This Privacy Policy ("Policy") explains how Allsoft Consulting Private Limited ("allsoft®", "we", "us" or "our") handles personal information when you use the QuickSFA mobile applications for Android and iOS (the "Apps"), the website quicksfa.com (the "Site") and the services connected to them (together, the "Services"). QuickSFA is a field sales force automation (SFA) platform used by distributors and businesses to run their field sales teams, covering route planning, retailer visits, order taking, visit outcomes and outstanding tracking.
1. Scope and Application
This Policy covers all personal information we handle in connection with the Services, including information:
- Shared with us by distributors and businesses ("Customers") that subscribe to QuickSFA for their field sales operations
- Relating to the sales representatives, supervisors and other users ("End Users") whom our Customers authorise to use the Apps
- Provided to us directly by people who visit our Site or contact us for information, support or sales
Our Two Roles: When we handle field sales data for a Customer, the Customer decides how that data is used. The Customer is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDPA") (the data controller under the GDPR), and we act as its Data Processor. When we collect information for our own purposes, for example through our Site's enquiry form or our support channels, we are the Data Fiduciary (data controller). Where it matters, this Policy states which role applies.
This Policy does not cover:
- Personal information that Customers handle on their own, outside QuickSFA
- Websites or services run by third parties, even if they are linked from our Services
- Information that Customers collect about their staff or retailers through other means
2. Definitions
In this Policy:
- "Personal Information": Information about a person who is identified or can be identified, such as a name, mobile number, identification number, location data or online identifier.
- "Party": A retailer, store or other customer of a Customer whose details are kept in the Apps.
- "Processing": Anything done with personal information, including collecting, recording, organising, storing, retrieving, using, sharing, restricting, erasing or destroying it.
- "Data Principal" or "Data Subject": The person to whom the personal information relates.
- "Consent": A clear, specific, informed and freely given agreement to the processing of personal information.
- "Contractual Necessity": Processing required to perform a contract with the individual, or to take steps at their request before entering into one.
- "Legal Obligation": Processing required so that we, or a Customer, can comply with the law.
- "Legitimate Interests": Processing needed for a genuine business interest, where that interest is not outweighed by the individual's rights.
3. Types of Personal Information We Collect
The information we handle depends on whether we are acting for a Customer (as processor) or for ourselves (as controller).
3.1 Information We Process for Customers
Acting on a Customer's instructions, we process the following:
Account and Identification Details
- End Users' names, mobile numbers and user IDs
- Login credentials and one-time passwords (OTPs) used to confirm identity
- The routes and Parties assigned to each End User
Field Sales Activity Data (Core Specialisation)
- Orders, including products, quantities, rates, discounts, payment mode, and the date and time of each order
- Visit outcomes, including No Response visits with the reason selected and visits placed On Hold
- Outstanding bills for each Party, with their supporting vouchers
- Performance summaries such as total calls, productive calls, average bill value and total bill value
- Master data supplied by the Customer, such as routes, Parties, the product catalogue and price lists
Party (Retailer) Information
- Name and contact details of new Parties registered through the Apps
- The location of a Party's premises, when it is saved in the Apps
Location Data
- GPS coordinates recorded when an order is saved, a No Response visit is recorded or a Party's location is saved
- Live location of End Users while live location is enabled, only where the Customer has turned on this feature and the End User has granted location permission
Device and Technical Information (When Using the Apps)
- Operating system type and version (Android or iOS)
- Device model and manufacturer
- App version, crash reports, error logs and performance data
- Whether the device is connected to the internet, so that the Apps know when to sync
- A notification token used to send push notifications to the Apps
- The permissions granted to the Apps: location, notifications and internet access
3.2 Information We Collect for Our Own Purposes
When we collect information for our own sales, support and website operations, this may include:
Enquiry and Communications Data
- Your name, firm or distributorship name, mobile number and number of field representatives, when you use our Site's enquiry form
- What you tell us in your enquiry, and our correspondence with you by phone, WhatsApp or email
- How you use our Site, such as the pages you visit
Support and Service Data
- Your name, contact details, firm name and app version when you contact our support team
- Records of your support conversations by phone, WhatsApp or email
Cookies and Tracking Technologies
- Google Analytics cookies, which help us count visits and understand which pages are read
- Google reCAPTCHA, which protects our enquiry form from spam
4. How We Collect Personal Information
We collect personal information in ways that are open and clear, so that people know what we collect and why.
4.1 Information Provided to Us
- Customer Setup: Customers give us their master data, such as routes, Parties, price lists and product catalogues, including from their back-office or ERP systems
- Use of the Apps: Information is created when End Users take orders, record visit outcomes, register new Parties or save Party locations
- Contacting Us: People send us information through our Site's enquiry form, or by phone, WhatsApp or email
- Support Requests: Users share details when they ask for technical help, billing assistance or product guidance
4.2 Information Collected Automatically
- Location: The Apps record GPS location when an order, a No Response visit or a Party location is saved, and collect live location where the Customer has enabled it
- Apps: Once installed, the Apps collect device information, crash reports and data that depends on permissions (location and notifications)
- Site: Cookies and similar technologies measure how our Site is used
- System Logs: Our servers and applications record technical logs, error reports and performance data
- Integrations: Data is exchanged with a Customer's ERP or accounting system, such as Tally, Busy, Marg or SAP, where the Customer uses this
- Service Providers: We receive information from providers we work with, such as Google Firebase and Sentry
4.3 How We Inform You
When information is collected, through permission requests in the Apps and through this Policy, we explain:
- What information is being collected
- Why each type of information is needed
- The legal basis for using it, where this applies
- Whether providing it is optional or required, and what happens if it is not provided
- Who it may be shared with
- How long it is kept, or how that period is decided
- How to contact us with privacy questions
5. How We Use Personal Information
We use personal information only for clear and legitimate purposes connected with the Services, and only as far as needed to provide the Services, meet our legal duties and protect legitimate interests.
5.1 When Acting for Customers (Customer Data)
When we handle data for a Customer, we use it only to:
Deliver the Field Sales Service
- Show each End User their assigned routes, Parties and visit order
- Let End Users take orders using the Customer's catalogue and price lists
- Record visit outcomes, including No Response visits with reasons and visits placed On Hold
- Record the location of orders, visits and Party premises as proof of visit
- Provide live location of End Users to the Customer, where the Customer has enabled it
- Register new Parties in the field
- Show outstanding bills and vouchers for each Party
- Let the Apps work offline and sync with the Customer's server once a connection is available
- Show performance summaries such as total calls, productive calls, average bill value and total bill value
- Support export of data to the Customer's ERP or accounting system
Run and Improve the Service
- Confirm users' identity and keep sessions secure
- Find and fix technical problems and crashes
- Maintain, update and fix our systems
- Monitor how available and fast the Services are
- Detect and prevent fraud, misuse and security threats
Communicate with Customers
- Send service notifications, such as sync alerts and service updates
- Help users with the Apps and resolve their problems
- Share billing, invoice and subscription information
- Tell Customers about changes to this Policy, our Terms and Conditions or legal requirements
Meet Legal and Regulatory Requirements
- Help Customers comply with the laws that apply to them
- Provide information for legal proceedings, investigations or audits when validly requested
- Keep records that the law requires
- Help Customers respond to requests from Data Principals
5.2 When Acting for Ourselves (Our Own Data)
When we are the controller, we use personal information to:
Sales and Business Development
- Answer questions about our Services, features and pricing
- Prepare setup plans and arrange trials for prospective Customers
- Send information about our Services, where you have agreed to receive it or the law allows
Customer Support and Service
- Give technical help and resolve issues
- Manage Customer accounts, billing and subscriptions
- Onboard, set up and train new Customers
Website Operations
- Handle enquiry form submissions
- Protect our Site from spam, bots and abuse
- Understand how our Site is used, so that we can improve it
Legal Compliance and Governance
- Meet our tax, GST and financial reporting obligations
- Respond to legal requests, notices and court orders
- Keep company records and carry out internal compliance checks
6. Location Information
QuickSFA does not track your location continuously by default. Location is collected in two ways:
- Location at the time of saving: When you save an order, record a No Response visit or save a Party's location, the Apps record your device's GPS location as proof of the visit.
- Live location (where enabled): Your employer may enable live location for its field team. In that case, the Apps may collect your location while live location is enabled, including while the Apps run in the background, so that your employer can see field coverage and movement. Live location is collected only after you grant location permission, and you can stop it at any time by changing the location permission in your device settings.
If location permission is not granted or is withdrawn, features that depend on location, such as saving orders and visits, will not be available.
Location information is processed to perform our contract with your employer, and on the basis of the permission you give on your device.
6.1 How Location Data Is Used
- Proof of Visit: To confirm where an order was taken or a visit outcome was recorded
- Party Location: To store the location of a Party's premises for later visits
- Route Guidance: To show End Users how far away the next Party on their route is
- Field Coverage: To let the Customer see the live location and movement of its field team, where live location is enabled
- Reporting: To give Customers accurate visit and coverage reports
7. Legal Basis for Processing
We process personal information only where the law allows it. For individuals in India, we rely on consent or on the legitimate uses allowed under Section 7 of the DPDPA, which include purposes of employment. For individuals in the European Economic Area (EEA), we rely on the legal bases in Article 6 of the GDPR, as described below.
7.1 When Acting as Processor (Customer Data)
Contractual Necessity (Article 6(1)(b))
- Needed to perform our contract with the Customer
- Covers route management, order capture, visit recording, location recording, data sync and reporting
Legal Obligation (Article 6(1)(c))
- Needed so that the Customer can meet its legal duties, such as keeping tax and GST records
- We follow the Customer's instructions in supporting its compliance
Legitimate Interests (Article 6(1)(f))
- Needed to keep the Services secure and reliable
- Covers fraud detection, security monitoring and improving the Services using aggregated data
Consent (Article 6(1)(a))
- Given through device permissions for location, including live location, and notifications
- Can be withdrawn at any time in device settings
7.2 When Acting as Controller (Our Own Data)
Consent (Article 6(1)(a))
- Relied on for marketing messages and non-essential cookies
- Can be withdrawn at any time
Legitimate Interests (Article 6(1)(f))
- Relied on for fraud prevention, network security and website analytics, where your rights do not outweigh our interests
Contractual Necessity (Article 6(1)(b))
- Relied on to provide what you ask for, such as support, trials and account management
Legal Obligation (Article 6(1)(c))
- Relied on to comply with the law, such as keeping invoices for tax authorities
8. Information Sharing and Disclosure
We share personal information only when it is necessary, and always with suitable protections in place.
8.1 Sharing with Customers (As Processor)
As a service provider, we make the following available to our Customers:
- Orders and transaction details
- Visit records and outcomes, with the location of each visit
- Live location of End Users, where the Customer has enabled it
- New Party registrations and Party locations
- Reports and performance summaries
- Data exported to the Customer's ERP or accounting system
- System logs relating to the Customer's account
We follow the Customer's instructions and do not decide on our own how this data is shared.
8.2 Sharing with Service Providers
We work with trusted providers that help us run the Services, including:
- Google Firebase Cloud Messaging, for push notifications
- Google Firebase Crashlytics, for crash reporting
- Sentry, for error and performance monitoring
- Google Analytics and Google reCAPTCHA, for website analytics and spam protection
- Cloud hosting providers (Amazon Web Services and Microsoft Azure), to host the Services
- Messaging providers, to deliver OTPs
Our service providers must:
- Use the data only as we instruct
- Keep the data secure and confidential
- Not use the data for their own purposes
- Help us respond to requests from Data Principals
- Tell us about any legal demands for the data or any data breach
We can share a current list of our service providers on request.
8.3 Legal and Protective Disclosures
We may disclose personal information where we reasonably believe it is needed to:
- Comply with a law, regulation, legal process or request from a government authority
- Protect the rights, property or safety of allsoft®, our users or the public
- Prevent or investigate fraud, illegal activity or security threats
- Enforce our Terms and Conditions or this Policy
- Respond to an emergency involving a serious risk to someone's life or safety
When we do this, we disclose only what is necessary, inform the affected Customer unless the law prevents it, and keep a record of the disclosure.
8.4 Business Transfers
If allsoft® is involved in a merger, acquisition, insolvency or sale of assets:
- Personal information may be transferred as part of that transaction
- We will inform affected individuals and Customers by email or through a clear notice on our Site
- The new owner must honour this Policy or offer equal protection
- Individuals keep their rights and may object to the transfer where the law allows
8.5 No Sale of Personal Information
We do not sell personal information, including within the meaning of the CCPA/CPRA or similar laws, and we do not give it to third parties in exchange for money for their own use.
9. International Data Transfers
QuickSFA's core data is hosted in India. Some of our service providers may process certain information outside India. Any such transfer follows applicable law, including the DPDPA and, where relevant, Chapter V of the GDPR.
9.1 Transfer Mechanisms
Where information is transferred across borders, we use one or more of these safeguards:
- Adequacy Decisions: Transfers to countries recognised as offering adequate protection
- Standard Contractual Clauses (SCCs): Approved contract terms for transfers to other countries, with additional measures where needed
- Specific Exceptions: Used only in limited cases, such as explicit consent, performing a contract, legal claims or protecting someone's vital interests
9.2 Where Data Is Hosted
QuickSFA's application databases are hosted in India, in Amazon Web Services (AWS) and Microsoft Azure regions in Mumbai, Chennai, Hyderabad and Delhi NCR. Service providers such as Google (Firebase, Analytics and reCAPTCHA) and Sentry may process some data in other countries, including the United States.
9.3 How Transfers Are Protected
For every transfer, we apply these protections:
- Data Minimisation: Only the data needed for the purpose is transferred
- Encryption: Data is protected by encrypted connections while in transit
- Access Controls: Access is role-based and protected by strong authentication
- Limited Use: Service providers may use the data only to provide their services to us
- Breach Cooperation: Service providers must help with breach notifications and regulatory enquiries
- Support for Your Rights: You can exercise your rights wherever your data is processed
- Indian Law: We follow any restrictions on transfers notified by the Government of India under the DPDPA
9.4 Transfers from the EEA
When personal information is transferred out of the EEA, we:
- Check that the destination offers adequate protection or that suitable safeguards are in place
- Inform Customers and End Users about the transfer
- Provide a copy of the safeguards on request
- Keep the transfer arrangements under review
10. Data Retention and Deletion
We keep personal information only as long as needed for the purposes in this Policy, to meet legal requirements, to resolve disputes and to enforce our agreements. How long we keep it depends on the type of data, the law and our contracts.
10.1 Retention Principles
- Purpose Limitation: Data is kept only for the purposes it was collected for
- Minimisation: We regularly review data and delete what is no longer needed
- Legal Requirements: We keep data for at least as long as the law requires
- Customer Instructions: When acting as processor, we follow the Customer's retention requirements
10.2 Retention Periods
Field Sales Data
- During the Subscription: Kept for as long as the Customer's subscription is active
- After the Subscription Ends: Kept for ninety days, unless the Customer asks us to delete it earlier, and then deleted
- Transaction Records: Kept longer where tax, GST or accounting laws require it
- Location at the Time of Saving: Kept with the order, visit or Party record it relates to
- Live Location: Kept only for as long as needed for the Customer's field coverage and reporting purposes, and then deleted
- Data on the Device: Stored on the End User's device until it has been synced with the Customer's server
Trial Data
- Data from a trial that does not become a paid subscription is deleted ninety days after the trial ends
Customer and Prospect Data
- Prospects: Kept until consent is withdrawn or contact ends, usually after 24 to 36 months of inactivity
- Customers: Contract records kept for at least 10 years after the contract ends, and billing records for at least 7 years for tax purposes
- Site Visitors: Analytics data kept for up to 26 months
Support and Communication Data
- Support Requests: Kept for 3 to 5 years after they are resolved
- Emails: Kept for 3 to 5 years
- Chat and WhatsApp Messages: Kept for 1 to 2 years
Aggregated and Anonymised Data
- Statistical data that cannot identify anyone may be kept indefinitely for business planning
10.3 How Data Is Deleted
- Scheduled Deletion: Automated processes delete data in line with our retention rules
- Customer Requests: Customers may ask us to delete specific data, subject to legal requirements
- Individual Requests: We handle deletion requests from individuals as the law requires
- Anonymisation: Where the law prevents deletion, we anonymise the data so that it can no longer identify anyone
- Backups: Backups are overwritten within 30 days; we do not remove individual records from backups
- Confirmation: We confirm deletion on request
10.4 When a Customer Leaves
When a Customer's subscription ends:
- Data Export: The Customer may ask for a full copy of its data in a standard, machine-readable format within ninety days
- Deletion: After ninety days, the data is permanently deleted from our live systems
- Backups: Copies may remain in backups for up to 30 more days
- Audit Logs: Limited logs may be kept for fraud prevention and legal protection
- Service Providers: We ask our service providers to delete or return the Customer's data
11. Data Subject Rights
Data protection laws give individuals rights over their personal information, and we help people use them. Where we act for a Customer, requests should normally go to the Customer (the employer) first.
11.1 Rights Under the GDPR (EEA Individuals)
Where we are the controller, or when we help a Customer as processor, individuals in the EEA can:
- Access (Article 15): Find out whether we process their personal information and get a copy of it
- Rectification (Article 16): Have wrong information corrected and incomplete information completed
- Erasure (Article 17): Have their information deleted where the legal grounds apply
- Restriction (Article 18): Limit how their information is used where the legal grounds apply
- Portability (Article 20): Receive their information in a structured, commonly used, machine-readable format
- Objection (Article 21): Object to processing based on legitimate interests, and to direct marketing at any time
- Automated Decisions (Article 22): Not be subject to decisions made only by automated means that significantly affect them
11.2 Rights Under the CCPA/CPRA (California Residents)
California residents can:
- Know what personal information we collect, use and share
- Ask us to delete their personal information, subject to legal exceptions
- Opt out of the sale of their personal information (we do not sell personal information)
- Be treated fairly when they exercise their privacy rights
- Have inaccurate personal information corrected
- Limit how sensitive personal information is used and shared
11.3 Rights Under India's DPDPA 2023
Individuals in India can:
- Get a summary of their personal information and how it is processed
- Have their personal information corrected, completed, updated or erased
- Withdraw their consent at any time
- Have their grievances addressed
- Nominate someone to exercise their rights if they die or become unable to do so
11.4 How to Exercise Your Rights
If You Use QuickSFA Through Your Employer (Processor Role)
- Where to Send Requests: Contact your employer, which controls your QuickSFA account
- Your Employer's Role: Your employer will pass your request on to us
- Our Role: We act on your employer's verified instructions to give access to, correct, delete or export your data
- Timeframe: We act on your employer's instructions within 30 days, or up to 60 days more for complex requests
- Fees: There is no fee, unless a request is clearly unfounded or excessive
If We Collected Your Data for Our Own Purposes (Controller Role)
- Where to Send Requests: Email [email protected]
- Verification: We will confirm your identity in a reasonable way before acting
- Timeframe: We reply within 30 days of receiving a verified request
- Extensions: For complex or multiple requests, we may take up to 60 days more, and will tell you within the first 30 days
- Format: We provide information in a standard, machine-readable format
- Fees: There is no fee, unless a request is clearly unfounded or excessive
Types of Requests
- Access: We give you a copy of your personal information and explain how we use it
- Correction: We fix inaccurate information and tell relevant third parties where needed
- Deletion: We delete your information unless we must keep it by law, under a contract or for legal claims
- Restriction: We limit use of your information while we check its accuracy or resolve a dispute
- Portability: We give you your information in a standard, commonly used format
- Objection: We stop direct marketing straight away, and review other processing to see whether we have strong legitimate grounds to continue
- Withdrawing Consent: We stop processing that relies on consent as soon as technically possible
Business Records: Some information, such as order and tax records, cannot be deleted while the law requires it to be kept.
12. Data Security
We use reasonable technical and organisational measures to protect personal information from unauthorised access, loss, misuse or alteration, including encrypted connections, access controls and secure storage of login credentials on the device. No method of transmission or storage is completely secure. If a personal data breach occurs, we will take action and give notice as the law requires.
13. Children's Privacy
The Services are meant for business use and are not directed at anyone under 18. We do not knowingly collect personal information from children.
14. Changes to This Policy
We may update this Policy from time to time. The updated Policy will be posted on this page with a new "Last Updated" date. For important changes, we will inform Customers before the changes take effect.
15. Contact Us and Grievance Officer
For any questions, requests or complaints about this Policy or your personal information, please contact our Grievance Officer:
Nitin KabraGrievance OfficerAllsoft Consulting Private LimitedOffice 408, Fourth Floor, Magneto Offizo,G E Road Raipur, Chhattisgarh, INDIA.CIN : U74999CT2018PTC008542GSTIN : 22AAQCA9248R1ZTEmail: [email protected]Phone: +91 93038 52900 (Monday to Friday, 10:00 am to 6:00 pm IST)If you are not satisfied with our response, you may complain to the Data Protection Board of India.