Privacy Policy

1. Who is responsible

Lumacorp is a product of Azotos App Studio Private Limited (the “Company”, “we”, “us” or “our”). This policy covers personal information handled through the Lumacorp services provided to your organisation.

For account administration, security and direct support, the Company determines the relevant processing purposes. For customer-controlled project records, the customer may determine those purposes and the Company processes information on its documented instructions. The allocation of responsibilities depends on the actual activity and customer agreement; it does not remove either party's legal duties.

2. Information and its purposes

• Account and contact information: name, email, phone number, organisation, assigned role and authentication information, used to provide access, manage permissions and communicate about the service. Account passwords are stored as hashes.
• Operational records: surveys, work assignments, attendance, inventory movements, reports and approvals, used to perform and document authorised project work.
• Location and media: coordinates, route geometry, timestamps, photographs and documents supplied through enabled workflows, used for site verification, planning and execution records. Such uploads may also contain information about other people.
• Technical and security information: IP addresses, browser or device information, session details and activity or error logs generated by enabled features, used to operate, troubleshoot and protect the service.
• Support correspondence: your enquiries, attachments and our responses, used to resolve requests and maintain relevant records.

Information can come from you, your organisation's administrators, authorised project participants and configured integrations. Do not upload Aadhaar details, financial credentials, medical information or unrelated personal information unless a specifically authorised workflow and lawful purpose require it.

3. Applicable law and lawful use

Processing must comply with applicable Indian law, including the Information Technology Act, 2000 and the Sensitive Personal Data or Information Rules, 2011 while applicable, and the Digital Personal Data Protection Act, 2023 and its rules as their relevant provisions come into force. The DPDP framework has phased commencement, so statutory rights and obligations apply from their respective commencement dates.

We process information for the purposes described above under the applicable consent, permitted use or other lawful requirement. Where consent is required, the relevant notice and consent must be provided for that purpose. Accepting website terms is not blanket consent to unrelated processing, and your employer's instructions do not override applicable law.

4. Cookies, local storage and permissions

Lumacorp uses cookies for sessions, authentication and request security, and browser local storage for preferences such as appearance and sidebar dropdown state. You can clear these through browser settings; clearing or blocking essential cookies can sign you out or prevent features from working.

Location, camera and file permissions depend on the application and workflow you use. Review permission prompts and change device permissions when needed; some field tasks may then be unavailable. A permission grant alone does not authorise unrelated monitoring.

Pages may load external fonts, scripts, maps or other provider resources. Loading those resources can disclose your IP address and browser information to the provider. External providers' own notices apply to their independent processing.

5. Sharing and service providers

We do not sell or rent personal information. Information may be shared with authorised customer administrators and project participants for their work, with providers supporting hosting, communications, maps and technical services, or with professional advisers where necessary and lawful.

We may disclose information to a competent authority when required by law or to address unlawful activity and protect legal rights. Public-project data is not automatically public information. Provider access must be limited to the relevant purpose and applicable contractual and legal safeguards; outsourcing does not remove our own obligations.

6. Storage and retention

Retention depends on the record's purpose, the customer agreement and applicable legal requirements. Account and support records are retained for service administration and necessary follow-up; project records follow the applicable project retention schedule; security logs, backups and records subject to a legal hold can have different retention periods.

Information should be deleted or anonymised when its purpose and lawful retention requirements end. A request to close an account does not necessarily erase authorised project records or records required for legal claims. Ask us for the retention schedule and hosting details relevant to your organisation.

Where applicable, CERT-In directions require covered ICT logs to be maintained securely for a rolling 180 days within India. Additional legal retention requirements apply as they come into force. We do not promise that all information or all third-party processing stays in India; any transfer must satisfy applicable Indian restrictions, required safeguards and customer commitments.

7. Security and incidents

Lumacorp uses authentication, hashed passwords and role-based access restrictions. Appropriate technical and organisational safeguards must also reflect the deployment, data and contractual requirements. No system is completely secure. Contact us for the safeguards applicable to your deployment.

Report suspected exposure or unauthorised access promptly to info@azotos.in. Do not send passwords or unnecessary sensitive records. We will assess reports and take appropriate containment and remediation steps, and notify affected customers, individuals and authorities where required within applicable legal timelines, including CERT-In obligations where applicable.

8. Your requests and choices

Contact us to request access to information about you, correction of inaccurate information, or deletion where permitted. Where processing relies on consent, you may withdraw that consent; withdrawal does not undo earlier lawful processing and may prevent the relevant service from continuing. We will explain any lawful reason for retaining information or declining a request.

We may verify your identity proportionately and coordinate with your organisation where it controls the records. Rights to information, correction, erasure, grievance redressal and nomination under the DPDP Act apply when the relevant provisions are in force and applicable. You may then use the statutory escalation channels available, including the Data Protection Board of India after the required grievance process.

9. Children

Lumacorp is intended for authorised adult professional users, not children under 18. Do not create a child's account or intentionally submit children's personal information. If you believe such information has been collected, contact us so we can assess and address it under applicable law.

10. Privacy enquiries and grievances

Grievance officer: Nagarajan Sampathkumar
Azotos App Studio Private Limited
Tiruchirappalli- 620010, Tamil Nadu, IN
Email: info@azotos.in

Use the subject “Privacy grievance — Lumacorp” and include your account email, organisation and a description of the issue. We will address grievances expeditiously within the period required by applicable law, including within one month where the SPDI Rules, 2011 apply. You retain access to competent statutory authorities and other remedies provided by law.

11. Changes to this policy

We will publish revisions with an updated date. Material changes will be communicated through appropriate channels as required. New processing purposes will receive the notice and consent required by law; merely continuing to browse does not waive your privacy rights.