Privacy Policy

1. Scope and who this policy applies to

This Policy applies to visitors to OmniZo websites, authorized users of customer organizations, administrators, sales and field personnel, support contacts, and individuals whose information is entered into the Services in connection with legitimate distribution, retail, inventory, order, field-sales, subscription, support or integration workflows.

Where a customer organization provides us with personal data about its employees, sales personnel, retailers, proprietors, contacts or other individuals, the customer is responsible for ensuring that it has an appropriate lawful basis, notice, authority or consent for providing that data to OmniZo and for configuring the Services in compliance with applicable law.

2. Our role and your organization's role

Depending on the processing activity, OmniZo may act either as a data fiduciary/controller determining the purpose and means of processing, or as a data processor/service provider processing personal data on documented instructions of a customer organization.

• When we process account, subscription, billing, security, service-operation, support, fraud-prevention and compliance data for our own business purposes, OmniZo generally determines the relevant purposes of processing.
• When an organization uses OmniZo to manage its sales personnel, retailer network, attendance, routes, orders, inventory, claims, targets or other business workflows, the organization may be the primary data fiduciary/controller and OmniZo may process that data on its behalf, subject to the customer agreement and applicable law.
• If you are an employee, contractor or sales user of a customer organization, requests concerning data controlled by that organization may need to be handled by the organization. We may assist it in responding where contractually and legally required.

3. Personal data we collect

The exact data processed depends on the modules enabled by your organization, your role, device permissions, integrations and how you use the Services. We may process the following categories:

OmniZo is not designed to require Aadhaar numbers, health information, biometric templates, payment-card credentials or other highly sensitive information unless a specific feature, customer agreement and lawful basis expressly require such processing. Users should not upload unnecessary sensitive personal data into free-text fields or attachments.

4. How we collect personal data

• Directly from you when you register, authenticate, update your profile, check in/out, create orders, visit retailers, submit data, contact support or use a feature.
• From your organization or an authorized administrator when it creates your account, maps you to roles/territories/beats, imports master data or otherwise configures the Services.
• Automatically from your browser, device, app and network when you access or interact with the Services, subject to device permissions and configuration.
• From authorized integrations selected by your organization, such as accounting/ERP systems, messaging/OTP providers, maps/location services, analytics services, cloud infrastructure or APIs.
• From other authorized participants in the same business workflow, for example where a brand, super stockist or distributor creates or shares channel-partner, retailer, order or inventory records visible within the permitted organization hierarchy.

5. How and why we use personal data

We process personal data only for lawful purposes connected with the Services, customer instructions, security, legal obligations and legitimate business operations. Depending on applicable law, processing may be based on consent, performance of a contract, compliance with law, specified legitimate uses or another lawful basis.

• Provide, configure, administer and support the Services and enabled modules.
• Authenticate users through OTP or other supported methods and manage sessions and access.
• Enforce role-based access control, organization hierarchy, module entitlements and user caps.
• Record attendance, check-in/check-out, field visits, routes, beats, retailer interactions and operational activity where those features are enabled.
• Process orders, inventory movements, sales targets, tasks, schemes, claims, settlements, reports, exports and other workflows.
• Synchronize authorized data between the mobile app, web platform, APIs and customer-selected integrations.
• Send transactional or service communications such as OTPs, order confirmations, security notices and support messages through channels configured by the customer.
• Detect, prevent and investigate unauthorized access, abuse, fraud, security incidents, data corruption and policy violations.
• Monitor performance, troubleshoot failures, analyze product usage and improve reliability and functionality.
• Administer subscriptions, billing, entitlements and account renewals.
• Comply with law, lawful requests, audits, court orders, cybersecurity directions and contractual obligations, and establish, exercise or defend legal claims.
• Create aggregated or de-identified analytics that do not reasonably identify an individual, for service improvement, capacity planning and business intelligence.

We do not sell personal data in exchange for monetary consideration. We do not use customer business data to advertise unrelated third-party products to individual users unless separately disclosed and lawfully permitted.

6. Location and field-force data

The SFA application may request device location permission because certain field-sales functions depend on location. Depending on configuration, location may be recorded at events such as attendance check-in/check-out, retailer visits, route/beat activity or other field actions. Continuous or background location should only be processed when a deployed feature expressly requires it, the operating system permission allows it, and the customer organization has provided the required notice and lawful basis.

Location data may be visible to authorized managers or administrators of the customer organization and may be used for attendance validation, route verification, field productivity, operational planning, safety, fraud prevention and audit purposes. OmniZo does not independently determine employee attendance policy, working hours or disciplinary use of location data; those decisions are the responsibility of the relevant customer organization.

You may disable location permission through your device settings, but location-dependent features may then be unavailable or may not function correctly. Your organization may separately require location-enabled use as part of its employment or operational policies, subject to applicable law.

7. Offline mobile storage and synchronization

Where offline mode is enabled, the mobile application may temporarily store business and personal data on the device so that permitted functions can continue without an internet connection. Data created offline may be assigned temporary local identifiers and synchronized with the backend when connectivity returns. Backend-generated identifiers, statuses or conflict-resolution rules may then be applied to the synchronized record.

Users should protect the device with appropriate access controls, promptly report lost or compromised devices, and synchronize pending records when connectivity is available. Local cached data may remain on the device until it is synchronized, cleared by the app, removed through logout/uninstallation where supported, or otherwise deleted according to the application's storage logic and operating-system behavior.

8. Cookies, analytics and similar technologies

Our websites and web applications may use cookies, local storage, session tokens and similar technologies that are strictly necessary for login, security, preferences and service operation. We may also use analytics or performance technologies to understand usage and diagnose reliability issues. Where consent is required by applicable law for non-essential cookies or similar tracking, we will request it before using those technologies.

You can control cookies through your browser settings, although blocking essential cookies may prevent authentication or other core functions.

9. How we share personal data

We disclose personal data only when reasonably necessary for the purposes described in this Policy, subject to access controls, contracts and applicable law. Recipients may include:

• Your customer organization and its authorized administrators, managers or users, according to role-based permissions and organization mappings.
• Authorized channel partners within a configured business relationship (for example brand, super stockist, distributor or retailer), but only to the extent the relevant data and workflow are intended to be shared across that relationship.
• Service providers and sub-processors supporting hosting, databases, storage, backups, content delivery, monitoring, analytics, customer support, email, SMS/WhatsApp or other OTP/notification delivery, maps/location services, security, and similar technical operations.
• Third-party systems or integrations that your organization instructs us to connect to, such as Tally/accounting, ERP or other business systems. Data exchanged through such integration is also governed by the third party's terms and privacy practices.
• Professional advisers, auditors, insurers, acquirers, investors or counterparties where reasonably necessary for legal, financial, corporate or transaction purposes and subject to appropriate confidentiality obligations.
• Government authorities, regulators, law-enforcement agencies, courts or other persons where disclosure is required or permitted by applicable law, a lawful order, cybersecurity direction or to protect rights, safety, security and integrity.

We require service providers handling personal data on our behalf to use it only for authorized purposes and to implement reasonable security and confidentiality measures appropriate to their role.

10. International or cross-border processing

OmniZo is designed primarily for customers in India and may use infrastructure or service providers located in India and/or other jurisdictions. Where personal data is transferred or made accessible outside India, we will do so in accordance with applicable contractual requirements, customer instructions, government restrictions and data-protection law. If the Government of India restricts transfer to a particular country or territory under applicable data-protection law, we will implement the required controls.

11. Data retention

We retain personal data for no longer than reasonably necessary for the purpose for which it was processed, the duration of the customer relationship, legitimate operational requirements, dispute resolution, security, backups, contractual obligations and applicable law. Retention depends on the category of record and the role in which we process it.

• Customer-controlled business records are generally retained for the customer's subscription term and any agreed post-termination retention/export period, unless earlier deletion is instructed or later retention is legally required.
• Account and support records may be retained for a reasonable period after account closure to complete offboarding, prevent fraud, resolve disputes and demonstrate compliance.
• Security and ICT logs may be retained for at least the period required by applicable cybersecurity directions. Current CERT-In directions require covered entities to maintain ICT system logs securely for a rolling period of 180 days within India.
• Backups may retain deleted data for a limited additional period until overwritten in the ordinary backup cycle, subject to access restrictions and non-production use.

When personal data is no longer required and no lawful retention basis applies, we will delete, anonymize or otherwise render it non-identifying in accordance with our retention procedures and contractual commitments.

12. Security safeguards

We use reasonable technical and organizational safeguards designed to protect personal data against unauthorized access, disclosure, alteration, loss or destruction. Measures may include role-based access control, least-privilege authorization, authentication controls, network protections, encryption in transit, appropriate encryption or protection of stored data, environment separation, secure development practices, monitoring, backups, logging, vulnerability management and incident-response procedures.

No online service, device or transmission method is completely secure. Users and customer organizations are also responsible for safeguarding devices, credentials, OTPs, integration keys and administrator access, promptly revoking access for departed personnel, and configuring permissions appropriately.

13. Data breach and incident response

If we become aware of a personal-data breach or cybersecurity incident affecting the Services, we will investigate, contain and remediate the incident and will notify affected customer organizations, individuals, regulators, CERT-In, the Data Protection Board of India or other authorities to the extent and within the timelines required by applicable law and contractual commitments. We may provide information in stages as facts become available and may take measures necessary to preserve evidence and protect the Services.

14. Your privacy rights and choices

Subject to applicable law, contractual roles and identity verification, you may have rights to obtain information about processing, access a summary of personal data and disclosures, correct or update inaccurate data, complete incomplete data, request erasure when retention is no longer necessary, withdraw consent where processing is based on consent, raise a grievance, and nominate another individual to exercise rights in circumstances recognized by law.

To exercise rights, use the privacy/grievance contact listed below or the in-product mechanism when available. If your account is controlled by a customer organization and the request concerns data that OmniZo processes only on that organization's instructions, we may forward the request to or coordinate with the organization. We may request reasonable information to verify identity and authority before acting.

Withdrawal of consent does not affect processing already carried out lawfully before withdrawal and may make some Services unavailable where the relevant data is necessary to provide them. Rights may also be limited where retention or processing is required by law, necessary for legal claims, or otherwise exempt under applicable law.

15. Children's data

OmniZo is a business and workforce platform and is not intended for use by children. Users who create accounts must be legally capable of entering the applicable agreement and, unless a customer agreement expressly provides otherwise in compliance with law, must be at least 18 years old. We do not knowingly seek to collect personal data directly from children through the Services.

16. Third-party links and integrations

The Services may contain links to or interoperate with third-party services. Once data is transmitted to a third party at your organization's request, the third party may process that data under its own terms and privacy policy. OmniZo is not responsible for independent third-party privacy practices except to the extent required by applicable law or expressly agreed in writing.

17. Changes to this policy

We may update this Policy to reflect product changes, legal requirements, security practices, integrations or business operations. The "Last updated" date will be revised when we publish an updated version. If a change materially affects how we process personal data, we will provide additional notice or obtain consent where required by law. Continued use after an update is subject to the applicable legal requirements for notice and consent and does not override rights that cannot lawfully be waived.

18. Contact and grievance redressal

For privacy questions, rights requests, complaints or grievances, contact:

Provider / product

OmniZo Technologies / OmniZo

Registered legal entity

OMNIZO TECHNOLOGIES PRIVATE LIMITED

Registered office

4/444 Oshiwara Shantivan, D CHS LTD Plot - 44, Andheri, Mumbai, Mumbai- 400053, Maharashtra

Privacy / Grievance contact

Mrs. Gayatri Gogate, CEO, gayatri@omnizo.ai

Website

https://omnizo.ai

We will use reasonable efforts to acknowledge and resolve grievances within the period required by applicable law. Where the Digital Personal Data Protection Act, 2023 and related Rules provide a right to approach the Data Protection Board of India, that right will be available in accordance with the provisions then in force after the applicable grievance process has been used.

19. India-specific legal framework

This Policy is intended to support compliance with applicable Indian law, including the Information Technology Act, 2000, applicable rules concerning reasonable security practices and sensitive personal data or information, directions issued by the Indian Computer Emergency Response Team (CERT-In), and the Digital Personal Data Protection Act, 2023 ("DPDP Act") and Digital Personal Data Protection Rules, 2025 ("DPDP Rules") as their respective provisions come into force.

The DPDP Act and Rules are being brought into force in phases. Certain institutional provisions took effect in November 2025, while most substantive obligations concerning notice, consent, data-fiduciary duties, individual rights and related rules are scheduled to come into force eighteen months after the 13 November 2025 notification. This Policy should be interpreted and updated as necessary to comply with provisions in force from time to time.

No reduction of statutory rights. Nothing in this Privacy Policy is intended to limit or waive any right that cannot lawfully be limited or waived under applicable data-protection, consumer, employment or other law.