Privacy Policy
Version 1.0 • Effective 27 August 2026
How VendraSphere handles personal data.
1. Scope and roles
This Privacy Policy explains how VendraSphere handles personal data when individuals visit our marketing website, request access, create or use platform accounts, communicate with us, or interact with tenant websites powered by VendraSphere. For our own website, account administration, security, billing and support, VendraSphere may act as the data fiduciary/controller. For personal data a tenant collects and instructs us to process through its workspace or public website, the tenant generally determines the purpose and means and VendraSphere generally acts as its processor/service provider. The exact role depends on the activity and applicable law.
2. Data we may collect
- Contact and identity
- Name, business name, email, phone and role for requests, onboarding and support.
- Account and access
- User ID, role, tenant affiliation, authentication events and security settings.
- Business content
- Business profile, services, catalogue, website content, customer-facing information and uploaded media.
- Commercial and transaction
- Order/acceptance records, configuration status, fee and invoice/payment references; full payment-card data should remain with the payment provider.
- Technical and security
- IP address, device/browser information, request logs, timestamps, audit events and suspected-abuse indicators.
- Communications
- Support requests, feedback, decisions, consents and grievance correspondence.
- Tenant-controlled data
- Customer, lead, booking or enquiry data processed under a tenant’s instructions when relevant modules are enabled.
3. Why we use personal data
- Respond to requests and determine onboarding suitability.
- Provision, configure, authenticate, operate and support the Services.
- Maintain tenant isolation, prevent fraud, investigate incidents and enforce terms.
- Process fees, maintain business records and comply with legal obligations.
- Communicate operational notices and requested information.
- Diagnose and improve reliability, accessibility and product usability using appropriately minimised data.
- Exercise or defend legal rights and respond to lawful requests.
4. Grounds and consent
We process personal data only for lawful purposes. Depending on the context, processing may be based on consent, steps requested before entering a contract, performance of a contract, compliance with law, or another ground recognised by applicable law. Where consent is required, the notice will identify the data and purpose, and consent may be withdrawn using the stated method. Withdrawal does not invalidate earlier lawful processing and may prevent delivery of a requested optional feature.
5. Sharing and subprocessors
We may disclose personal data to vetted hosting, content-delivery, security, communications, payment, professional-adviser and integration providers only to the extent needed for their services and subject to appropriate safeguards. We may also disclose data where required by law, to protect rights and safety, or in connection with a lawful business reorganisation. We do not sell personal data.
6. International processing
Some providers may process or store data outside India. Where this occurs, we will use contractual, organisational and technical safeguards and comply with applicable transfer restrictions. Customers should assess any sector-specific localisation requirements.
7. Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including service delivery, security, dispute resolution and legal recordkeeping. Retention periods vary by record type. Request-access records will be deleted or anonymised when no longer needed, while security and transaction records may be retained longer where justified or legally required.
8. Security
We use measures designed to protect confidentiality, integrity and availability, including tenant isolation, access controls, encryption where appropriate, secure development, logging, backups, vulnerability management and incident handling. Access is limited to authorised personnel with a need to know. No method is risk-free; users should use strong credentials and report suspected compromise promptly.
9. Individual rights and grievances
Subject to applicable law, individuals may request access to information about processing, correction or updating, erasure, withdrawal of consent, grievance redressal and nomination or other available rights. Requests should be sent to contact@vendrasphere.com with enough information to verify identity and locate the relevant record. If the data is controlled by a tenant, we may direct the individual to that tenant and assist the tenant as required.
10. Children
The Services are intended for businesses and authorised adult users, not for children to create independent accounts. Tenants must not collect children’s personal data through VendraSphere unless the activity is lawful, necessary, transparently disclosed and supported by required parental consent and safeguards. VendraSphere may restrict children-focused use until enhanced controls are available.
11. Incidents and notifications
We maintain an incident-response process. Where a personal-data breach occurs, VendraSphere will investigate, mitigate and provide notices to affected customers, individuals or authorities as required by applicable law and the parties’ roles. Tenants must promptly notify us of incidents affecting their credentials or workspace.
12. Changes and contact
We will show an effective date and version and provide appropriate notice of material changes. Privacy questions, rights requests and grievances may be sent to contact@vendrasphere.com or by post to the address listed above.