Privacy policy

This Privacy Policy explains how Xeed Consulting Private Limited (“Xeed”, “we”, “us” or “our”), which owns the WorkVigil brand, handles personal data in connection with the WorkVigil website, application, related services and customer support (together, the “Services”).

Legal entity: Xeed Consulting Private Limited. Registered office: Xeed Consulting Private Limited , Supreme Works, 2nd Floor, Eros City Square, Sector 49, Gurugram, Haryana – 122018 - India. Privacy contact: privacy@xeedconsulting.com. Grievance contact: Sumeet Mehta – Director.

This Policy should be read with the applicable customer agreement, Terms of Service and, where applicable, a Data Processing Agreement (“DPA”). If a customer contract contains a specific data-processing term that conflicts with this public Policy, the contract will govern to the extent of the conflict for that customer relationship, subject to applicable law.

Download the Privacy Policy (Word document)

1. Scope and applicable law

This Policy applies to personal data processed through the Services. It is intended to address applicable Indian law, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, where applicable, and the Digital Personal Data Protection Act, 2023 and rules or notifications to the extent in force and applicable. The DPDP Act and Rules have phased commencement; references to statutory rights and obligations apply as and when the relevant provisions become effective.

If WorkVigil is offered to customers or users outside India, additional laws may apply. The customer is responsible for identifying sector-specific, employment, records-retention or other obligations applicable to its use of the Services, and Xeed will address its own obligations under applicable law and the relevant customer contract.

2. Our role and customer workspace data

WorkVigil is a business software service. A customer organisation (“Customer”) may decide which employees, contractors or other authorised people can access its workspace, which work activities are recorded, and what evidence is requested. For personal data processed within that workspace on the Customer’s instructions, the Customer generally determines the purposes and means of processing and is responsible for the relevant notices, lawful basis and workplace policies. Xeed processes that data to provide, secure and support the Services, under the customer contract and any applicable DPA.

For certain activities—such as managing our direct business contacts, subscription administration, billing, platform security, abuse prevention, website enquiries and our own legal obligations—Xeed determines the purposes of processing and is responsible for those activities.

If you use WorkVigil through your employer or another organisation, first contact that organisation’s workspace administrator for questions about work records, evidence, access or correction. Xeed will assist the Customer where required by contract or law.

3. Personal data we may collect

• Account and identity data: name, work email, optional phone number, organisation, role, account identifiers and authentication information. Passwords are stored as salted, one-way hashes and not in readable form.
• Workspace content: tasks, projects, comments, checklists, forms, time entries, approvals, documents, attachments, operational records and other content entered or uploaded by authorised users.
• Evidence data: photographs, video or audio, electronic signatures, scanned codes, readings, device location or other evidence where the Customer enables the relevant feature and a user submits it.
• Usage, device and security data: sign-in events, timestamps, IP/network address, browser/device information, session events, access logs, error reports and security/audit events.
• Communications data: support requests, contact-form submissions, service notifications and records of emails or other messages sent through the Services, including delivery status where available.
• Subscription and billing data: customer legal name, billing address, GSTIN where provided, plan, invoices, payment references and transaction status. Payment-card or bank credentials should be handled by the payment provider where the payment flow is designed that way; we do not claim that this applies to every payment method unless confirmed.
• Website and preference data: essential cookies, local storage settings and server logs. The actual website’s cookies, analytics, embedded services and third-party resources must be checked against this description before publication.

4. Purposes for which we use personal data

• To create and administer accounts, authenticate users, provide the subscribed features and display authorised workspace information.
• To record task and workflow activity, approvals, evidence, audit events and notifications configured by the Customer.
• To respond to support requests, communicate service updates, manage subscriptions, process payments and issue tax invoices.
• To protect the Services, detect abuse, investigate suspected security incidents, enforce access controls, maintain reliability and troubleshoot errors.
• To comply with applicable laws, lawful requests, accounting and tax obligations, and to establish, exercise or defend legal claims.
• To improve the Services using appropriate operational information. We do not sell personal data or use customer workspace content for third-party advertising. Any use of workspace content for product analytics, model training or other secondary purposes must be expressly disclosed and contractually authorised before it occurs.

5. Legal basis, notice and choice

We process personal data only for purposes permitted by applicable law. Depending on the activity and the law in force, this may include providing a service requested by the Customer, performing a contract, complying with legal obligations, protecting the Services, or consent or another legally recognised basis where required.

Where consent is relied upon, it should be informed, specific, clear and capable of being withdrawn through an accessible process. Withdrawal does not affect processing already lawfully carried out and may affect the ability to provide a feature or service. Where another lawful basis applies, withdrawal of consent is not necessarily the relevant mechanism.

Customers must provide employees and other individuals with appropriate notices and obtain consent or other authorisation where required before collecting their personal data through WorkVigil, particularly for monitoring, photographs, recordings, signatures and location evidence.

6. Photos, recordings, signatures and location

A Customer may configure workflows that ask users to submit photographs, video/audio recordings, a signature, a scanned code, a reading or device location as work evidence. Such evidence may incidentally include other people, personal information, confidential business information or sensitive locations.

The feature should be used only for a defined and legitimate business purpose, with appropriate notice, access restrictions and retention limits. Users should capture evidence only where authorised and should avoid unnecessary capture of bystanders or unrelated information. Device permission prompts are not, by themselves, a substitute for any workplace notice or legal basis required from the Customer.

The current product design and permissions must be verified before making any claim about when camera, microphone or location access occurs, whether background location is possible, or whether a permission can be used by a browser or device. This Policy must be updated if product behaviour changes.

7. Cookies, local storage and similar technologies

The application may use strictly necessary cookies for authentication and local storage to remember interface preferences. Essential technologies are used to provide a requested function or secure session. The website and application may use other technologies only where disclosed and, where required, consented to.

Before publication, Xeed will verify the live website and app for analytics tools, advertising tags, pixels, third-party fonts, embedded video, CAPTCHA, error monitoring, chat widgets and other external requests. If any are present, this Policy and any consent interface will be updated accordingly.

8. Sharing and recipients

We may disclose personal data to the following categories, as appropriate:

• Authorised users and administrators within the relevant Customer workspace, subject to the Customer’s roles and permissions.
• Service providers acting for us, such as hosting/cloud infrastructure, storage, email delivery, payment processing, customer support, security monitoring and technical maintenance providers.
• Professional advisers, auditors, insurers and financial or tax service providers subject to appropriate confidentiality obligations.
• Government, law-enforcement, courts or regulators where disclosure is required by law or is necessary to respond to a valid legal process.
• A successor, acquirer or transferee in connection with a merger, restructuring, financing or sale of all or part of the business, subject to appropriate confidentiality and lawful safeguards.

9. Cross-border processing and data location

Personal data may be processed in India or other countries depending on the infrastructure and service providers actually used. Xeed will comply with applicable restrictions, government notifications and contractual obligations concerning transfers and will apply appropriate security and contractual safeguards.

10. Retention, deletion and backups

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, the customer contract, applicable law, security requirements and the establishment or defence of legal claims. Different categories may have different retention periods.

Workspace data may remain available during an active subscription. When a trial or subscription ends, access may be restricted or the workspace may become read-only as described in the Terms of Service. Read-only status does not itself mean that the data has been deleted.

When a Customer closes a workspace or requests deletion, we will follow the applicable contract and DPA, verify the request and authority, provide export where agreed, and delete or anonymise data within the documented retention period, unless retention is required or permitted by law, needed for a legal hold, or necessary for security and fraud prevention. Backup copies may remain until they expire through the documented backup cycle and will not be restored except for disaster recovery or lawful purposes.

Accounting, tax and transaction records will be retained for the period required by applicable law. Security logs will be retained in accordance with applicable requirements, including CERT-In directions where they apply.

11. Security safeguards and incident response

We implement reasonable technical and organisational safeguards appropriate to the nature of the data and the risks of processing. Depending on the system and configuration, these may include access controls, authentication, encryption in transit or at rest, secure file access, logging, backups, vulnerability management, personnel confidentiality and incident-response procedures.

If a personal-data or cybersecurity incident occurs, Xeed will assess, contain, investigate, preserve relevant evidence and notify affected Customers and authorities within the time and manner required by applicable law and contract. Customers must cooperate and promptly provide information reasonably needed to assess the incident. CERT-In reporting obligations and timelines will be handled by the legally responsible entity where applicable.

12. Individual rights and requests

Subject to the applicable law and its commencement, an individual may have rights to obtain information about processing, seek correction or completion, request erasure, withdraw consent where consent is the basis, nominate another person in prescribed circumstances, and raise a grievance or complaint.

A request concerning a Customer’s workspace should normally be sent to that Customer’s administrator or privacy contact. Xeed will assist the Customer as required by contract or law. A request concerning Xeed’s own account, billing or website-contact processing may be sent directly to the privacy contact below.

We may need to verify identity and authority before acting. Requests may be limited where the law requires or permits retention, where the record is needed for legal claims or security, or where responding would adversely affect another person’s rights. We will explain the outcome or any lawful limitation, where required.

13. Children

WorkVigil is intended for business use by adults and is not designed for children. Customers must not invite anyone under 18 to a workspace or use WorkVigil to process children’s personal data unless the use has been separately approved by Xeed and satisfies all applicable legal requirements, including any parental-consent or tracking/targeted-advertising restrictions that may apply.

14. Third-party websites and services

The Services may contain links to third-party websites or use third-party services. Their privacy practices are governed by their own notices and terms. Xeed is not responsible for third-party practices outside its control, but will describe relevant service providers and data flows where required.

15. Changes to this Policy

We may update this Policy to reflect changes in law, product functionality or business practices. We will publish the updated version with its revision date and provide notice of material changes to Customers or users where required by law or contract. If a change requires consent, we will obtain it through an appropriate process rather than treating mere continued use as consent where the law does not permit that approach.

16. Contact and grievance redressal

Data controller/contact for Xeed’s own processing: Xeed Consulting Private Limited.

Registered office: Xeed Consulting Private Limited , Supreme Works, 2nd Floor, Eros City Square, Sector 49, Gurugram, Haryana – 122018 - India.

Privacy email: privacy@xeedconsulting.com

Grievance officer / designated contact: Sumeet Mehta.

We will acknowledge and address complaints within the timelines required by applicable law. Where a statutory escalation route is available under law then in force, the individual may use that route after following the applicable process.

17. Related legal documents

The Terms of Service govern access to and use of the Services. A DPA may govern processing of personal data on behalf of a Customer. An SLA or security annexure may apply to enterprise subscriptions. These documents should be read together.