Legal

Privacy Policy

Think and Scale (YTS Labs)Applies to HRxBoard and its website
On this page
  1. 1Definitions and interpretation
  2. 2Who we are and what this Policy covers
  3. 3Our two roles
  4. 4Client Data we host
  5. 5Our Data: what we collect and why
  6. 6Notice, consent and legal grounds
  7. 7What we do not do
  8. 8Disclosure and Sub-processors
  9. 9Where data is stored
  10. 10Access by our Personnel
  11. 11How we protect data
  12. 12How long we keep data
  13. 13Your rights
  14. 14Personal data breaches
  15. 15What we expect of Clients
  16. 16Children and minors
  17. 17Website, enquiries and support
  18. 18Cookies and logs
  19. 19Automated processing and artificial intelligence
  20. 20Changes to this Policy
  21. 21Grievances, the Data Protection Board and contact
  22. 22Governing law

1. Definitions and interpretation

1.1.
In this Policy, unless the context requires otherwise:
1.1.1.
“we”, “us”, “our” and “YTS Labs” mean Think and Scale, a partnership firm registered under the Indian Partnership Act, 1932 [registration number], having its registered office at [address], which trades through its YTS Labs brand and operates HRxBoard.
1.1.2.
“Applicable Data Protection Law” means, until the DPDP Commencement Date, section 43A of the IT Act, the SPDI Rules and the other provisions of the IT Act that apply to the processing of personal data; and from the DPDP Commencement Date, the DPDP Act and the DPDP Rules together with the provisions of the IT Act that continue to apply.
1.1.3.
“CERT-In Directions” means the directions issued by the Indian Computer Emergency Response Team under section 70B(6) of the IT Act on 28 April 2022, as amended or replaced.
1.1.4.
“Client” means the business that subscribes to the Platform under an Order.
1.1.5.
“Client Admin” means the person the Client names to manage its account.
1.1.6.
“Client Team” means the users whom the Client adds, whether as Client Admin, Team Member (who records filings and uploads) or Viewer (read-only).
1.1.7.
“Client Data” means all data that a Client or its Client Team uploads, enters or generates in the Platform, comprising Workforce Data, Compliance Records, Filing Documents and the Client Business Profile.
1.1.8.
“Compliance Records” means records of an Act, obligation, period, due date, status and filing date.
1.1.9.
“Client Business Profile” means a Client’s legal name, industry, office addresses and establishment codes under EPF, ESIC, Professional Tax and Shops & Establishments laws.
1.1.10.
“Data Fiduciary”, “Data Processor”, “Data Principal”, “Personal Data” and “Personal Data Breach” have the meanings given in the DPDP Act and, before the DPDP Commencement Date, are used in the same sense.
1.1.11.
“Data Protection Board” means the Data Protection Board of India established under the DPDP Act.
1.1.12.
“DPDP Act” means the Digital Personal Data Protection Act, 2023.
1.1.13.
“DPDP Rules” means the Digital Personal Data Protection Rules, 2025.
1.1.14.
“DPDP Commencement Date” means the date on which the substantive duties of Data Fiduciaries under the DPDP Act take effect, expected to be [13 May 2027].
1.1.15.
“Filing Documents” means challans, ECR and ESI contribution files, return acknowledgements, registers and similar documents uploaded by a Client.
1.1.16.
“Grievance Officer” means the person named in clause 21.
1.1.17.
“Infrastructure Access” means access by our engineers to production systems to maintain the infrastructure, as described in clause 10.
1.1.18.
“IT Act” means the Information Technology Act, 2000 and the rules made under it.
1.1.19.
“SPDI Rules” means the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
1.1.20.
“Order” means the order form, online sign-up or subscription agreement under which a Client subscribes to the Platform.
1.1.21.
“Our Data” means Personal Data that we collect about Client Team users, Website visitors and people who contact us, as described in clause 5.
1.1.22.
“Personnel” means our partners, employees and contractors.
1.1.23.
“Platform” means the HRxBoard application at app.ytslabs.com and its APIs, databases and document storage. “Website” means hrxboard.com.
1.1.24.
“Professional Firm” means a law, chartered accountancy, company secretary or consulting firm that uses the Platform to manage its own clients’ compliance under an Order that permits it.
1.1.25.
“Security Incident” means an event that compromises, or is reasonably suspected of compromising, the confidentiality, integrity or availability of the Platform or data held in it.
1.1.26.
“Sensitive Personal Data or Information” has the meaning in the SPDI Rules and includes passwords and financial information such as bank account, credit card or other payment instrument details.
1.1.27.
“Sub-processor” means a third party that we engage to process Client Data or Our Data on our behalf.
1.1.28.
“Support Access” means time-bound access to Client Data that a Client Admin grants to our Personnel, for up to 4 hours.
1.1.29.
“Terms of Use” means our Terms of Use for the Platform.
1.1.30.
“Workforce Data” means the employee master data uploaded by a Client: name, designation, date of joining, gender, employee type (permanent, contract or intern) and work location.
1.1.31.
“Working Day” means a day other than a Saturday, Sunday or public holiday at [city].
1.1.32.
“you” means the person reading this Policy: a Client, a Client Team user, an employee of a Client, a Website visitor or anyone who contacts us.
1.2.
Interpretation. Headings are for convenience only. “Including” means including without limitation. A reference to a statute, rule or direction includes it as amended, re-enacted or replaced. A reference to a clause is to a clause of this Policy. If this Policy is translated, the English version prevails unless the law requires otherwise.

2. Who we are and what this Policy covers

2.1.
HRxBoard is a labour law and payroll compliance workspace. It is a record-keeping and visibility system. It helps Clients track statutory obligations, record filings and see compliance status. It does not file returns, run payroll or make decisions about any employee.
2.2.
This Policy explains what data the Platform and the Website handle, in what capacity, for what purposes and on what grounds, with whom we share it, where it is stored, how it is protected, how long it is kept, and how you can exercise your rights. It is our privacy policy for the purposes of rule 4 of the SPDI Rules and, from the DPDP Commencement Date, our notice for the purposes of section 5 of the DPDP Act.
2.3.
The Platform is intended for businesses in India. We do not target persons located in the European Economic Area, the United Kingdom or other jurisdictions with their own data protection regimes. If you access the Platform from outside India, you do so on the footing that Indian law governs, and we make no commitment to comply with a foreign data protection law except where it applies to us by compulsion of law.
2.4.
This Policy forms part of the Terms of Use. The Cookie Policy, the Grievance Redressal Policy and the Risk & Financial Disclaimer are separate documents that work alongside it.

3. Our two roles

3.1.
Client Data: we are the Data Processor. The Client decides why and how its workforce and compliance data is used. We store, secure, display, back up, export and erase Client Data only on the Client’s documented instructions, under the data processing terms in the Terms of Use. Those terms are the contract that section 8(2) of the DPDP Act requires between a Data Fiduciary and a Data Processor.
3.2.
Our Data: we are the Data Fiduciary. We decide the purposes for which we process Our Data, and we are responsible for it under Applicable Data Protection Law.
3.3.
Employees of a Client. If your Personal Data is in the Platform because you work for a Client, your employer is the Data Fiduciary for that data. Clause 13 explains how to exercise your rights.
3.4.
Professional Firms. Where a Professional Firm loads data about its own end-clients, each end-client is the Data Fiduciary for its workforce data, the Professional Firm is its Data Processor, and we are the Professional Firm’s Sub-processor.
3.5.
Facts decide roles. Our description of a role is not conclusive. Where the law characterises a party’s role differently on the facts, that characterisation applies and the parties’ duties follow it.

4. Client Data we host

4.1.
Categories. Client Data consists of:
  • Workforce Data, which the Client uploads through an Excel template;
  • Compliance Records;
  • Filing Documents. Statutory files can contain member-level data such as Universal Account Numbers, wages and contribution amounts, and challans can show bank details; and
  • the Client Business Profile.
4.2.
What the template does not ask for. The workforce template has no fields for Aadhaar numbers, PAN, bank account details, biometrics, health information, caste, religion or data about children, and our database has no such structured fields.
4.3.
Incidental content. A Client may nonetheless upload documents that contain such data. We store every Filing Document and proof encrypted and access-logged. We do not extract, index, search, profile or analyse its contents. The only automated processing is malware scanning at upload and the security monitoring described in clause 11. The Client is responsible for what it uploads (Terms of Use, “Your data and your responsibilities”).
4.4.
Source. Client Data comes from the Client’s own team. We do not collect it directly from employees, buy or enrich it from third parties, or scrape government portals.

5. Our Data: what we collect and why

5.1.
What we collect.
  • Account data: name, work email, mobile number, role, assigned Acts and locations, and account status.
  • Credentials: your password, which we store only in hashed form, and multi-factor authentication details. A password is Sensitive Personal Data or Information under the SPDI Rules.
  • Security and activity logs: user ID, timestamp, action, IP address, and device and browser details.
  • Billing records: invoice number, amount, period, payment status, the billing contact and the Client’s GSTIN. Payment instrument details (card, UPI or bank details) are handled by our payment gateway and not stored by us.
  • Enquiry data: name, email, organisation and message from demo requests on the Website.
  • Support data: messages and attachments you send to support.
  • Grievance records: your grievance, our handling of it and its outcome.
5.2.
Why we use it. We use Our Data only to: authenticate users and control access; secure the Platform, keep an audit trail and investigate misuse; meet the log retention that Indian law requires; issue invoices and keep tax and accounting records; answer enquiries and support requests; handle grievances; and meet our legal obligations and establish or defend legal claims.
5.3.
What we never do with Our Data. We never use it for marketing, profiling, benchmarking or advertising, and we never sell it.
5.4.
Account data is provided by the Client Admin. Client Admins create accounts for Client Team users. The Client confirms to us that it has the authority to give us those details and has told its team about this Policy.

6. Notice, consent and legal grounds

6.1.
Notice. At first sign-in, every Client Team user receives a notice that says what Our Data we keep about them and why, links to this Policy, and tells them how to contact the Grievance Officer. We provide the notice in English [and in the Eighth Schedule languages we make available].
6.2.
Consent. Before we process Sensitive Personal Data or Information (such as your password) we ask for your consent electronically, in the form the SPDI Rules require, and we explain the purpose. For other Our Data, consent is given when you provide details and accept this Policy, and from the DPDP Commencement Date it is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. You may refuse, but if you do we may be unable to give you access to the Platform.
6.3.
Other legal grounds. From the DPDP Commencement Date we may also process Our Data where section 7 of the DPDP Act permits it, including: where you have voluntarily provided it for a specified purpose and have not indicated that you do not consent; to comply with a law or a court order; and to respond to a medical emergency or other emergency. We rely on legal obligation for the retention of logs and billing records.
6.4.
Withdrawing consent. You may withdraw consent at any time by writing to the Grievance Officer. Withdrawal is as easy as giving consent. It does not affect processing done before withdrawal and does not stop us retaining data we must keep by law. If you withdraw, we stop processing the data concerned, or erase it, unless the law requires otherwise, and we may no longer be able to give you access.
6.5.
Consent managers. We do not currently work through a registered consent manager. If the law gives you the right to act through one, we will honour a request properly made through it.

7. What we do not do

  • We do not sell or rent Client Data or Our Data.
  • We do not share Client Data with anyone except our Sub-processors, or an authority acting under lawful order (clause 8).
  • We do not use Workforce Data for analytics, benchmarking, profiling, advertising or marketing. Headcount figures are computed only for that Client’s own dashboard.
  • We do not train, fine-tune or evaluate any artificial intelligence or machine learning model on Client Data, and we do not use it to make automated decisions about any person.
  • We do not combine Client Data across Clients.
  • We do not contact employees of a Client, except to reply to an employee who writes to us (clause 13). We contact Client Team users only for service, security and billing purposes.
  • We do not open a Client’s Workforce Data or documents unless the Client Admin grants Support Access, or the law requires us to.

8. Disclosure and Sub-processors

8.1.
Sub-processors. We use Sub-processors to run the Platform. Each is bound by a written contract with confidentiality and security terms no less protective than ours, and the Client’s instructions are passed down to it. We remain responsible for each Sub-processor’s performance.
8.2.
Current Sub-processors. Amazon Web Services, Asia Pacific (Mumbai), hosts all production data, backups and logs. A transactional email service [name, location] sends reminder emails and receives only the obligation, the Client’s name, the due date and the recipient’s email address, and never Workforce Data. A payment gateway [name, location] collects subscription payments. [A support tool [name, location] handles support messages.] Our source code is held on GitHub, which holds no Client Data. We publish the current list on request and in our Sub-processor register at [URL].
8.3.
Notice of change. We give each Client at least 30 days’ notice before adding or replacing a Sub-processor that will handle Client Data. A Client may object in writing during that period. If we cannot reasonably accommodate the objection, the Client may end its subscription without penalty and receive a pro-rata refund of prepaid fees for the unused period.
8.4.
Lawful disclosure. We may disclose data to a court, regulator, law-enforcement or other authority where the law requires, for example under sections 69 or 70B of the IT Act. Where lawful, we tell the affected Client first, and we disclose only what the law requires. We report qualifying cyber incidents to CERT-In.
8.5.
Business transfers. If we reorganise or transfer the business, we may transfer data to the successor on notice, on the same terms as this Policy.

9. Where data is stored

9.1.
Client Data, documents, backups and logs are stored and processed in India, in the Amazon Web Services Asia Pacific (Mumbai) region. Our Personnel with any access work from India. We do not transfer Client Data outside India.
9.2.
The CERT-In Directions require certain logs to be kept within Indian jurisdiction. We comply by keeping our logs in India.
9.3.
If we ever need to transfer Personal Data outside India, we will first give the Client notice under clause 8.3, comply with any restriction the Central Government imposes under section 16 of the DPDP Act, and apply safeguards no less protective than those in this Policy.

10. Access by our Personnel

10.1.
Principle. No member of our Personnel has standing access to Client Data.
10.2.
Tier 1: access to Client Data. We first try to help by screen-share with the Client Admin, without opening the data ourselves. Where access is unavoidable, the Client Admin grants Support Access from the Client Portal for up to 4 hours. The grant, every record opened and its expiry are logged and visible to the Client.
10.3.
Tier 2: Infrastructure Access. Our engineers reach production systems only with approval from a designated partner, multi-factor sign-in through a bastion host and a 4-hour limit. Every command is logged. Infrastructure Access is for maintaining systems and is not used to view Client Data. If an emergency makes it unavoidable to touch Client Data this way, we notify the Client Admin promptly and record the access in the Client’s audit trail.
10.4.
Platform Administrators. Platform Administrators see only account set-up, subscription and regulation master information. Their access is reviewed every quarter and revoked on the day a person leaves.
10.5.
Personnel. All Personnel with access undergo background verification, sign confidentiality undertakings that refer to section 72A of the IT Act, and receive annual training.

11. How we protect data

11.1.
Standard. We maintain an information security management system certified to ISO/IEC 27001:2022 and a quality management system certified to ISO 9001:2015 [certificate numbers, certifying body, scope and validity on request]. The SPDI Rules recognise ISO/IEC 27001 as a reasonable security practice, and we also apply the safeguards the DPDP Rules require, including encryption or equivalent measures, access control, logging and monitoring, backups and continuity.
11.2.
Controls. In summary:
  • encryption with TLS 1.2 or higher in transit and AES-256 at rest, with keys held in a managed key service;
  • server-side role-based access, mandatory multi-factor authentication for Client Admins and Platform Administrators, and logical separation of each Client’s data;
  • an append-only audit trail visible to Client Admins and Viewers, including any action by our Personnel on their account;
  • encrypted daily backups kept for 30 days in India, with recovery designed to limit data loss to no more than 15 minutes;
  • an annual penetration test by a CERT-In empanelled auditor;
  • non-production systems that use synthetic data only; and
  • clock synchronisation and log retention in line with the CERT-In Directions.
11.3.
Limits. No system is free of risk. These controls are measures to protect data, not a guarantee that no incident will occur. Our Information Technology & Data Protection Note, available to Clients on request, gives fuller detail.

12. How long we keep data

12.1.
Client Data. Client Data stays while the Client’s subscription is active. Statutory registers and challans are kept for as long as the Client instructs.
12.2.
After the subscription ends. The Client Admin can export every record and document as Excel and PDF for 30 days. We then erase Client Data from live systems within 30 days, and backups age out within their 30-day cycle. The whole process can take up to about 90 days. We issue a deletion certificate on request.
12.3.
Logs. Security and audit logs are kept for one year and then deleted. This is longer than the 180 days that the CERT-In Directions require and reflects the log retention that the DPDP Rules prescribe for a Data Fiduciary.
12.4.
Our Data. User accounts are disabled rather than deleted during the subscription so the audit trail stays complete. Billing records are kept for [8] years or longer if the law requires. Enquiry data is kept for [12] months after the last contact unless you become a Client. Support data is kept for [12] months after the issue is closed. Grievance records are kept for [3] years after closure.
12.5.
Erasure on request and legal hold. Where Applicable Data Protection Law requires us to erase your Our Data, we erase or anonymise it. We may keep it where the law requires, to establish or defend a legal claim, or while an incident is under investigation, and we tell you when we do.

13. Your rights

13.1.
Rights. Under the SPDI Rules you may review the information you have provided and have it corrected, and you may withdraw consent. From the DPDP Commencement Date, under the DPDP Act you may: obtain a summary of your Personal Data and the processing, and the identities of the Data Fiduciaries and Data Processors with whom it has been shared (section 11); seek correction, completion, updating and erasure (section 12); have your grievance redressed (section 13); and nominate another person to exercise your rights if you die or become incapable (section 14).
13.2.
Before the DPDP Commencement Date. We honour the corresponding rights under the SPDI Rules and the IT Act, and we apply the DPDP standards to Our Data where we reasonably can.
13.3.
Employees of a Client. Your employer decides your request. Ask your employer: its Client Admin can export, edit or erase your records and show their activity history. If you write to us, we tell you first that we will pass your request on, then pass it to the Client within 2 Working Days, disclosing only what is needed, and tell you where it has gone. We ask the Client not to take adverse action against you for making the request.
13.4.
Client Team users, Website visitors and others. Write to the Grievance Officer. We acknowledge your request within 2 Working Days and decide it within 30 days. We may need to confirm your identity first. We will never ask for your password.
13.5.
Your duties. From the DPDP Commencement Date, section 15 of the DPDP Act requires you to comply with the law, not to impersonate another person, not to suppress material information, not to register false or frivolous grievances, and to furnish only verifiably authentic information when exercising a right.

14. Personal data breaches

14.1.
Our response plan. If a Security Incident occurs, an incident lead takes charge at once, revokes sessions and keys, isolates affected systems and preserves logs.
14.2.
Reporting to CERT-In. We report qualifying cyber incidents to CERT-In within 6 hours of noticing them, in the prescribed format, through our designated point of contact.
14.3.
Telling the Client. We tell the Client Admin without undue delay, and in any case within 24 hours of becoming aware of a Personal Data Breach affecting its Client Data. We say what we know (the nature, time, data affected, likely impact, steps taken and a contact), and update as facts are established. We give a detailed report within 48 hours of the first notice, covering causes, mitigation, findings and remedial measures, so the Client can meet its own duties, including its duty to intimate the Data Protection Board and affected individuals. We provide the list of affected individuals and draft wording on request.
14.4.
Breaches of Our Data. Where a breach affects Our Data, we intimate the Data Protection Board and affected persons as Applicable Data Protection Law requires.
14.5.
Learning. After recovery we carry out a root-cause analysis and record corrective action. The Client receives the final report. Our point of contact is reachable 24 hours a day, and we rehearse the response plan in a tabletop exercise twice a year.

15. What we expect of Clients

  • Have a lawful basis for processing Workforce Data, and give your employees every notice the law requires.
  • Upload only what your statutory obligations need, and keep it accurate and complete.
  • Take responsibility for any data of minors you choose to upload, including any verifiable consent the law requires, and for any sensitive data in uploaded documents.
  • Manage your team’s accounts, disable leavers promptly, review access reports and secure your own devices and networks.
  • Respond to your employees’ rights requests. We provide export, correction and erasure tools.
  • Tell us if you need data kept after the subscription ends, or erased sooner.
  • Tell us promptly of a suspected Security Incident on your side.

16. Children and minors

HRxBoard is a business tool and is not directed at children. We do not knowingly collect Our Data from anyone under 18, and we require every user to be at least 18. If we learn that we have collected such data, we will delete it. We do not track or monitor the behaviour of children or direct advertising at them. Workforce Data of an intern or apprentice under 18 is uploaded at the Client’s responsibility, and the Client must meet section 9 of the DPDP Act and the DPDP Rules in relation to it.

17. Website, enquiries and support

The Website holds no Client Data and stores only public content and demo requests. We use the name, email, organisation and message from an enquiry only to reply and to follow up on your request. Please do not send Workforce Data or Filing Documents by email. Use the in-app support channel or a screen-share. If you do email such data, we may delete it and ask you to use the secure channel.

18. Cookies and logs

Our Cookie Policy explains the cookies we use. The Platform keeps server logs for security and audit purposes, as described in clause 12.3.

19. Automated processing and artificial intelligence

We do not use Client Data or Our Data to train any model, to profile any person, or to take any decision that produces legal or similarly significant effects on a person without human involvement. The Compliance Health Score and threshold flags are computed from the status and data your team enters and are management indicators only.

20. Changes to this Policy

We update this Policy when the law, the Platform or our practices change. We give Clients notice of a material change through the Platform or by email at least [30] days before it takes effect. A Client that does not accept the change may end its subscription before the effective date and receive a pro-rata refund of prepaid fees for the unused period. The effective date above shows the latest version, and earlier versions are available on request.

21. Grievances, the Data Protection Board and contact

21.1.
Grievance Officer. Grievance Officer, Think and Scale (YTS Labs): [name], [designation], [email], [phone and hours], [registered office address]. Our Grievance Redressal Policy sets out how we handle complaints and the timelines.
21.2.
Data Protection Board. From the DPDP Commencement Date, if you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India after you have used our grievance mechanism, and you may pursue any other remedy the law gives you.

22. Governing law

This Policy is governed by the laws of India. Disputes are resolved as the Terms of Use provide, subject to your rights under Applicable Data Protection Law to approach the Data Protection Board or any court or authority with jurisdiction.

Questions or concerns about this policy? Our Grievance Officer is here to help, as set out in the Grievance Redressal Policy.

Back to HRxBoard
Cookie settings

We use only strictly necessary cookies, which keep the HRxBoard platform secure and signed in. This website does not set analytics, advertising or other non-essential cookies, so there is nothing to switch on or off here. If that changes, we will ask for your consent first.

Strictly necessaryAlways on
Analytics, advertising and other non-essential cookiesNot used
Read the Cookie Policy