, we will determine the period of retention based on the following criteria:
|Sr. No||Category of Data||Factors on which period of retention will be based|
|1.||Usage data||Parameters of usage being analysed|
|2.||Response data||Terms of Service under which the response is solicited|
|3.||Profile data||Nature of utilization of profile|
|4.||Service data||Nature of Service; covenants of Service contract|
|5.||Customer relationship data||Nature of relationship; covenants of Service contract|
|6.||Notification data||Terms of opt-in|
|7.||Correspondence data||Nature of correspondence; requirements of law|
Not with standing the foregoing provisions of this Section, we may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, or in order to protect your vital interests or the vital interests of another natural person.
This Section summarises the rights that you have under data protection law. Please note that some of the rights available to you are convoluted and may not be represented in detail in this Policy. We advise you to peruse the relevant laws for a complete understanding of your rights. Your principal rights concerning your Personal Data under GDPR are as below:
Subject to the condition that the rights and freedoms of others are not affected, we will supply to you a copy of your personal data. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee. You can request your personal data with us, by emailing us on email@example.com.
However, there are exclusions of the right to erasure. The general exclusions include where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, exercise or defence of legal claims.
You have the right to object to our processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes). If you make such an objection, we will cease to process your personal data for this purpose.
You have the right to object to our processing of your personal data for scientific or historical research purposes or statistical purposes on grounds relating to your particular situation, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
You may exercise any of your rights in relation to your personal data by a written notice to us on firstname.lastname@example.org. In order for us to comply with your request, your notice must clearly state the right that you wish to exercise and identify your information in respect of which you wish to exercise such right. Please note that as a security measure, we may require you to verify your identity before accepting any request concerning your Personal Data.
For additional information, please refer to our:
This policy forms part of the Information Security Management Framework. It should be read in conjunction with the Information Security Policy and all supporting policies.
GaragePlug Policies shall be reviewed at least once annually to reflect changes to Business environment, landscape and improvements considered at various phases of implementation and practices.
It is the responsibility of the Information Technology Function to facilitate the review of this policy on a regular basis. Personnel and Department Head from relevant departments should also participate in the annual review of this policy.
Deficiencies within this policy should be immediately communicated to the Information Technology Function. Policy changes should require the approval of Management.
Change log should be kept current and should be updated as soon as any change has been made
There shall be a business case represented to GaragePlug Management Leaders for a formal approval on the deviations of policies and describing challenges.
Failure to comply with this policy by violating the policies set forth in this document may lead to disciplinary action up to and including termination
Necessary disciplinary action will be taken against any employee not following the policies and procedures laid down by GaragePlug Similarly, action will be taken against those employees encouraging/observing such an activity and not reporting the same to the concerned authority.
Any user found to have violated this policy may be subject to disciplinary action, including but not limited to:
|Acronyms/terms to be defined||Definition|
|Personal Data||Any information relating to an identified or identifiable natural person ("Data Subject") who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.|
|Sensitive Personal Data||Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms. Those personal data include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.|
|Data Controller||The natural or legal person, public authority, agency or any other body, which alone or jointly with others, determines the purposes and means of the processing of personal data.|
|Data Processor||A natural or legal person, public authority, agency or any other body which processes personal data on behalf of a Data Controller.|
|Processing||An operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of the data.|
|Anonymization||Irreversibly de-identifying personal data such that the person cannot be identified by using reasonable time, cost, and technology either by the controller or by any other person to identify that individual. The personal data processing principles do not apply to anonymized data as it is no longer personal data.|
|Pseudonymization||The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. Pseudonymization reduces, but does not completely eliminate, the ability to link personal data to a data subject. Because pseudonymized data is still personal data, the processing of pseudonymized data should comply with the Personal Data Processing principles.|