Privacy Policy
We believe privacy is a right, not a checkbox. Here's a plain-language explanation of exactly what we collect, why, and how it's protected.
📅 Effective Date: April 8, 2026🔄 Last Updated: April 8, 2026
Who We Are
Vinkar is a cloud-based HRMS, Payroll, and PSA platform built for IT services companies. The platform is operated by Vinkweb Infotech private limited , India a company incorporated under applicable law and operating from Dubai, UAE, with India operations.
For the purposes of applicable data protection laws — including India's Digital Personal Data Protection Act, 2023 (DPDPA) and the UAE Federal Decree-Law No. 45/2021 on Personal Data Protection — Vink Technologies is the Data Controller (or Data Fiduciary) in respect of your personal data.
Data We Collect
Information You Provide Directly
Contact form submissions: name, business email address, company name, phone number, and your message.
Account registration: full name, work email address, company name, designation, and a password (stored in hashed form only).
Profile updates: any optional information you add to your account profile after registration.
Information Collected Automatically
Log data: IP address, browser type and version, operating system, referring URL, pages visited, and timestamps.
Cookies and similar technologies: session cookies for authentication and analytics cookies to understand usage patterns. See Section 9 for full details.
Device information: device type, screen resolution, and language preferences.
Information We Do Not Collect
We do not collect payment card details directly — payments are processed securely via Razorpay. We do not collect sensitive personal data such as biometrics, government IDs, health information, or financial account numbers at the website/marketing stage.
How We Use Your Data
We use the data we collect for the following purposes:
To respond to enquiries submitted via our contact form, including scheduling demos and providing product information.
To create and manage your account, including authentication and access control.
To deliver the Vink ERP service you have signed up for, including sending transactional emails such as welcome messages, password resets, and billing notifications.
To improve our website and product using aggregated, anonymised analytics data.
To send product updates and marketing communications where you have given your explicit consent, or where we have a legitimate interest and you have not opted out.
To comply with legal obligations under applicable Indian and UAE law.
Legal Basis for Processing
We process your personal data under one or more of the following legal bases:
Consent: Where you have actively provided consent (e.g., subscribing to marketing emails or submitting a contact form).
Contractual necessity: Where processing is required to fulfil a contract with you (e.g., providing your registered account and the SaaS service).
Legitimate interests: Where processing is necessary for our legitimate business interests (e.g., improving our service, fraud prevention), provided those interests are not overridden by your rights.
Legal obligation: Where we are required to process data to comply with applicable law.
Sharing Your Data
We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:
Service providers: Trusted third-party vendors who process data on our behalf under strict data processing agreements, including cloud hosting (DigitalOcean), email delivery, analytics, and payment processing (Razorpay).
Business transfers: If Vink Technologies is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you in advance.
Legal requirements: Where we are required to disclose data by law, court order, or governmental authority.
Protection of rights: To protect the security, rights, or property of Vink Technologies, our users, or the public.
All third-party service providers are selected to ensure they meet appropriate data protection standards consistent with this policy.
Data Retention
We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law.
Contact form data: Retained for up to 24 months from the date of submission, or until the enquiry is resolved.
Account data: Retained for the duration of your active subscription plus 90 days following account closure to allow for reactivation, and thereafter for up to 36 months in anonymised or aggregated form.
Log and analytics data: Retained for up to 12 months.
You may request deletion of your data at any time (see Your Rights below), subject to our obligations under applicable law.
Your Rights
Depending on your jurisdiction (India or UAE), you have the following rights in relation to your personal data:
Access: Request a copy of the personal data we hold about you.
Correction: Request correction of inaccurate or incomplete data.
Erasure: Request deletion of your personal data, subject to our legal obligations.
Grievance redressal: Lodge a complaint with us via the contact details in Section 12. Under the DPDPA, you also have the right to file a complaint with the Data Protection Board of India.
Withdrawal of consent: Withdraw consent at any time where processing is based on consent. This does not affect the lawfulness of processing prior to withdrawal.
Opt out of marketing: Unsubscribe from marketing emails at any time via the link in any such email, or by contacting us.
Data portability: Request your data in a structured, machine-readable format where technically feasible.
To exercise any of these rights, please email us at privacy@vinkapp.com. We will respond within 30 days.
Security
We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:
TLS/HTTPS encryption for all data in transit.
AES-256 encryption for data at rest on DigitalOcean infrastructure.
Password hashing using bcrypt with appropriate salt rounds.
Role-based access controls limiting internal access to personal data.
Regular security reviews and vulnerability assessments.
While we take reasonable precautions, no transmission over the internet is 100% secure. If you suspect a security incident involving your account, please contact us immediately.
Cookies
We use the following categories of cookies on our website:
Strictly necessary cookies: Required for authentication, session management, and core platform functionality. These cannot be disabled.
Analytics cookies: Help us understand how visitors interact with our website (e.g., pages visited, time on site). We use anonymised analytics and do not track individuals across third-party websites.
Preference cookies: Remember your settings such as language or region preferences.
You can control non-essential cookies via your browser settings or our cookie consent banner. Note that disabling certain cookies may affect your experience on the site.
Children's Privacy
Vink ERP is a business-to-business platform intended for use by adults in a professional capacity. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us and we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, applicable law, or service offerings. When we make material changes, we will:
Update the "Last Updated" date at the top of this page.
Notify registered users via email at least 14 days prior to the changes taking effect.
Display a prominent notice on our website.
Continued use of the website or service after the effective date constitutes acceptance of the revised policy.
Contact & Grievances
If you have questions, concerns, or wish to exercise your rights, please contact our Data Protection Officer:
Grievance Officer / Data Protection Contact
Vink Technologies
Dubai, United Arab Emirates
India Operations: [City, India]
📧 privacy@vinkapp.com
🌐 www.vinkapp.com
We aim to respond to all privacy-related requests within 30 days of receipt. If you are located in India and are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once it becomes operational under the DPDPA, 2023.
