Privacy Policy

1. Who we are

Complifly is operated by S3 Infotech Pvt Ltd, H-49, 2nd Floor, Sector-63, Noida, Uttar Pradesh 201301, India. For the personal data of people who contact us through this website or who use Complifly, we are the Data Fiduciary. For the tax documents your organisation processes through the platform (invoices, GSTINs, IRNs, e-way bills), we act as a Data Processor for your organisation under our agreement with it, and your organisation remains responsible for the lawful basis of that data.

2. Personal data we collect

When you submit a form on this website (a demo, Health Check, application, proposal or contact request) we collect:

• your name, work email address, mobile number and role;
• your company name and, where you give it, your PAN, your GSTINs and how many you have;
• the answers you choose or write, for example your ERP, volumes and where your process is difficult;
• the page you arrived from, any campaign page or campaign tag in the link, and any referral or promotion code the link carried or you typed, kept only if you submit a form;
• the plan and billing period you tell us you are interested in, if you say;
• a record that you accepted this policy, with the date, time, IP address and browser, as evidence of your consent.

3. If you become a customer

We also collect what is needed to issue and take payment for an order: the organisation, PAN, GSTINs, a contact name, email address and phone number, billing details, and the order amount. Card and bank details are entered on the payment gateway’s own page and are never seen or stored by us; we receive only the result and a transaction reference. We also collect the account, user and billing details needed to set up and administer your account.

This website sets no advertising or analytics cookies. It counts page views in aggregate, without any identifier, so that we cannot tell which visitor viewed what; see the Cookie Policy. Our services are for businesses, and we do not knowingly collect personal data from children.

4. Why we use it

We use the personal data you give us to:

• respond to your request: arrange a demo, prepare and send a Health Check report, consider an application, or prepare a proposal;
• validate your PAN and GSTINs during review, using Complifly’s validation capability, so that we know who we are dealing with before we issue an order;
• take and record payment against an order, and verify it;
• contact you about that request and keep a record of our dealings with you;
• if you become a customer, create and administer your account, deliver and support the service, and meet our own legal and security obligations.

5. Optional updates

With your separate, optional consent we may also send you product and compliance updates. That consent is independent of your request, is never a condition of anything else, and you can decline or withdraw it at any time.

6. Our basis for using it

For individuals’ personal data our basis is your consent, given when you accept this policy on a form, together with the performance of our contract with you once you are a customer. Optional updates rely on your separate consent. We also use personal data where the DPDP Act allows it without consent, for example to meet a legal obligation. Tax documents are processed on your organisation’s instructions as its processor, not on the basis of our own consent.

7. Who we share it with

We share personal data only as needed to run the service:

• the provider that delivers our email (Microsoft Azure Communication Services);
• the payment gateway (Airpay) that processes payments;
• the GST Suvidha Provider that Complifly’s validation uses to check PAN and GSTIN;
• the infrastructure that hosts our systems;
• for customers, the GST Suvidha Provider and the GSTN, for compliance operations;
• courts, regulators and authorities, where the law requires it.

8. Advisers, and what we never do

We share with advisers only where you direct or consent. We do not sell personal data. The current list of providers is on our Sub-processors page.

9. How it is protected

Enquiry records can be read only by Complifly staff who handle enquiries, after they sign in. Changes to an enquiry are recorded with who made them and when. The Trust section says what we can evidence about the platform’s controls. If a personal data breach affects you, we will tell you and the Data Protection Board of India, as the DPDP Act requires.

10. How long we keep it

We keep an enquiry for as long as we need it to deal with your request. We review enquiries that did not lead to a customer relationship at least once a year and delete those we no longer need. You can ask us to delete an enquiry at any time.

If you become a customer, we keep personal data while your account is active. Afterwards we keep only what the law requires, for example order, payment and invoice records under tax and company law, and then delete or anonymise it. We keep the record of your consent for as long as we rely on it, and afterwards for as long as we need to show that we had it.

11. Your rights

Under the DPDP Act you may ask for access to, correction of, or erasure of your personal data, nominate another person to exercise your rights, and raise a grievance. Write to privacy@complifly.in quoting your reference, or use your Complifly account if you have one. We may ask you to confirm who you are first. We reply within one business day to acknowledge your request and tell you when to expect the answer.

12. Withdrawing consent

Withdrawing consent is as easy as giving it. Write to us at the address in this policy and we will stop the processing that depended on it. Withdrawal does not affect processing already carried out, and withdrawing consent we need to deal with your request may mean we can no longer deal with it.

13. Grievance Officer

For any privacy question, request or complaint, contact our Grievance Officer at privacy@complifly.in. We respond within the timelines the DPDP Act requires. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

14. Changes to this policy

This policy is versioned. When we make a material change (a new purpose or a new type of data), we publish a new version and ask you to review it and, where required, consent again. The current version and effective date are shown at the top of this page.