Privacy Policy

This Privacy Policy describes how Factura Softwares (“Factura”, “we”, “us” or “our”) collects, receives, uses, stores, processes, shares, protects and otherwise handles Personal Data in connection with our websites, software applications, cloud services, mobile and desktop applications, APIs, support services and other products and services offered under the Factura brand.

Our principal place of business is at 602 C2A, BKM Society, Om Nagar, Andheri East, Mumbai 400099, Maharashtra, India.

This Privacy Policy should be read together with our Terms of Service, applicable Order Forms, subscription agreements, Data Processing Addenda, product-specific terms and any privacy notices presented to you when Personal Data is collected.

1. Scope

This Privacy Policy applies to Personal Data processed by Factura in connection with:

1. our website, including www.facturasoftwares.com;
2. Factura Financials and accounting solutions;
3. Factura HRMS, payroll and employee-management solutions;
4. Factura CRM;
5. Factura Contract and contract-management solutions;
6. mobile, desktop and cloud applications made available by Factura;
7. integrations, APIs, support portals and related services;
8. demonstrations, trials, subscriptions and customer-support interactions;
9. sales, marketing and business-development activities; and
10. AI-enabled, automation and analytical features made available as part of our Services.

This Policy does not govern third-party websites, services, applications or integrations that are governed by their own privacy policies.

2. Applicable Data Protection Framework

Factura processes Personal Data in accordance with applicable laws and regulations in force from time to time, including, where applicable:

• the Information Technology Act, 2000 and applicable rules made thereunder;
• the Digital Personal Data Protection Act, 2023 (“DPDP Act”);
• the Digital Personal Data Protection Rules, 2025, as and when the relevant provisions become applicable;
• the Data Protection Act, 2012 (Act 843) of Ghana, where Factura processes Personal Data of individuals in Ghana or on behalf of Customers established in Ghana; and
• any other applicable privacy or data-protection law governing a particular processing activity.

Where the laws of another jurisdiction apply to a particular Customer, Data Principal or processing activity, Factura will comply with such additional requirements to the extent applicable to Factura.

3. Definitions

For purposes of this Policy:

“Customer” means an organisation, business, firm, company, employer or other person that subscribes to, purchases or uses the Services.

“Customer Data” means information, documents, records and other data submitted to, stored in, generated through or otherwise processed using the Services by or on behalf of a Customer.

“Personal Data” means data about an individual who is identifiable by or in relation to such data and includes any equivalent concept under applicable privacy law.

“Data Principal” means the individual to whom Personal Data relates.

“Process” or “Processing” includes collecting, recording, organising, storing, using, analysing, transmitting, sharing, retrieving, altering, deleting or otherwise handling Personal Data.

“Services” means the software, applications, websites, cloud services, APIs, support services and other products and services provided by Factura.

4. Factura's Role in Processing Personal Data

Factura may process Personal Data in different capacities depending upon the circumstances.

4.1 Where Factura Determines the Purpose of Processing

Factura ordinarily acts as the Data Fiduciary or equivalent controller in relation to Personal Data concerning:

• website visitors;
• prospective customers;
• customer administrators and authorised users;
• billing and payment contacts;
• persons requesting demonstrations;
• persons communicating with our sales or support teams;
• vendors and business partners; and
• persons who otherwise interact directly with Factura.

In these circumstances, Factura determines why and how the Personal Data is processed.

4.2 Customer Data Processed on Behalf of Customers

When a Customer uses Factura to process information relating to the Customer's employees, workers, customers, suppliers, vendors, contractors, business contacts or other persons, the Customer ordinarily determines the purpose and means of processing.

For such Customer Data, the Customer ordinarily acts as the Data Fiduciary or Data Controller, and Factura acts as a Data Processor or service provider processing the Personal Data on the Customer's instructions.

For example, an employer using Factura HRMS to process employee attendance, payroll or leave information is responsible for determining why that employee information is being processed and for satisfying the employer's applicable notice, consent and other legal obligations.

Factura will process such Customer Data only for providing, securing, supporting and improving the Services, complying with documented Customer instructions, fulfilling legal obligations, or as otherwise permitted under the applicable agreement and law.

5. Personal Data We May Collect

Depending upon the Services used and your relationship with Factura, we may process the following categories of information.

5.1 Account and Identification Information

This may include:

• name;
• business or organisation name;
• designation;
• postal address;
• email address;
• telephone or mobile number;
• username or account identifier;
• profile information;
• authentication information; and
• information required to administer an account.

5.2 Commercial and Subscription Information

This may include:

• products and subscription plans purchased;
• quotation and order details;
• billing address;
• invoices;
• GST and tax-related details;
• payment status;
• transaction records; and
• communications relating to purchases, renewals or subscriptions.

Where payments are processed through an external payment provider, payment-card or banking information may be processed directly by that provider rather than stored by Factura.

5.3 Financial and Accounting Data

Customers using Factura Financials may upload or generate information such as:

• accounting entries;
• ledgers;
• invoices;
• vouchers;
• customer and vendor records;
• bank-related information;
• taxation information;
• GSTIN, PAN or other identifiers;
• receivable and payable records;
• inventory information;
• financial statements; and
• other financial or business records.

Such information may include Personal Data relating to individuals connected with the Customer's business.

5.4 HR, Payroll and Employee Data

Customers using Factura HRMS or payroll services may process information including:

• employee names and contact details;
• employee identification numbers;
• date of birth;
• employment history;
• department, designation and reporting structure;
• attendance and working-hours information;
• leave records;
• compensation, payroll and incentive information;
• bank-account information;
• tax and statutory contribution information;
• PAN and other statutory identifiers;
• performance and appraisal records;
• expense and reimbursement information;
• training records;
• disciplinary, grievance or separation records;
• dependent or nominee information; and
• other information entered by the Customer.

Factura does not require Customers to upload unnecessary Personal Data and Customers should configure and use the Services in accordance with the principle of data minimisation.

5.5 CRM and Contract Data

Customers using Factura CRM or Factura Contract may process:

• customer and prospect information;
• contact details;
• sales activities;
• communications;
• contractual documents;
• names and details of signatories;
• commercial terms; and
• other business records.

5.6 Technical, Device and Usage Information

We may automatically collect information such as:

• IP address;
• browser type;
• operating system;
• device identifiers;
• login time and authentication events;
• application and feature usage;
• diagnostic data;
• error and crash information;
• access logs;
• audit logs;
• security events; and
• information about interactions with our website and Services.

5.7 Communications and Support Information

When you contact us, we may process:

• support requests;
• emails;
• chat communications;
• telephone or meeting notes;
• screenshots;
• diagnostic files; and
• other information supplied to resolve a support request.

Customers should avoid providing Personal Data that is not relevant to the support request.

5.8 Cookies and Similar Technologies

Our website and online Services may use cookies and similar technologies for authentication, security, preferences, analytics, performance and, where permitted, marketing purposes.

You can control cookies through your browser settings. Disabling certain cookies may affect the functioning of the website or Services.

6. Sources of Personal Data

We may obtain Personal Data:

• directly from you;
• from the Customer or organisation through which you use our Services;
• from authorised users or administrators;
• automatically through the Services;
• from authorised business partners or resellers;
• from service providers and integration partners;
• from publicly available sources; or
• from third parties where such disclosure to Factura is lawful.

7. Purposes for Which We Process Personal Data

Factura may process Personal Data for purposes including:

1. creating and administering accounts;
2. providing and operating the Services;
3. authenticating users and controlling access;
4. processing subscriptions, payments and invoices;
5. providing implementation, maintenance and technical support;
6. responding to enquiries and requests;
7. communicating service, security and administrative information;
8. maintaining audit trails and transaction records;
9. monitoring and protecting the security and integrity of the Services;
10. preventing fraud, misuse and unauthorised access;
11. diagnosing errors and improving reliability and performance;
12. developing and improving our products and Services;
13. complying with legal, accounting, regulatory and taxation requirements;
14. enforcing contractual rights and resolving disputes;
15. performing analytics using aggregated or appropriately de-identified information;
16. conducting sales and marketing activities where permitted by law; and
17. any other purpose disclosed to you at or before collection.

Where consent is required by applicable law, Factura will seek consent in a clear manner appropriate to the relevant processing activity.

Where processing is based upon consent, consent may be withdrawn in accordance with applicable law. Withdrawal does not affect processing already lawfully undertaken before withdrawal and may affect our ability to provide a Service that requires the relevant Personal Data.

8. Customer Responsibilities for Customer Data

Customers remain responsible for Personal Data that they control and submit to the Services.

Each Customer represents and warrants that it has the lawful authority to collect and process Customer Data and to instruct Factura to process such information.

Customers are responsible for:

• providing applicable privacy notices;
• obtaining required consents or establishing another lawful basis for processing;
• complying with employee, labour, tax, financial, privacy and other applicable laws;
• responding to Data Principal requests where the Customer is the Data Fiduciary;
• ensuring Personal Data entered into the Services is appropriate and relevant;
• maintaining accurate authorised-user permissions; and
• ensuring that Customer administrators do not grant unnecessary access to Customer Data.

Where Factura receives a Data Principal request concerning Personal Data controlled by a Customer, Factura may refer the requester to the relevant Customer and may assist the Customer as required by applicable law or contract.

9. AI-Enabled and Automated Features

Certain Factura Services may include AI-assisted, machine-learning, analytical or automated functionality.

Information submitted to such functionality may be processed to provide the requested feature, subject to this Privacy Policy, applicable product terms and any additional notice presented for that feature.

AI-generated responses, summaries, predictions, classifications or recommendations may contain errors and should be independently reviewed before being relied upon for accounting, payroll, tax, employment, legal, financial or other material decisions.

Unless expressly agreed otherwise with the Customer, Factura will not use a Customer's confidential Customer Data to train a general-purpose AI model for unrelated customers.

Where an AI feature depends on a third-party service provider, information necessary to provide the feature may be transmitted to that provider subject to contractual and security controls and applicable law.

10. Sharing and Disclosure

Factura does not sell Customer Data or Personal Data for monetary consideration.

We may share Personal Data where reasonably necessary with:

10.1 Service Providers and Sub-Processors

We may engage vendors that provide services such as:

• cloud infrastructure and hosting;
• email delivery;
• communications;
• analytics;
• cybersecurity;
• payment processing;
• technical support;
• customer relationship management;
• data backup; and
• AI or other technology services.

Such providers are permitted to process Personal Data only for the relevant service and subject to appropriate contractual obligations.

10.2 Customer Administrators and Authorised Users

Where you use the Services through an organisation, authorised administrators of that organisation may access and control your account and information in accordance with the organisation's permissions and policies.

10.3 Third-Party Integrations

Where a Customer enables an integration with a third-party service, information may be exchanged with that service as directed by the Customer.

The privacy practices of the third-party provider will also apply.

10.4 Legal and Regulatory Requirements

We may disclose information where reasonably necessary to:

• comply with applicable law;
• comply with an order issued by a court, regulator or competent authority;
• investigate fraud, cybersecurity incidents or unlawful activity;
• protect the rights, property or security of Factura, our Customers or others; or
• establish, exercise or defend legal claims.

10.5 Corporate Transactions

Personal Data may be disclosed in connection with a proposed or completed merger, acquisition, financing, restructuring, sale of business or assets, provided appropriate confidentiality and data-protection safeguards are applied.

11. International and Cross-Border Processing

Factura primarily operates from India.

Some infrastructure providers, integrations or technology service providers may process information outside India.

Where Personal Data is transferred outside India, Factura will take measures required under applicable law, including restrictions or conditions notified by the Government of India from time to time.

Customers remain responsible for determining whether their own use of particular integrations or data-storage configurations is subject to additional localisation or sector-specific requirements.

12. Customers and Individuals in Ghana

This Section applies where Personal Data relates to individuals in Ghana or is processed on behalf of a Customer established in Ghana.

In relation to Customer Data, the Customer is the data controller for purposes of the Data Protection Act, 2012 (Act 843) and Factura acts as a data processor on the Customer's behalf. The Customer is responsible for its own registration with the Data Protection Commission of Ghana and for satisfying the notice, consent and other obligations that Act 843 places on data controllers.

Individuals in Ghana may have rights under Act 843, including rights to access and correct Personal Data, to object to or prevent certain processing, including processing for direct marketing, and to lodge a complaint with the Data Protection Commission. Where the Personal Data is controlled by a Customer, requests should ordinarily be directed to that Customer.

Factura operates from India. Personal Data relating to individuals in Ghana may therefore be stored or processed in India or in other countries where Factura's infrastructure and service providers operate, subject to the safeguards described in this Policy.

13. Data Security

Factura maintains reasonable administrative, organisational, physical and technical safeguards designed to protect Personal Data against unauthorised access, disclosure, alteration, loss, destruction or misuse.

Measures may include, as appropriate:

• access controls and role-based permissions;
• authentication controls;
• encryption in transit and, where appropriate, at rest;
• logging and monitoring;
• backup and recovery procedures;
• vulnerability and patch-management processes;
• network and infrastructure protections;
• employee confidentiality obligations; and
• incident-management procedures.

No internet-based system can be guaranteed to be completely secure. Customers are also responsible for protecting their credentials, endpoints, networks and administrator accounts.

14. Personal Data Breaches and Security Incidents

Factura maintains procedures for investigating and responding to suspected Personal Data breaches.

Where Factura acts as a Data Processor for Customer Data, Factura will notify the affected Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting that Customer Data, to the extent required by applicable law or contract.

Where Factura acts as a Data Fiduciary, Factura will provide notifications to affected Data Principals, the Data Protection Board of India or other competent authority as required by applicable law.

15. Retention and Deletion

Factura retains Personal Data only for so long as reasonably necessary for the purpose for which it was processed, including to provide the Services and meet contractual, legal, accounting, security and regulatory obligations.

Different categories of information may therefore have different retention periods.

Customer Data is ordinarily retained during the active subscription or contractual relationship.

Following expiry or termination, the applicable Order Form, subscription agreement, product documentation or enterprise agreement may provide a period during which Customer Data can be exported.

Where no different period has been agreed, Factura may commence deletion of Customer Data after 30 days following termination or expiry.

Residual copies may remain in encrypted backups, logs and disaster-recovery systems until they are overwritten or deleted in accordance with Factura's normal retention cycle.

Information may be retained for longer where required by law, legal proceedings, regulatory obligations, fraud prevention or legitimate security purposes.

16. Data Principal Rights

Subject to applicable law and Factura's role in relation to the relevant Personal Data, an individual may have rights to:

• obtain information concerning the processing of Personal Data;
• request access to Personal Data;
• request correction, completion or updating of inaccurate Personal Data;
• request erasure of Personal Data where applicable;
• withdraw consent where processing is based on consent;
• request grievance redressal;
• nominate another individual to exercise rights in circumstances permitted by law; and
• exercise other rights made available under applicable law.

Requests may be sent to info@facturasoftwares.com.

Factura may need to verify the requester's identity before processing a request.

Where the Personal Data is controlled by a Factura Customer, requests should ordinarily be submitted directly to that Customer.

17. Marketing Communications

Factura may communicate information about our products, upgrades, events, webinars and services where permitted by law.

Recipients may unsubscribe from non-essential promotional communications using the unsubscribe mechanism contained in the communication or by contacting us.

Opting out of marketing does not prevent Factura from sending essential service, security, billing, contractual or account communications.

18. Children

Factura's website and Services are intended primarily for businesses and are not directed to children for their independent personal use.

Where a Customer processes information concerning a child through the Services, including dependent, nominee or other HR information, the Customer is responsible for satisfying applicable legal requirements relating to such processing, including parental or guardian consent where required.

Factura will comply with obligations directly applicable to it concerning the processing of children's Personal Data.

19. De-Identified and Aggregated Information

Factura may create aggregated or de-identified information that does not reasonably identify an individual or Customer.

Such information may be used for statistical analysis, security, capacity planning, research, benchmarking and improvement of the Services, provided Factura does not attempt to re-identify such information except where required for security, validation or as permitted by law.

20. Third-Party Websites and Integrations

Our Services may contain links to or integrate with third-party websites, government portals, banks, payment providers, communication services or other applications.

Factura does not control the independent privacy practices of such third parties. Customers should review the privacy terms applicable to those services before enabling an integration or providing information to them.

21. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our Services;
• changes in our processing practices;
• changes in technology;
• changes in legal requirements; or
• security and regulatory developments.

The updated Policy will be published with a revised “Last Updated” date.

Where required by law or where a change materially affects the manner in which Personal Data is processed, we will provide additional notice or obtain consent as required.

22. Privacy and Grievance Officer

Questions, complaints and requests concerning this Privacy Policy or Factura's handling of Personal Data may be addressed to:

Privacy & Grievance Officer
Factura Softwares
602 C2A, BKM Society, Om Nagar, Andheri East, Mumbai 400099, Maharashtra, India
Email: info@facturasoftwares.com

We will review and respond to valid grievances within the period required by applicable law.

Where applicable provisions of the DPDP Act are in force, a Data Principal may also exercise the statutory remedies available before the Data Protection Board of India after following the applicable grievance-redressal process.

23. Contact Us

For general questions concerning Factura's products or Services:

Factura Softwares
602 C2A, BKM Society, Om Nagar, Andheri East, Mumbai 400099, Maharashtra, India
Email: info@facturasoftwares.com