1. Regulatory Scope & Legal Roles (DPDP Act 2023)
Lezore Technologies Private Limited ("Lezore", "Company", "we", "us", or "our") operates the Lezore workforce and payroll management Software-as-a-Service platform. This Privacy Policy is formulated in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
For Contractor Account details, registered GSTIN, authorized signatory contacts, corporate billing information, and direct support communications.
For blue-collar workforce records, attendance logs, biometric/photo marks, wage tallies, and advance vouchers entered by the Contractor (who acts as the primary Data Fiduciary for their workers).
2. Categories of Information We Collect
We process the following categories of information strictly to deliver and maintain the Service:
- Enterprise & Account Credentials: Corporate name, registered business address, GSTIN, PAN, primary admin email, phone number, and encrypted password credentials.
- Site Supervisor & Staff Profiles: Supervisor full name, phone number, designated project site authorizations, and role permissions.
- Workforce & Labor Master Data: Worker name, mobile contact, trade classification (e.g. Fitter, Welder, Rigger, Mason, Helper), site assignment, join/relieve dates, wage rates, and encrypted identification/banking details where submitted for payslip generation.
- Attendance, Overtime & Financial Ledgers: Daily muster records (Present, Absent, Half-Day, OT hours), supervisor remarks, mid-month cash advance slips, deductions, and monthly salary settlement computations.
- Technical & Telemetry Data: IP address, device model, browser user agent, login timestamps, and IndexedDB local synchronization tokens used for offline PWA functionality.
3. Purpose & Lawful Basis of Processing
All data processing activities are carried out under valid contractual necessity and legitimate statutory purposes:
Calculating daily and monthly wages based on fixed 30-day divisor arithmetic and overtime multiples.
Compiling Form XIX wage registers, Form 78 muster rolls, and PDF payslips for labor audits.
Temporarily queuing attendance marks on site supervisor mobile devices until 2G/4G connectivity is restored.
Maintaining immutable audit logs for salary revisions, advance approvals, and workspace role changes.
We do not sell, rent, or trade your workforce, financial, or operational data to third-party advertisers, data aggregators, or marketing brokers.
4. Multi-Tenant Cryptographic Isolation & Security
Lezore implements a state-of-the-art multi-tenant cloud architecture engineered to guarantee absolute separation of organization data:
- Row-Level API Scoping: Every database query and transaction is cryptographically bound to your unique Organization ID with zero cross-tenant leakage.
- Role-Based Access Control (RBAC): Site supervisors can only mark daily attendance; contractor margins, global worker rates, and enterprise financials remain redacted.
- Encryption in Transit & At Rest: All web traffic is protected via Transport Layer Security (TLS 1.3) with perfect forward secrecy. Persistent databases and backups are encrypted using AES-256.
5. Indian Cloud Hosting & Data Residency
In accordance with Indian regulatory recommendations and enterprise data sovereignty standards, all primary databases, server clusters, and automated backups are hosted in secure Tier-IV data centers located within the Republic of India (AWS Asia-Pacific Mumbai Region — ap-south-1).
6. Authorized Sub-Processors & Infrastructure Partners
To deliver high-availability cloud services, Lezore engages vetted enterprise sub-processors:
| Partner / Sub-Processor | Service Provided | Data Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud Virtual Servers, Encrypted Relational Database & Object Storage | Mumbai, India |
| Razorpay / Cashfree Payments | RBI-Authorized Payment Gateway (Subscription Billing & Invoicing) | India |
| Resend / Twilio / Meta Cloud API | Transactional SMS, Security OTPs, Email & WhatsApp Notifications | Global / India |
7. Data Principal Statutory Rights (DPDPA 2023)
Under the Digital Personal Data Protection Act, 2023, Data Principals enjoy explicit statutory rights:
- Right to Summary: Obtain a transparent summary of personal data processed and processing activities.
- Right to Correction & Updating: Request correction of inaccurate or misleading personal records.
- Right to Erasure: Request the secure deletion of personal data upon cessation of contractual or statutory obligations.
- Right of Grievance Redressal: Direct escalation to our designated Grievance Officer and subsequently the Data Protection Board of India if unresolved.
- Right to Nominate: Designate an authorized representative in the event of incapacity.
8. Data Ownership, Retention & 1-Click Portability
Your organization retains 100% unconditional ownership of all worker profiles, attendance sheets, advance ledgers, and payslip archives.
Admins may generate and export a complete JSON/CSV snapshot of all workspace data at any time from Settings > Backup Hub. In the event of account closure, data is retained for 30 days to facilitate transition or export, after which all primary operational tables are permanently deleted from active clusters.
9. Prohibition of Child Labour & Minor Data
Lezore strictly prohibits the creation of accounts or workforce entries for individuals below the age of 18 years, in strict alignment with the Child and Adolescent Labour (Prohibition and Regulation) Act, 1986. We do not knowingly process personal data belonging to minors.
10. Data Protection Officer & Statutory Grievance Redressal
Pursuant to Section 8 of the DPDPA 2023 and Rule 5(9) of the Information Technology Rules, 2011, inquiries, grievance filings, or statutory notices may be addressed to our Grievance Officer: