Privacy Policy

1. Introduction

JEBI Tech is a software development company providing cloud-based software solutions to multiple business customers. This Privacy Policy explains how JEBI Tech protects personal data processed through its software solutions and how it meets applicable privacy data-protection requirements and regulations.

2. Scope and Privacy Roles

Customer Data

When a customer uses a JEBI Tech software solution, the customer remains the owner and controller of the personal data processed through that solution. JEBI Tech acts only as a data processor and processes customer personal data:

• Only on the documented instructions of the respective customer;
• Only for providing, supporting and maintaining the contracted software services;
• Only for responding to customer-related requests;
• In accordance with the applicable contract and Data Processing Agreement.

JEBI Tech does not use customer personal data for its own marketing, analytics, commercial benefit or any purpose unrelated to providing services to the customer.

Employee Data

JEBI Tech acts as a data controller only in relation to the personal data of its employees and contractors. All current JEBI Tech employees are based in India. Employee personal data is processed for legitimate employment purposes, including recruitment, payroll, benefits, performance management, administration, legal compliance and information security.

3. GDPR Privacy Principles

JEBI Tech processes personal data in accordance with the following GDPR principles:

• Lawfulness, fairness and transparency: Personal data is processed fairly, transparently and on an appropriate legal basis.
• Purpose limitation: Personal data is collected and used only for specified and legitimate purposes.
• Data minimisation: Only personal data necessary for providing the relevant services is processed.
• Accuracy: Reasonable steps are taken to keep personal data accurate and up to date.
• Storage limitation: Personal data is retained only for as long as required by customer instructions, contractual requirements or applicable law.
• Integrity and confidentiality: Personal data is protected against unauthorised access, disclosure, alteration, loss or destruction.
• Accountability: JEBI Tech maintains appropriate governance, documentation and oversight of its personal-data processing activities.

4. Customer Data Confidentiality

JEBI Tech manages software solutions for multiple customers and treats each customer's data as confidential. Customer personal data will not be:

• Shared with another customer;
• Disclosed to another entity;
• Used for an unrelated purpose;
• Accessed beyond what is necessary to provide the contracted services;

unless the respective customer has provided approval, the disclosure is required under the applicable contract, or JEBI Tech is legally required to disclose the information.

Any authorised service provider or subprocessor used by JEBI Tech will be subject to appropriate confidentiality, security and data-protection obligations.

5. International Data Transfers

JEBI Tech operates from India and provides software services to customers located in the European Economic Area, the United Kingdom, United States of America or other jurisdictions.

Where personal data is transferred from the European Economic Area to India, JEBI Tech will enter into the applicable European Commission Standard Contractual Clauses (“SCCs”) with the European customer.

Where required, JEBI Tech will also support transfer-risk assessments, privacy impact assessments and implement appropriate supplementary safeguards as requested by the customer.

6. Information Security

JEBI Tech maintains state-of-the-art security practices appropriate to the nature, scope and risks of its processing activities. JEBI Tech maintains reasonable and proportionate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration or disclosure.

JEBI Tech's information-security programme is aligned with the principles and requirements of ISO/IEC 27001.

Data Security

JEBI Tech applies reasonable technical and organisational safeguards, including but not limited to:

• Role-based access controls;
• Authentication and access management;
• Encryption during transmission;
• Logging and security monitoring;
• Backup and recovery controls;
• Vulnerability and patch management;
• Secure software development practices;
• Confidentiality obligations for employees and contractors.

Production personal data should not be used in development or testing environments. Synthetic, masked or anonymised data should be used wherever possible.

7. Data Retention and Deletion

Customer personal data is retained in accordance with:

• The customer's documented instructions;
• The applicable service agreement;
• The Data Processing Agreement;
• Applicable legal and regulatory requirements.

Data may also be retained to comply with legal, accounting and contractual requirements, resolve disputes and protect legal rights.

At the end of the service relationship, customer personal data will be returned, deleted or securely retained as agreed with the customer and subject to applicable legal obligations.

Employee personal data is retained only for the period required for employment administration, legal compliance, dispute management and other legitimate organisational purposes in line with local laws.

8. Data-Subject Requests

Where JEBI Tech receives a request relating to personal data processed on behalf of a customer, JEBI Tech will forward or refer the request to the relevant customer. The customer, as data controller, is responsible for reviewing and responding to the request.

JEBI Tech will provide reasonable assistance to the customer where required under the applicable Data Processing Agreement.

Requests relating to JEBI Tech employee data will be handled directly by JEBI Tech in its capacity as data controller.

9. Your Rights

Depending on applicable law, individuals may have the right to:

• Access their personal information;
• Correct inaccurate information;
• Request deletion;
• Restrict or object to processing;
• Request data portability;
• Withdraw consent;
• Lodge a complaint with a data-protection authority.

Where information is processed on behalf of a JEBI Tech customer, requests may need to be directed to that customer.

10. Personal-Data Breaches

JEBI Tech maintains processes for identifying, assessing and responding to personal-data breaches. Where a breach affects customer personal data, JEBI Tech will inform the relevant customer without undue delay and provide reasonable information and assistance to support the customer's legal and regulatory obligations.

11. SMS and Text Messaging

Opt-In and Consent

JEBI Tech and its product VirtueInspect (virtueinspect.com) may send SMS/text notifications to end users who have provided explicit consent. Users opt-in to receive SMS messages through one of the following methods:

• Creating an account on jebitech.com and providing their phone number during signup or in account settings, and checking a box agreeing to receive SMS notifications from VirtueInspect regarding task assignments, updates, and reminders;
• Being added to a workspace by an administrator, at which point the user receives an initial SMS asking them to confirm opt-in by replying “YES.”

Types of Messages

SMS messages sent through our Services are limited to:

• Task assignment notifications;
• Task status updates;
• Schedule and deadline reminders;
• Account verification and security codes.

Message Frequency

Message frequency varies based on your activity and task assignments. You may receive multiple messages per day when tasks are assigned or updated.

Opt-Out

You may opt out of SMS notifications at any time by:

• Replying “STOP” to any SMS message received from VirtueInspect;
• Disabling SMS notifications in your account settings on jebitech.com;
• Contacting us at DPO@Jebitech.com.

After opting out, you will receive a single confirmation message. You will not receive further SMS messages unless you re-opt-in.

Costs and Carriers

Message and data rates may apply depending on your mobile carrier and plan. JEBI Tech is not responsible for any charges imposed by your carrier.

Phone Number Data

Phone numbers collected for SMS notifications are used solely for delivering the messages described above. We do not sell, rent, or share your phone number with third parties for marketing purposes. Phone numbers may be shared with our SMS service provider solely for the purpose of delivering messages on our behalf, subject to appropriate data protection agreements.

For help, reply “HELP” to any message or contact DPO@Jebitech.com.

12. Privacy Enquiries and Complaints

Data subjects, customers and other concerned parties may raise a privacy-related concern or data-subject request by contacting:

Where the request concerns personal data controlled by a JEBI Tech customer, the request may be referred to that customer for appropriate action.