1.About this policy
This policy explains what personal data RG Servers handles, why, on what basis, who else sees it, how long it is kept, how it is protected, and what you can ask of us. It is written to meet the Digital Personal Data Protection Act, 2023 (the Act) and the rules made under it, and it applies to everybody whose personal data we handle.
It does not cover websites or services run by anybody else — including the outside services a shop can connect to our applications, which are governed by their own policies.
2.Definitions
In this policy:
- Personal data means any data about an individual who can be identified by or in relation to it.
- You means the individual whose personal data it is. The Act calls that person the data principal.
- A data fiduciary is whoever decides the purpose and means of processing personal data. A data processor processes it on a data fiduciary's behalf.
- A customer, or a shop, is a business that subscribes to our services.
- The services are the Retail Ecosystem — Retail POS, Warehouse Manager, CRM and HR Manager — hosted and operated by us, together with the network, internet and support services we provide alongside it.
- The website is rgserver.in and every page on it.
3.Who we are, and our two roles
RG Servers (we, us, our) operates the website and provides the services. You can reach us at the address at the foot of this page. We handle personal data in two different capacities, and the rules differ between them:
- As a data fiduciary, for the personal data we collect for our own purposes — from visitors to the website, from people who write to us, and from the people we deal with at our customers and suppliers. Sections 4 to 6 cover this.
- As a data processor, for the personal data a customer puts into the services — about its staff, its customers, its suppliers and its employees. The customer is the data fiduciary for that data: it decides what is collected and why, and we process it only to provide the services and on its instructions. Sections 7 to 9 cover this.
4.Personal data we collect ourselves
4.1When you visit the website
Browsing the website creates no account and no profile, and puts nothing about you in our database. Like every web server, ours records each request it answers: the internet (IP) address it came from, the date and time, the page requested, the page that linked to it, and the description your browser gives of itself.
To stop the contact form being flooded, the website also counts submissions from each address. That count is held in memory only, and discarded when its counting window ends.
4.2When you write to us
If you use the contact form, we keep what you give us:
- your name, and your business's name if you give it;
- your email address, and your phone number if you give it;
- what your message is about, and the message itself;
- the time it arrived, the IP address it came from and your browser's description of itself — so that we can recognise and block automated messages;
- the reference number we give it, and whether our automatic acknowledgement reached you.
If you email us directly, we keep your message and the address it came from.
4.3When your business works with us
We keep the names, job titles and business contact details of the people we deal with at our customers and suppliers, together with our correspondence, support requests, orders, contracts and invoices.
4.4What we do not collect
We do not collect payment card details, and we do not buy personal data from anybody, or gather it from social media. The website uses no analytics, advertising or tracking of any kind — section 17 explains exactly what it does store in your browser.
5.Why we use it, and on what basis
We process personal data only for a lawful purpose: with your consent, or for a use the Act permits without it — such as a purpose you gave the data to us for voluntarily, or complying with the law. We use the data described in section 4:
- to reply to an enquiry, and to continue the conversation it starts;
- to send you an automatic acknowledgement that your enquiry arrived, with its reference;
- to keep the website working and secure, and to detect and stop abuse of it;
- to provide, administer, support and invoice the services we provide to our customers;
- to meet our obligations under tax, accounting and other laws, and to respond to lawful requests from authorities.
We do not use personal data for advertising, sell it, build profiles of people from it, make automated decisions about people with it, or use it to train artificial intelligence.
6.Withdrawing your consent
Where we rely on your consent, you can withdraw it at any time, as easily as you gave it — by writing to the address at the foot of this page. We will then stop processing your data for that purpose, within a reasonable time. Withdrawing consent does not affect what was done before you withdrew it, and it may mean we can no longer reply to you.
7.Personal data we process for our customers
What a customer holds in the services depends on which applications it uses and how it chooses to use them. This section describes what the applications are able to hold.
7.1Retail POS and CRM
- the shop's customers: name, phone numbers, email address, company, loyalty number, birthday and anniversary where the shop records them, billing and delivery addresses, GSTIN and PAN where an invoice needs them, and credit terms;
- what they have bought and returned, the bills and credit notes issued to them, and any balance they owe;
- whether, how and for what they have agreed to be contacted — with when that was given and who asked — and every message sent to them;
- enquiries and orders, the staff member who looks after a customer, follow-ups, wishlists and appointments;
- feedback a customer chooses to give on the shop's counter tablet;
- the shop's salespeople, and the commission they earn.
No card numbers are stored. A card payment is recorded by the reference the shop types in, and a UPI payment by its transaction reference — never by any detail of the account that paid.
7.2Warehouse Manager
The shop's suppliers, goods, stock and the paperwork between them, and photographs and packing videos taken in the warehouse, which may show the people working there. A supplier can be sent a link that shows it the details of one return and nothing else.
7.3HR Manager
- the shop's employees: contact details, job, place of work, manager, pay rate and dates of joining and leaving, and — where the shop records them — date of birth, gender, blood group, address and an emergency contact;
- attendance: each punch's time and device, and a location or photograph only where the shop has switched that on;
- leave, including any medical certificate the leave policy requires;
- pay, payslips, loans and advances, benefits and the dependants they cover, and expense claims with their receipts;
- performance reviews, disciplinary records and workplace complaints. A complaint under the sexual harassment law can be read only by the committee named to hear it, and an anonymous survey records no identity at all;
- identity and bank details — Aadhaar, PAN, UAN, ESIC number, bank account and IFSC, passport and driving licence numbers. These are kept apart from everything else, shown masked, never available through the applications' programming interface, and every time somebody reveals one it is recorded;
- people applying for jobs with the shop: what they enter on the application link and the documents they upload to it.
7.4In every application
- the shop's own users: name, username, role and, if the shop adds one, email address. Passwords are stored only as salted hashes;
- an audit log of who did what and when, from which IP address — recording which fields changed, never their values;
- WhatsApp messages sent and received, if the shop has switched WhatsApp on.
8.How we handle our customers' data
We process a customer's data only to provide, maintain and support the services for that customer, on its instructions, and where the law requires. We do not sell it, use it for advertising, share it with other customers, combine it with anybody else's data, or send any of it to an artificial intelligence service.
Each business's applications run as an installation of its own, with databases of their own, not as rows in a pool shared with other customers. Inside it, the customer decides who sees what: every user has a role, can be limited to particular stores or departments, and every sign-in and change is recorded in an audit log the customer can read.
Within RG Servers, only the people who operate the platform can reach a customer's data, and only when that is needed to keep the services running, to put a problem right, or because the customer has asked.
If your personal data is in a shop's system — as its customer, its employee or a job applicant — the shop decides what happens to it, so the shop is who to ask. If you write to us instead, we will pass your request to the shop and help it answer.
9.Services a shop can switch on
Some features send personal data outside our applications. Every one of them is off until the shop switches it on and supplies its own account, and each is then governed by that provider's terms and privacy policy as well as ours:
- WhatsApp messages, sent and received through Meta's own WhatsApp Business service — the recipient's phone number and the message go to Meta;
- email, sent through the shop's own mail account;
- text messages, through a messaging provider the shop chooses;
- notifications to staff browsers, delivered by the browser maker's push service and encrypted so that service cannot read them;
- links to other systems the shop runs, including attendance devices, and printing and time-clock software installed on the shop's own premises;
- an AI assistant of the shop's own choosing, connected to its data through the MCP server we run — the assistant's provider receives what the assistant asks for.
None of our applications contains analytics or advertising code, and none takes payments through a payment gateway.
10.Who we share personal data with
We share personal data only with:
- the providers who host and carry our services — the datacentre where our servers run and the email service that carries our messages — who process it only on our instructions and are bound to keep it confidential and secure;
- the providers a shop has switched on, as section 9 describes, at the shop's direction;
- a court, regulator, law-enforcement or other government authority, where the law requires us to, or where it is needed to protect somebody's safety or our legal rights.
We share it with nobody else, and we never sell it.
11.Where personal data is processed
Our servers run in a datacentre operated for us. Where personal data is transferred outside India — whether by us, or by a provider a shop has switched on, such as Meta's WhatsApp service — it is transferred only as the Act permits, and never to a country to which the Government of India has restricted transfers.
12.How long we keep it
We keep personal data for as long as the purpose it was collected for needs it, or as long as the law requires, and then delete it.
- Enquiries are kept until we delete them. Nothing deletes them automatically, because an enquiry is often the start of a conversation that runs for months. Ask, and we will delete yours.
- Server records of visits are kept only as long as we need them to keep the website working and secure.
- Records of our dealings with customers and suppliers are kept for the life of the relationship, and afterwards for as long as tax and accounting law requires.
- In the services, the customer decides how long its data is kept. The applications deactivate a record rather than erase it wherever something else depends on it — a customer named on a tax invoice, for instance, which the shop must be able to produce years later. The audit log is kept for the life of the installation.
- Short-lived data expires on its own: a password-reset link after an hour, a sign-in code after five minutes, a staged spreadsheet import after a day, a printed receipt's queue entry after a week.
- What happens to a customer's data when its subscription ends is set out in its agreement with us.
13.How we protect it
- Every page of the website and every application is served over an encrypted connection.
- The website runs no code from anybody else, and a strict content security policy stops a page loading anything we have not put there.
- Enquiries can be read only by our own staff, through an administration panel that is password-protected, rate-limited against guessing, and never linked from the public site.
- Passwords are stored only as salted hashes. A password-reset link works once, and for an hour.
- Keys that let other systems connect are stored hashed and can be limited to what they need.
- Identity and bank numbers are masked on screen, and every reveal is recorded.
- Every business's data sits in an installation of its own, and every sign-in and change inside it is audited.
No system is impossible to break into, and we will not pretend otherwise. What we can promise is that we take these measures, keep them under review, and tell you if they fail.
14.If there is a breach
If a breach affects personal data for which we are the data fiduciary, we will tell the Data Protection Board of India and each person affected, in the form and within the time the Act requires, and say what happened and what we are doing about it.
If a breach affects a customer's data, we will tell that customer without delay, with what it needs to meet its own obligations to the people concerned.
15.Your rights
Under the Act, you can ask the data fiduciary that holds your personal data:
- for a summary of the personal data it holds about you, what it does with it, and who it has shared it with;
- to correct it, complete it or bring it up to date;
- to erase it, unless it is still needed for the purpose you gave it for or a law requires it to be kept;
- to deal with a grievance about how it has been handled;
- to let a person you nominate exercise these rights for you if you die or become unable to.
To exercise a right with us, write to the address at the foot of this page. We may need to confirm who you are before we act. We will acknowledge your request and tell you what we have done about it. If your data is in a shop's system, the shop is the data fiduciary — see section 8.
16.Your duties
The Act also asks something of you when you exercise these rights: to comply with the law, not to impersonate anybody else, not to withhold material information when giving personal data for an official document, not to make a false or frivolous complaint, and to give only information that can be verified as authentic when you ask for a correction.
17.Cookies and your browser
The website sets one cookie — the session cookie — and only when you open the contact form. It holds a security token that stops another website submitting the form in your name, valid for four hours, and, after you send a message, the reference number shown on the thank-you page. It cannot be read by scripts, is only ever sent over an encrypted connection, is never sent to another website, and is deleted when you close your browser.
The homepage also notes in your browser's session storage that you have seen its opening animation, so it is not replayed on every page. That note never leaves your device and is cleared when you close the tab.
Nothing else: no analytics, no advertising, no tracking pixels, no social-media buttons, and no third-party scripts or fonts. Everything the website shows you is served from our own server, so visiting it tells nobody but us that you did.
The applications use one sign-in cookie, which lasts as long as the customer's settings say. They may also store the shop's product list in the browser so that the counter stays fast, and a subscription for staff notifications if somebody asks for them.
18.Children
The website and the services are for businesses. They are not directed at children, and we do not knowingly collect personal data from anybody under 18.
A shop that records a child's personal data in the services is responsible for obtaining the verifiable consent of the child's parent or lawful guardian that the Act requires.
19.Links to other websites
Where the website links to another website, that website's own privacy policy applies to it. We are not responsible for how other websites handle personal data.
20.Grievances
Our grievance officer handles complaints about how we process personal data. Write to the address at the foot of this page with privacy grievance in the subject, say what happened, and say what you would like us to do. We will acknowledge it and answer it within the time the Act requires.
If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
21.Changes to this policy
When this policy changes, the date at the top of this page changes with it, and the previous version is available on request. If a change affects how we use personal data we already hold, we will tell the people it affects, rather than rely on their noticing the date.
Questions
Write to info@rgserver.in. A person reads it.
See also our terms of service.