Voluntary Information: Voluntary Information is information that you voluntarily provide to us, for example through the Contact page form on the Website, through our chat widget, or when you register the client for, and avail of, our services on its behalf. You may choose not to provide such information; however, it may affect the services available to the client, because certain details and documents are required to set up the client’s account, bill the client and register the service. The itemised list of the personal data we collect is in Schedule 1.

Identity proof of the authorised person: For system setup, billing and keeping a record of which clients we serve, we require Aadhaar or other ID proof of the client’s authorised person. This is the personal data of that individual. Aadhaar is only one of the ID proofs we accept. The authorised person is not required to provide Aadhaar if another valid ID proof is provided, and if Aadhaar is provided, we request a masked copy.

Contact details of the authorised person: The name, email address and phone number of the client’s authorised person. These are the personal data of that individual.

Business information of the client: The client’s business PAN, GST certificate, GST number, certificate of incorporation, company registration certificate and company address and, if either certificate is not available, a utility bill. These relate to the client entity and not to an individual, and they are not personal data. We nevertheless use them only for system setup, billing and keeping a record of which clients we serve, share them only as described in Section 3, and do not use them for marketing.

Recipient information: Information about the recipients of the client’s messages and campaigns (for example, their mobile numbers and the content of the messages) is not collected by us for our own purposes. We process it only as a Data Processor, on the client’s instructions, to deliver the messages the client asks us to send. The client is the Data Fiduciary for that information and is responsible for giving notice to those recipients and for obtaining all consents and permissions required by law, including under the DPDP Act, the TRAI regulations and the DLT requirements. Recipients who wish to exercise their rights should contact the client.

Involuntary Information: Involuntary Information is information collected automatically by Us when you visit our Website or avail of our services. We use cookies and similar technologies to collect it, and it may include your IP address and details of your operating system, browser and computer system. We do this only if you consent by ticking the relevant box in Part D of Schedule 1. You may withdraw that consent at any time, and you also have the option of disabling cookies within your browser.

Children: Our services are intended for businesses and their authorised representatives. We do not knowingly process the personal data of anyone under 18 years of age, and we do not track or monitor the behaviour of, or target advertising at, children. If we learn that we hold a child’s personal data without the verifiable consent of the child’s parent or lawful guardian, we will erase it. A parent or guardian who believes this has happened may write to our Grievance Officer.

We process your personal data only for the specific purposes stated in Schedule 1, and only with your consent or for a legitimate use permitted by the DPDP Act (such as complying with a law or a court order). We collect only the personal data that is necessary for those purposes.

The identity proof of the authorised person (Section 1.2) and the client’s business information (Section 1.4) are used only for system setup, billing and keeping a record of which clients we serve. They are not used for marketing.

The authorised person’s name, email address and phone number are used for the same purposes (system setup, billing and keeping a record of which clients we serve), and to respond to enquiries, communicate about the client’s account and provide support. They may also be used for marketing, but only if you have opted in, as described in Section 4. The client’s GST number and company address, being business information, are used for the same purposes and are not used for marketing.

Because we resell messaging solutions from third-party vendors, our vendors and the telecom operators need the client’s basic business details and the authorised person’s contact details to deliver and register the service. This sharing is described in Section 3.

Your system details, including your operating system, screen resolution and browser details, are collected to optimise our Website and other services to your requirements.

We may also process personal data to prevent and detect security threats, fraud or other illegal activity and to comply with applicable law, as the DPDP Act permits. We will not use your personal data for any other purpose without giving you a fresh notice and, where the law requires, obtaining your fresh consent.

We do not sell personal data. We share personal data and business information only with the parties described below, and only to the extent required to provide the service.

DLT platform: The authorised person’s identity proof (Section 1.2) and the client’s business information listed in Section 1.4 are shared with the DLT platform only. The authorised person’s name, email address and phone number, and the client’s GST number and company address, are also shared with the DLT platform where required. “DLT platform” means the Distributed Ledger Technology platform used under TRAI regulations to register businesses, sender IDs and message templates for commercial communications.

Messaging vendors and telecom operators: The authorised person’s name, email address and phone number, and the client’s GST number, are shared with our messaging vendors and telecom operators where required to deliver and register the service. Our vendors can also access the client’s company address.

WhatsApp: If you use our WhatsApp services, we may share the details required for template approval and registration with Meta, which may process them outside India, in accordance with the DPDP Act.

Legal disclosure: We may disclose personal information when we believe in good faith that the law requires it, or to protect the rights or property of Bonvoice, or if we believe that such disclosure is appropriate in the interests of national security. Under certain circumstances, Government authorities or a competent court may require the disclosure of information, including your personal information, and we will be obliged to comply, especially in the interests of national security, criminal investigations, legal proceedings and the like.

Once your information has been shared with a vendor, operator or platform, it is handled in accordance with that party’s own terms and privacy policy.

We engage vendors who process personal data on our behalf only under a valid contract. You can ask us for the identities of the other parties with whom we have shared your personal data and a description of that data, as set out in Section 7.

Contact page: The Contact page form on our Website has an optional checkbox for each marketing channel (see Part C of Schedule 1). Bonvoice Systems LLP collects the details you share through the form to respond to your enquiry. If you tick a marketing box, you agree to receive updates about our products and services through that channel (messages, RCS, email or phone calls), and we will also use your name, email address and phone number for that purpose.

Ticking any marketing checkbox is voluntary. None of them is a condition of making an enquiry or of availing of our services.

We use only your name, email address and phone number for marketing, and only if you have opted in on our Website. We do not use the authorised person’s identity proof or the client’s business information (including its GST number and company address) for marketing.

Chat widget: Information you share through our chat widget is used only to respond to you and is not used for marketing.

Withdrawing marketing consent: You can withdraw your consent to marketing communications at any time, as easily as you gave it, by writing to our Grievance Officer. Withdrawal will not affect messages relating to your account, services or billing, or any processing carried out before you withdrew consent.

We will send promotional messages and calls in accordance with the applicable TRAI regulations, including DLT registration and consent requirements.

We are committed to protecting your personal information.

All data is stored on servers located in India. It is encrypted, and access to it is restricted to authorised persons. We maintain reasonable security safeguards to protect the personal data in our possession or under our control, including measures to detect and investigate unauthorised access and to keep the logs needed for that purpose.

Information shared with the DLT platform, vendors, operators and other parties under Section 3 is held on their systems, which are outside our control and are governed by their own security practices. We require vendors that process personal data on our behalf to maintain reasonable security safeguards.

Personal data breach: If a personal data breach affects your personal data, we will inform you without delay and in plain language of its nature, extent, timing and location, its likely impact on you, the steps we have taken to reduce the risk, the safety measures you can take, and the contact details of our Grievance Officer. We will also inform the Data Protection Board of India, as the law requires.

However, no system is 100% safe and, to the extent permitted by applicable law, we do not make any guarantees against loss, corruption or leakage of data due to virus, hacking and similar malicious attacks. Further, we are not responsible for any damages caused due to any negligence, act or omission on your part.

We keep client data, including the personal data of the authorised person, for 2 years after the client is deactivated, so that we can meet our telecom, tax and accounting obligations, handle queries and resolve disputes. After that period, we erase or anonymise it. If you withdraw your consent earlier, we will erase your personal data, and ask our Data Processors to do so, unless the law requires us to keep it. However, we may keep an archived version for meeting the obligations mentioned above.

We may keep certain records for longer where required by applicable law (for example, tax, GST, accounting and telecom regulations) or to establish, exercise or defend legal claims, and only for as long as that requirement continues.

Details submitted through the Contact page or chat widget by persons whose organisations do not become clients are kept only for as long as needed to respond to the enquiry and, where you have opted in to marketing, until you withdraw your consent.

We keep the logs and traffic data relating to our processing of personal data for at least one year, as the DPDP Rules require, and for longer where other law requires.

Access: You may ask us for a summary of the personal data we process about you and the processing activities we carry out, the identities of all other Data Fiduciaries and Data Processors with whom we have shared your personal data, a description of the data shared, and any other information about your personal data and its processing that the law entitles you to.

Correction, completion, updating and erasure: You may ask us to correct inaccurate or misleading personal data, complete incomplete data, update it, or erase it. We will do so unless keeping the data is necessary for the purpose for which it was collected or is required by law (see Section 6).

Withdrawing consent: You may withdraw any consent you have given at any time, and it will be as easy to withdraw as it was to give. You can do so by writing to our Grievance Officer or, for marketing communications, by the method in Section 4.5. You bear the consequences of withdrawal: if you withdraw consent for the personal data in Part A of Schedule 1, we may be unable to set up or continue to provide our services to the client. Withdrawal does not affect the lawfulness of processing done before it. In the event there is a change of the authorised person for the Client entity, you may request deletion of your personal data and provide us with the details of your replacement. After you withdraw, we will stop processing your personal data, and cause our Data Processors to stop, within a reasonable time, unless the law permits or requires us to continue.

Grievance redressal: If you have a grievance about how we process your personal data or about the exercise of your rights, please write to our Grievance Officer at the details given below, with your name, contact details and a description of your request. We may ask you to verify your identity first. Please use this process before approaching the Data Protection Board of India. We will respond within 90 days, or any shorter period the law prescribes.

Nomination: You may nominate another individual who may exercise your rights on your behalf if you are incapacitated or become incapable of doing so.

Complaint to the Data Protection Board of India: If you are not satisfied with our response, you may make a complaint to the Data Protection Board of India under the DPDP Act.

Consent Managers: You may give, manage, review or withdraw your consent through a Consent Manager registered with the Data Protection Board of India, once such Consent Managers are available.

Your duties: You must comply with applicable laws when providing personal data to us; must not impersonate another person or suppress any material information; must ensure that the information you give us is verifiable and authentic; and must not make a false or frivolous grievance or complaint.

Applicable law: We process personal data in accordance with the DPDP Act and the DPDP Rules and, for so long as they remain in force, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

These terms are governed by the laws of India, with courts in Ernakulam, Kerala having jurisdiction.

Cancellation by the client: The client may cancel a service at any time by writing to us at the details given below (Section 3). Cancellation takes effect on the date we confirm it to the client in writing.

Cancellation by Bonvoice: Bonvoice may cancel a service, with or without cause, by giving the client written notice in accordance with the agreement.

Cancellation for Bonvoice’s breach: The client may cancel a service because of a breach committed by Bonvoice as contemplated in the SLA, in the manner and subject to the conditions (including any notice and cure period) set out in the SLA.

Charges: The client remains liable for the charges for services delivered, and message credits consumed, up to the date on which cancellation takes effect.

No refund on cancellation by the client: If the client cancels a service for any reason other than a breach committed by Bonvoice as described in Section 2.3, no refund will be made. This includes fees paid for any unexpired part of the service. No refund will be made either if Bonvoice cancels a service because of the client’s breach of the agreement or of applicable law.

Cancellation by Bonvoice without cause: If Bonvoice cancels a service without cause, Bonvoice will refund the client, on a pro rata basis, the fees the client has paid in advance for the period after the date on which cancellation takes effect.

Cancellation for Bonvoice’s breach: If the client cancels a service because of a breach committed by Bonvoice as contemplated in the relevant SLA, Bonvoice will refund the client, on a pro rata basis, the fees the client has paid in advance for the period after the date on which cancellation takes effect.

Pro rata calculation: A pro rata refund is the fees paid for the paid period, multiplied by the number of days remaining in that period after the date on which cancellation takes effect, divided by the total number of days in that period.

To claim a pro rata refund under Section 2.2 or 2.3, the client must write to us, with its account details, payment details and the basis of its claim, within 30 days of the date on which cancellation takes effect.

Approved refunds will be credited to the client’s original mode of payment within 30 business days of approval.

No refund will be made for services already delivered or for message credits already consumed.