GDPR & Data Subject Rights

Account & Data Deletion

Verdeshell IM (operated by Verdeshell Technologies Private Limited) is a multi-tenant B2B platform. User accounts are created by an organization (the “Customer”) for its team members. The organization owns the account and the operational data; individual team members are Users (Data Principals). There are two ways to request deletion, depending on what you want removed.

Path A — Delete an individual team-member account

You may request deletion of your own user account; an organization administrator may also request it on a team member's behalf.

Data deleted: your login credentials, full name, email address, hashed password, device push-notification token, and active sessions. Your activity attribution (inventory movements, audit submissions, and other actions) is anonymized — permanently disassociated from your identity.

Data kept: the underlying operational records (inventory movements, stock changes, audit entries) remain with the organization, which owns that data and may be required to retain it for audit-trail integrity and statutory record-keeping. After deletion these records no longer identify you.

Path B — Delete the entire organization account

An organization owner or administrator may request deletion of the whole organization account and all data associated with it.

Process & retention:on termination, the organization's data enters a 90-day grace window (to allow data export), after which it is permanently deleted from production systems and backups. Invoices and billing records are retained for 7 years to satisfy statutory accounting requirements under Indian law, then deleted.

Response time

We verify your identity before acting and respond within 30 days (GDPR) or the timelines prescribed by the DPDP Act 2023. Deletion requests are processed free of charge. A fuller breakdown of retention periods by data type is set out in our Data Usage Policy.

1. Applicability

GDPR (EU/EEA)

The GDPR applies to the processing of personal data of individuals located in the European Union and European Economic Area. If you are an EU/EEA resident and your personal data is processed through Verdeshell IM (for example, as an employee of an organization that subscribes to our Service), the GDPR rights described in this page apply to you.

DPDP Act 2023 (India)

India's Digital Personal Data Protection Act 2023 applies to the processing of digital personal data of individuals within India. If you are an Indian resident whose personal data is processed by Verdeshell, the rights under the DPDP Act described here apply to you.

2. Data Controller / Data Fiduciary

For EU/EEA residents: Verdeshell acts as the data controllerfor personal data processed in the course of providing the Service. Your employer or organization (if a Customer of Verdeshell) may also act as an independent data controller for purposes beyond the Service — consult your organization's privacy policy in that case.

For Indian residents: Verdeshell is the Data Fiduciary as defined under the DPDP Act 2023.

3. Personal Data We Process About You

As a User of Verdeshell IM, we process:

• Name and email address — used for authentication and notifications.
• Hashed password — stored as a BCrypt hash; never in plain text.
• Last login timestamp and failed login count — for security purposes.
• Role and permission assignments within your organization — for access control.
• Device push notification token — if you enable push notifications on mobile.
• Attribution of inventory movements, audit submissions, and other actions you take within the platform — these are linked to your user ID for operational and audit trail purposes.

We do not process special categories of personal data (sensitive personal information) about Users.

4. Your Rights Under GDPR (EU/EEA Residents)

4.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process personal data about you, and to receive a copy of that data along with information about the purposes, categories, recipients, and retention periods.

4.2 Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected. You can update your name and other profile information directly in the platform settings. For other corrections, contact legal@verdeshell.com.

4.3 Right to Erasure / Right to Be Forgotten (Article 17)

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (where consent was the basis), or where you object to processing under Article 21.

Note that as a B2B platform, certain data (such as inventory movement attributions) may be retained for contractual or legal compliance reasons (e.g., audit trail integrity, statutory record-keeping). We will inform you of any such limitations when responding to your request.

4.4 Right to Data Portability (Article 20)

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON or CSV) and to transmit it to another controller. Request a data export at legal@verdeshell.com.

4.5 Right to Restriction of Processing (Article 18)

You have the right to request that we restrict processing of your personal data in circumstances such as: you contest the accuracy of the data; the processing is unlawful but you oppose erasure; or you have objected to processing pending verification.

4.6 Right to Object (Article 21)

You have the right to object to processing of your personal data carried out on the basis of legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

4.7 Rights Related to Automated Decision-Making (Article 22)

Verdeshell IM does not currently make automated decisions that produce legal effects or similarly significant effects on individuals. AI-assisted features are planned for a future release — this policy will be updated before any such processing begins.

4.8 Right to Withdraw Consent

Where processing is based on consent (e.g., push notifications), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal. To withdraw push notification consent, disable notifications in your device settings or contact legal@verdeshell.com.

5. Your Rights Under DPDP Act 2023 (Indian Residents)

5.1 Right to Access Information (Section 11)

You have the right to obtain a summary of the personal data we process about you and the processing activities undertaken with respect to your data.

5.2 Right to Correction and Erasure (Section 12)

You have the right to correct inaccurate or misleading personal data, complete incomplete data, and request erasure of personal data that is no longer necessary for the purpose for which it was collected or that you no longer consent to us processing.

5.3 Right to Grievance Redressal (Section 13)

You have the right to have your grievances related to personal data processing addressed. We commit to responding to grievances within the timelines prescribed by the DPDP Act and its rules. Contact: legal@verdeshell.com.

5.4 Right to Nominate (Section 14)

You have the right to nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. To register a nomination, contact us at legal@verdeshell.com.

6. How to Exercise Your Rights

We will verify your identity before processing the request and respond within:

• GDPR: 30 days (extendable to 90 days for complex requests, with notice).
• DPDP Act 2023: within the timelines prescribed by the Act and applicable rules.

Requests are processed free of charge. For manifestly unfounded, excessive, or repetitive requests, we may charge a reasonable administrative fee or decline to act.

7. Data Transfers Outside India

Our primary infrastructure is hosted within India. Certain third-party processors (Google FCM, Sentry) may process limited data in jurisdictions outside India. We ensure such transfers are covered by:

• The relevant processor's Standard Contractual Clauses or equivalent mechanisms for EU data transfers.
• Adequacy decisions or government-approved transfer frameworks where applicable.

For EU/EEA residents: As a controller established outside the EU, we do not currently have an EU representative. If required under Article 27 GDPR based on our processing activities, we will appoint one and update this page.

8. Right to Lodge a Complaint with a Supervisory Authority

EU/EEA Residents

If you believe we have processed your personal data in violation of the GDPR, you have the right to lodge a complaint with the data protection supervisory authority in your EU member state of habitual residence, place of work, or the place of the alleged infringement. A list of EU supervisory authorities is available at edpb.europa.eu.

Indian Residents

Under the DPDP Act 2023, you may approach the Data Protection Board of India if your grievance is not resolved to your satisfaction by us. The Board's contact details will be published by the Government of India upon operationalization of the Board. Until then, you may contact legal@verdeshell.com for grievance redressal.

9. Updates to This Page

We will update this page when there are changes to applicable law, our processing activities, or our rights-handling procedures. Material changes will be communicated to registered users by email. The 14 June 2026 update added the Account & Data Deletion section (Paths A and B) above.

10. Contact