Legal Document

Data Compliance

Last Updated: June 12, 2026 | Governing Law: India | Framework: IT Act 2000 + DPDP Act 2023

ðŸ¢ JewelSoft is owned, developed, and operated by OmniServe Intelligence Pvt Ltd, incorporated under the Companies Act, 2013. OmniServe Intelligence Pvt Ltd is the Data Fiduciary (as defined under DPDP Act 2023) for all data collected through the JewelSoft platform and assumes full legal responsibility for data protection compliance.

1. Applicable Legal Framework

OmniServe Intelligence Pvt Ltd ensures that JewelSoft complies with all applicable Indian data protection and technology laws:

IT Act, 2000

Information Technology Act, 2000 â€” the primary law governing electronic commerce, cybercrime, and data security in India.

IT Rules, 2011

IT (SPDI) Rules 2011 â€” defines Sensitive Personal Data and mandates reasonable security practices for companies.

DPDP Act, 2023

Digital Personal Data Protection Act 2023 â€” India's primary data protection legislation governing processing of digital personal data.

IT Intermediary Rules, 2021

IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 â€” governs platform liability and takedown obligations.

CGST Act, 2017

Goods & Services Tax law â€” financial records including invoices and billing data must be retained for 7 years.

PMLA, 2002

Prevention of Money Laundering Act â€” high-value jewellery transactions may attract KYC and record-keeping obligations.

2. Roles Under DPDP Act 2023

OmniServe Intelligence Pvt Ltd as Data Fiduciary

OmniServe Intelligence Pvt Ltd is the Data Fiduciary for all data collected directly from jewellers registering on JewelSoft (name, email, GST, business data). As Data Fiduciary, OmniServe:

Determines the purpose and means of processing personal data
Ensures lawful, fair, and transparent processing
Is responsible for implementing appropriate technical and organisational security measures
Appoints a Grievance Officer and maintains a data processing register

Registered Jewellers as Data Fiduciaries

When Jewellers enter their end-customers' personal data (name, phone number, purchase history) into JewelSoft, the Jeweller acts as a Data Fiduciary for that customer data, and OmniServe acts as a Data Processor processing it on the Jeweller's behalf.

3. Data Processing Principles

OmniServe Intelligence Pvt Ltd adheres to the following data processing principles under the DPDP Act 2023:

Principle	How JewelSoft Complies	Status
Purpose Limitation	Data is collected only for specific, stated purposes (billing, inventory, loans) and not used beyond those purposes	âœ” Compliant
Data Minimisation	Only data necessary for the stated business function is collected	âœ” Compliant
Accuracy	Users can update their business profile and customer data at any time	âœ” Compliant
Storage Limitation	Data is retained per statutory requirements; accounts can be deleted on request	âœ” Compliant
Security	HTTPS/TLS, bcrypt passwords, session tokens, role-based access, encrypted database	âœ” Compliant
Accountability	OmniServe Intelligence Pvt Ltd assumes full legal responsibility as Data Fiduciary	âœ” Compliant

4. Cross-Border Data Transfers

JewelSoft uses Supabase Inc. (USA) for database hosting. Data transferred outside India is governed by:

Standard contractual clauses (SCCs) between OmniServe and Supabase
Compliance with Section 16 of the DPDP Act 2023 (restrictions on cross-border transfer of personal data)
Pending the Central Government's notification of permitted countries under the DPDP Act, transfers are conducted under contractual safeguards

5. Security Measures (IT Rules 2011 â€” Annex A Compliance)

âœ” Encrypted data transmission (HTTPS/TLS 1.3)
âœ” Password hashing with bcrypt (minimum 10 rounds)
âœ” Session-based authentication with secure, HTTP-only cookies
âœ” Role-based access control (Admin / Manager / Staff)
âœ” Automated daily database backups with 30-day retention
âœ” Access logs maintained for audit purposes
âœ” Data breach incident response plan in place

6. Data Breach Notification

In the event of a personal data breach, OmniServe Intelligence Pvt Ltd shall:

Notify the Data Protection Board of India as required under DPDP Act 2023
Notify affected Data Principals (registered jewellers and, where applicable, their customers) without undue delay
Document all breaches in our internal incident register

7. Data Principal Rights

Under the DPDP Act 2023, you have the following rights which can be exercised by contacting our Grievance Officer:

Right to Access: Obtain a summary of personal data OmniServe processes about you
Right to Correction: Correct inaccurate or incomplete personal data
Right to Erasure: Request deletion of your data (subject to statutory retention requirements)
Right to Grievance Redressal: File a complaint with our Grievance Officer, and escalate to the Data Protection Board of India if not resolved
Right to Nominate: Nominate a trusted individual to exercise your rights in case of death or incapacity

8. Retention Schedule

Data Type	Retention Period	Legal Basis
Invoice & Billing Records	7 years	CGST Act, 2017 â€” Section 35
Gold Loan Ledger	7 years	RBI Master Directions & accounting standards
User Account Data	Duration of subscription + 1 year	DPDP Act 2023 â€” Storage Limitation
Access Logs	90 days	IT Intermediary Rules 2021 â€” Rule 3(1)(j)
Customer PII	As directed by Jeweller (Data Fiduciary)	DPDP Act 2023

9. Grievance Officer

As mandated under IT Rules 2011 and DPDP Act 2023, OmniServe Intelligence Pvt Ltd has designated a Grievance Officer for data compliance matters:

Company: OmniServe Intelligence Pvt Ltd
Email: support@omniserveai.com
Data Compliance Email: support@omniserveai.com
Response Time: Acknowledgement within 24 hours; resolution within 30 days.
Escalation: Data Protection Board of India (once operational under DPDP Act 2023)

10. Changes to This Policy

OmniServe Intelligence Pvt Ltd may update this Data Compliance document as laws evolve. Registered users will be notified of material changes via email. Continued use of JewelSoft constitutes acceptance.