1. INTRODUCTION

ETECH SERVICES PRIVATE LIMITED (“ETECH“, “we“, “our” or “us“) is dedicated to protecting the privacy, confidentiality and security of the information handled through MR Reporting and its associated websites, applications, software, products and services.

MR Reporting is a workforce productivity intelligence platform that lets organisations manage workforce productivity, attendance, application and website usage, activity, screenshots, reporting and other related workplace information.

This Privacy Policy describes how ETECH collects, uses, processes, stores, protects, retains and shares information when you:

• visit our website;

• set up or log in to an account;

• use MR Reporting;

• use our applications or software;

• ask for a demonstration or trial;

• get in touch with our sales or support teams;

• take part in implementation or onboarding; or

• interact with ETECH or MR Reporting in any other way.

This Privacy Policy should be read alongside the following policies and terms published on the MR Reporting website, where applicable:

• Terms of Service

• Service Level Agreement (SLA)

• Cancellation and Refund Policy

• Shipping and Exchange Policy

Some customers, especially enterprise customers, may also sign further contractual documents with ETECH, such as an Enterprise Subscription Agreement, an Enterprise Software License & Support Agreement or other relevant agreements. Where these apply, they may include specific terms on data processing, security, confidentiality, retention, service levels and other matters.

If this Privacy Policy conflicts with a signed Customer agreement that applies, the signed Customer agreement will prevail to the extent of the conflict.

2. ABOUT ETECH

MR Reporting is offered by:

ETECH SERVICES PRIVATE LIMITED

Corporate Office: 325, Qutub Plaza, DLF City Phase 1, Gurgaon 122002, Haryana, India.

For questions or requests about privacy:

Email: info@mrreporting.com

Website: https://mrreporting.com

3. SCOPE

This Privacy Policy covers information that ETECH processes in connection with:

• MR Reporting;

• the MR Reporting website;

• MR Reporting applications and software;

• desktop applications and agents;

• free trials and demonstrations;

• customer onboarding and implementation;

• technical support;

• professional services;

• sales and business communications;

• customer and user accounts; and

• any other services ETECH provides.

This Privacy Policy covers both:

• Cloud-hosted (SaaS) deployments; and

• Customer-hosted (On-Premise) deployments,

subject to the responsibilities set out in this Privacy Policy and in any applicable Customer agreement.

4. ROLES OF ETECH AND THE CUSTOMER

For Customer Data processed through MR Reporting on behalf of an organisation, and unless applicable law requires otherwise:

• the Customer is the Data Controller, Data Fiduciary or equivalent under applicable law; and

• ETECH is the Data Processor or equivalent service provider to the extent it processes Personal Data on the Customer’s behalf.

The Customer is responsible for:

• deciding why data is collected and processed;

• deciding the lawful basis for processing;

• deciding which Personal Data is processed through MR Reporting;

• setting up MR Reporting appropriately;

• giving any privacy notices required by law;

• securing any required permissions, approvals or consents;

• telling employees and users about the relevant data processing; and

• complying with applicable employment, labour, workplace monitoring, privacy, cybersecurity and data protection laws.

ETECH does not decide the Customer’s employment, workforce management, monitoring or business purposes for using MR Reporting.

ETECH does not give legal, employment, HR, regulatory or compliance advice.

Where ETECH processes Personal Data directly for its own purposes, for example for website enquiries, sales communications, account management, billing, security or business administration, ETECH may act as the Controller or equivalent under applicable law.

5. INFORMATION WE COLLECT

Depending on how you interact with ETECH and MR Reporting, we may collect and process the types of information described below.

5.1 Account and Business Information

This may include:

• name;

• work email address;

• phone number;

• job title;

• organisation name;

• business address;

• account identifiers;

• login credentials;

• authentication details;

• billing details; and

• information given during registration or onboarding.

5.2 Device and Technical Information

This may include:

• type of device;

• device identifiers;

• operating system;

• IP address;

• browser details;

• application version;

• network details;

• system configuration;

• diagnostic data;

• error logs; and

• system performance data.

5.3 Workforce and Activity Information

Depending on how the Customer configures and uses MR Reporting, the platform may process:

• details of employees or users;

• attendance records;

• application usage;

• website usage;

• login and logout details;

• productivity metrics;

• activity details;

• screenshots;

• screen monitoring data;

• live monitoring data;

• activity logs;

• productivity reports;

• device details; and

• any other information the Customer configures or uploads.

The Customer decides which types of Personal Data are processed through MR Reporting.

5.4 Support and Communication Information

This may include:

• support tickets;

• service requests;

• email correspondence;

• meeting details;

• technical troubleshooting details;

• feedback;

• survey responses; and

• any other communications with ETECH.

5.5 Customer-Provided Information

Customers may upload, submit or otherwise process documents, files, records, reports, images, screenshots, employee details or other information through MR Reporting.

This information may be Customer Data and is generally processed by ETECH for the Customer under the applicable agreement.

6. HOW WE USE INFORMATION

ETECH may process information for the purposes set out below.

6.1 Providing MR Reporting

We may process information to:

• deliver MR Reporting functionality;

• set up and manage accounts;

• verify users;

• deliver workforce productivity functionality;

• deliver attendance and activity functionality;

• produce reports and analytics;

• provide dashboards;

• keep the system available;

• deliver the services purchased; and

• provide implementation and onboarding services.

6.2 Technical Support and Maintenance

We may process information to:

• give technical support;

• look into incidents;

• resolve technical issues;

• diagnose software problems;

• keep the service reliable;

• maintain the software;

• deliver Updates and Upgrades; and

• respond to customer requests.

6.3 Security and Fraud Prevention

We may process information to:

• spot unauthorised access;

• prevent misuse;

• investigate security incidents;

• protect the security and integrity of MR Reporting;

• monitor how the system performs;

• find vulnerabilities;

• prevent fraud or abuse; and

• enforce applicable contractual and security requirements.

6.4 Product Improvement

Subject to applicable law and contractual limits, ETECH may process technical, diagnostic, statistical, aggregated, anonymised or de-identified information to:

• improve MR Reporting;

• improve performance and reliability;

• build new functionality;

• study product usage trends;

• improve security; and

• develop analytics and product capabilities.

ETECH does not sell Customer Data and does not use it for advertising.

Where reasonably practicable, ETECH will rely on aggregated, anonymised or de-identified information for product improvement and analytics.

6.5 Business and Administrative Purposes

We may also process information for:

• billing and processing payments;

• administering contracts;

• managing accounts;

• keeping business records;

• responding to lawful requests;

• meeting legal obligations;

• protecting our legal rights; and

• running corporate operations.

7. LEGAL BASIS FOR PROCESSING

Depending on the applicable law and the situation, ETECH may process Personal Data on the basis of:

• performing a contract;

• meeting legal obligations;

• legitimate business interests, where the law allows;

• consent;

• instructions from the Customer; or

• any other lawful basis available under applicable law.

Where ETECH processes Personal Data for a Customer, the Customer remains responsible for deciding the right lawful basis for its own processing.

8. CUSTOMER DATA AND OWNERSHIP

Customer Data belongs to, and stays under the control of, the Customer.

ETECH makes no claim of ownership over Customer Data.

ETECH may access or process Customer Data only to the extent reasonably needed to:

• deliver the contracted services;

• carry out implementation;

• provide support;

• resolve technical issues;

• carry out maintenance;

• deliver Professional Services;

• deliver Updates and Upgrades;

• maintain security;

• meet legal requirements; or

• carry out any other activity the Customer has authorised or the applicable agreement permits.

ETECH may create and use aggregated, anonymised or de-identified information that does not identify the Customer or any individual user, for legitimate business purposes including improving the service, analytics, security, product development and statistical analysis.

9. SAAS AND ON-PREMISE DATA RESPONSIBILITIES

9.1 SaaS Deployment

For Cloud-hosted SaaS deployments, ETECH is responsible for security and operational controls within the infrastructure it controls, including, where relevant:

• application security;

• hosting infrastructure;

• managed databases;

• software updates;

• security patches;

• infrastructure security;

• monitoring of the platform; and

• operational security controls.

The Customer is responsible for:

• managing user accounts;

• password security;

• endpoint security;

• internet connectivity;

• managing internal access;

• its own configurations; and

• any Customer Data it exports from the platform.

9.2 On-Premise Deployment

For Customer-hosted On-Premise deployments, Customer Data stays within the Customer Environment and under the Customer’s control, except where ETECH temporarily accesses or stores Customer Data for agreed implementation, support, troubleshooting, migration or other Services.

ETECH is responsible for the security of the Licensed Software, including, where relevant:

• software security;

• software updates;

• security patches;

• bug fixes;

• authentication and authorisation mechanisms inside the Licensed Software;

• secure development practices; and

• technical support.

The Customer is responsible for securing and operating its Customer Environment, including:

• servers;

• operating systems;

• databases;

• storage;

• networking;

• firewalls;

• VPN configuration;

• Active Directory or other identity services;

• SSL certificates;

• endpoint security;

• backup and disaster recovery;

• internet connectivity; and

• any other infrastructure within the Customer Environment.

ETECH is not responsible for Security Incidents that arise solely from vulnerabilities, failures, misconfiguration or compromise within the Customer Environment.

10. DATA STORAGE AND LOCATION

For SaaS deployments, Customer Data may be stored and processed on infrastructure run by ETECH or its authorised service providers.

Data may be hosted or processed in India or in other countries where reasonably needed for:

• delivering the service;

• running infrastructure;

• system reliability;

• technical support;

• redundancy;

• business continuity; or

• disaster recovery.

For On-Premise deployments, Customer Data stays within the Customer Environment unless expressly agreed otherwise or temporarily accessed by ETECH to provide the Services.

11. DATA RETENTION

11.1 SaaS Deployment

Unless the applicable Order Form or contract says otherwise, Customer Data is kept on a rolling ninety (90) day basis while the Subscription Term is active.

This means Customer Data older than ninety (90) days may be deleted automatically from the production environment under MR Reporting’s standard retention policy.

The Customer can export available Customer Data using the export tools inside MR Reporting.

After a SaaS subscription ends or expires, the Customer may export available Customer Data during the period set out in the applicable agreement or Order Form. Once that period ends, ETECH may securely delete or permanently anonymise any remaining Customer Data, unless the law requires it to be kept or it has been otherwise agreed in writing.

11.2 On-Premise Deployment

Customer Data stays within the Customer Environment and under the Customer’s control.

The Customer is responsible for:

• data retention;

• backup;

• archiving;

• restoration;

• deletion; and

• compliance with any record-keeping requirements that apply.

ETECH does not automatically delete Customer Data held in the Customer Environment.

If ETECH temporarily stores Customer Data for support, troubleshooting, migration, implementation or other agreed Services, it will securely delete that data once the Services are complete, unless otherwise agreed in writing or required by law.

12. DATA SECURITY

ETECH uses administrative, technical and organisational measures intended to protect information from unauthorised access, disclosure, alteration, destruction, loss or misuse.

Depending on the service and deployment model, these measures may include:

• encryption of data in transit using industry-standard protocols;

• encryption of stored data where supported;

• role-based access controls;

• authentication and authorisation controls;

• secure management of passwords;

• security logging and monitoring;

• vulnerability management;

• secure software development practices;

• infrastructure monitoring, where applicable;

• controlled administrative access;

• backup and recovery controls; and

• confidentiality obligations for personnel.

ETECH may enhance or change these measures from time to time in response to changing security risks, technology, product features and operational needs.

No system, or method of transmitting or storing data electronically, can be guaranteed to be fully secure.

13. CONFIDENTIALITY

ETECH requires its employees, contractors and authorised service providers who have access to Customer Data to be bound by suitable confidentiality obligations.

Access to Customer Data is restricted to personnel who need it to provide the Services or to carry out authorised business or operational functions.

14. SUBPROCESSORS AND THIRD-PARTY SERVICE PROVIDERS

ETECH may use trusted third-party service providers and Subprocessors where reasonably needed to deliver MR Reporting and related Services.

These providers may help with:

• cloud hosting;

• infrastructure;

• storage;

• communications;

• customer support;

• payment processing;

• analytics;

• security;

• monitoring;

• email delivery; and

• other operational functions.

ETECH will take reasonable care when choosing these providers and will require suitable confidentiality and security obligations where applicable.

ETECH remains responsible for its Subprocessors to the extent required by applicable law and the applicable Customer agreement.

On reasonable written request, ETECH may share information about the categories of Subprocessors it uses to deliver the relevant Services.

15. SECURITY INCIDENTS

ETECH has procedures for identifying, investigating, responding to and managing Security Incidents.

If ETECH becomes aware of a confirmed Security Incident affecting Customer Data within its control, it will, subject to applicable law and the applicable Customer agreement:

• inform the affected Customer without undue delay;

• investigate the Security Incident;

• make commercially reasonable efforts to contain it and reduce its impact;

• take suitable corrective action; and

• give reasonable updates as more information becomes available.

For On-Premise deployments, ETECH is not responsible for Security Incidents that arise solely within the Customer Environment.

Notifying a Security Incident does not amount to an admission of liability.

16. INTERNATIONAL DATA TRANSFERS

Information may be transferred between geographic regions where reasonably needed for:

• delivering the service;

• system reliability;

• technical support;

• running infrastructure;

• business continuity;

• disaster recovery; or

• other legitimate business purposes.

Where Customer Data is transferred across national borders, ETECH and the Customer will each comply with the laws that govern such transfers.

Where the law requires it, suitable safeguards will be put in place for these transfers.

17. CUSTOMER AND DATA SUBJECT RIGHTS

Subject to applicable law and the applicable agreement, Customers may:

• ask for reasonable information about ETECH’s security practices;

• ask for help in relation to Security Incidents;

• ask for reasonable help with lawful data subject requests;

• export available Customer Data from SaaS deployments; and

• access Customer Data held within the Customer Environment for On-Premise deployments.

Where ETECH processes Personal Data for a Customer, individuals should usually send requests about Customer-controlled Personal Data to the relevant Customer or organisation.

ETECH may give Customers reasonable help in responding to lawful requests, subject to applicable law, confidentiality, security considerations and the applicable agreement.

Help that goes beyond standard support may be provided as Professional Services.

18. COOKIES AND WEBSITE TECHNOLOGIES

The MR Reporting website may use cookies, pixels, tags, analytics tools and similar technologies to:

• run the website;

• remember your preferences;

• understand how the website is used;

• measure performance;

• improve the user experience;

• assess how effective our marketing is; and

• keep the website secure.

Third-party services on our website may also use cookies or similar technologies under their own privacy policies.

Where the law requires it, suitable cookie controls or consent mechanisms will be provided.

19. SALES, MARKETING AND BUSINESS COMMUNICATIONS

If you contact ETECH, ask for a demo, start a trial, download resources, attend an event or otherwise engage with our sales or marketing activities, we may process information such as:

• name;

• business email;

• phone number;

• organisation;

• job title;

• history of communications; and

• information relevant to your business needs.

We may use this information to:

• answer enquiries;

• set up demonstrations;

• share requested information;

• manage trials;

• provide onboarding;

• tell you about our products and services; and

• carry out legitimate business development activities.

Where the law allows, we may send promotional communications.

You can opt out of promotional communications by using the unsubscribe option in the message or by contacting us.

Opting out of marketing will not stop us sending transactional, security, service or contractual messages that are needed to provide the Services you have requested.

20. PAYMENTS AND BILLING

When you buy services from ETECH, billing and payment information may be processed by ETECH and, where relevant, by third-party payment processors.

This may include:

• billing contact details;

• billing address;

• transaction details;

• invoice details;

• payment status; and

• information needed for financial administration.

Payment card details may be processed directly by third-party payment providers where relevant, and ETECH may not store them in full.

21. CHILDREN’S DATA

MR Reporting is built for business and organisational use and is not meant for children under eighteen (18) years of age.

ETECH does not knowingly collect Personal Data directly from children through its public website or services.

If a Customer uses MR Reporting to process information about individuals under eighteen (18), the Customer is responsible for making sure that processing is lawful and meets applicable requirements.

22. DATA ACCURACY

ETECH depends on Customers and users to provide accurate and up-to-date information.

Where ETECH processes Customer Data for a Customer, the Customer is responsible for that Customer Data being accurate, complete, lawful and intact.

ETECH does not independently check Customer Data unless this is expressly part of the contracted Services.

23. CUSTOMER CONFIGURATION AND USE

MR Reporting has configurable features that may let Customers decide:

• which users are monitored;

• what information is collected;

• how often monitoring takes place;

• whether screenshots and activity are collected;

• access permissions;

• retention settings, where available;

• report configurations; and

• administrator access.

The Customer is responsible for configuring and using MR Reporting appropriately and lawfully.

ETECH is not responsible for any unlawful, excessive, inappropriate or unauthorised processing that results from the Customer’s configuration, instructions or use of the platform.

24. DISCLOSURE OF INFORMATION

ETECH may share information where reasonably needed to:

• deliver the Services requested;

• meet applicable legal obligations;

• respond to lawful requests from government or regulators;

• protect the rights, property or security of ETECH, its customers, users or others;

• prevent fraud, abuse or security threats;

• enforce applicable agreements; or

• run the business through authorised service providers.

ETECH does not sell Customer Data.

ETECH does not use Customer Data for advertising.

25. BUSINESS TRANSFERS

If ETECH goes through a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, information relevant to the business may be passed to the successor or acquiring entity, subject to applicable law and suitable confidentiality and security protections.

26. RECORD RETENTION AND LEGAL REQUIREMENTS

ETECH may keep information for as long as reasonably needed to:

• deliver Services;

• keep business and financial records;

• meet legal obligations;

• resolve disputes;

• enforce agreements;

• prevent fraud;

• maintain security; or

• establish, exercise or defend legal claims.

Retention periods may differ depending on the type of information, applicable law, contractual obligations and operational needs.

27. COMPLIANCE AND CERTIFICATIONS

ETECH maintains an information security programme suited to the Services it provides.

ETECH supports compliance with applicable privacy and security laws, including the Digital Personal Data Protection Act, 2023 (India), to the extent relevant to ETECH’s role and obligations.

ETECH may obtain or maintain additional certifications, assessments or compliance frameworks from time to time.

Nothing in this Privacy Policy is a statement that ETECH currently holds any particular certification or compliance status, unless this is expressly confirmed in writing.

The Customer remains responsible for identifying the regulatory and legal requirements that apply to its own processing and use of MR Reporting.

28. SECURITY AND PRIVACY DUE DILIGENCE

Customers may ask for reasonable information about ETECH’s privacy and security practices for genuine vendor due diligence.

Subject to confidentiality and security considerations, ETECH may provide:

• security questionnaires;

• summaries of policies;

• compliance documentation;

• available certifications;

• audit reports cleared for sharing with customers; and

• other reasonable security information.

ETECH is not required to disclose:

• source code;

• confidential security configurations;

• information about other customers;

• information that could reasonably put the security of the Services at risk; or

• any other confidential information that ETECH is not allowed to disclose.

Additional audit, assessment or security support may be provided as Professional Services.

29. CUSTOMER RESPONSIBILITIES

Customers are responsible for:

• making sure MR Reporting is used lawfully;

• deciding the lawful basis for their processing;

• configuring system settings appropriately;

• telling employees and users about the relevant data collection and processing;

• securing any required permissions, approvals or consents;

• managing user access permissions;

• maintaining suitable endpoint security;

• maintaining their own infrastructure for On-Premise deployments;

• keeping suitable backups where relevant;

• complying with applicable laws; and

• making sure Customer Data submitted to MR Reporting can lawfully be processed.

ETECH is not responsible for unlawful configuration, misuse, unauthorised monitoring or unlawful processing by a Customer or its users.

30. THIRD-PARTY WEBSITES AND SERVICES

MR Reporting may include links to third-party websites, services or applications.

ETECH does not control, and is not responsible for, the privacy practices, content, security or policies of third-party services.

Users should read the privacy policies of third-party services before sharing Personal Data with them.

31. CHANGES TO THIS PRIVACY POLICY

ETECH may revise this Privacy Policy from time to time to reflect:

• changes in applicable law;

• changes to MR Reporting;

• changes in security practices;

• changes in business operations;

• new features or services;

• changes in third-party service providers; or

• other operational needs.

Revised versions will be published on the official MR Reporting website with an updated “Last Updated” date.

Where the law requires it, ETECH will give additional notice of, or obtain consent for, material changes.

32. CONTRACTUAL DOCUMENTS AND PRECEDENCE

This Privacy Policy gives a general overview of ETECH’s privacy practices.

Some customers, especially enterprise customers, may have further contractual documents governing their relationship with ETECH, such as an Enterprise Subscription Agreement, an Enterprise Software License & Support Agreement, an Order Form, a Data Processing & Security Addendum (DPSA), an SLA or other relevant agreements.

Where these documents apply, the specific terms of the signed agreement will govern the relevant relationship and processing activities.

If this Privacy Policy conflicts with a signed Customer agreement that applies, the signed Customer agreement will prevail to the extent of the conflict.

33. CONTACT US

For any privacy, data protection or security questions, requests or concerns, please contact:

ETECH SERVICES PRIVATE LIMITED

Email: info@mrreporting.com

Website: https://mrreporting.com

When contacting us about a Customer account or Customer Data, please give enough information for us to identify the relevant Customer organisation and request.