Privacy policy
Last updated:
How Trunish Lifescience Private Limited collects, uses, shares and protects personal data in Trunish ERP and its customer portal, and the rights you have over it under Indian law.
1. Who we are
Trunish Lifescience Private Limited ("Trunish", "we", "us") runs Trunish ERP, the business system it uses for sales, purchasing, stores, manufacturing, quality, regulatory work, accounts, HR and payroll, and the customer portal that goes with it.
For the personal data described here, Trunish is the data fiduciary under the Digital Personal Data Protection Act 2023 ("DPDP Act"), and the body corporate that collects and handles the information under the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 ("SPDI Rules").
- Legal name
- Trunish Lifescience Private Limited
- CIN
- U24100GJ2020PTC112965
- Address
- Block No-56, GF, Type-C3, At Post-Umra, Umra, Umra 394248, Gujarat
- info@trunish.com
- Phone
- 02621299100
2. Who this policy covers
This policy applies to personal data that Trunish ERP holds about:
- our staff and consultants who use the ERP, and employees whose attendance and pay it records;
- the people we deal with at customers, suppliers and transporters;
- people who use the customer portal for their company;
- visitors we expect, whose names we show on the welcome screen at reception;
- people who email our department mailboxes or message us on WhatsApp.
The ERP is a business system, not a consumer service. How we use it to run our business is also governed by our contracts with you or your employer, and, for users, by the terms of service.
3. Personal data we process
Staff and consultants
- Name, username, roles and department, work email address and mobile number.
- Your sign-in PIN, stored only as a salted one-way hash that cannot be turned back into the PIN.
- Employee records: employee code, department, designation, shift, joining and leaving dates, gender and mobile number, and the QR code on your ID card.
- Attendance: each punch in or out with its time, the kiosk it was made on and how (ID card or name and kiosk PIN), and corrections HR makes. The kiosk uses the phone's camera only to read the QR code on your ID card. It does not take, keep or send photographs. Your kiosk PIN is stored only as a one-way hash.
- Leave requests, expense claims and advances.
- Payroll: salary structure, pay, deductions and payslips; your bank name, account number and IFSC; and statutory identifiers such as your PF universal account number (UAN), ESI number and, where recorded, PAN, with the state whose professional tax applies.
- If you choose WhatsApp alerts, the number you give and your agreement to receive them.
- What you do in the ERP: the records you create, change, approve or view, in the audit trail.
Customer, supplier and transporter contacts
- Business details: company name, GSTIN, PAN, addresses and bank details for payments.
- Contact people: names, roles, email addresses and phone numbers.
- A contact's WhatsApp number and the record that they agreed to receive WhatsApp messages from us.
- Correspondence, orders, quotations, invoices, payments and other records of our dealings.
Customer portal users
- Your name, email address and the customer you act for.
- One-time sign-in codes (stored only as a hash, valid for 10 minutes and once), when you signed in, and your IP address and browser.
- What you view and download in the portal.
Visitors
When we expect visitors, staff may enter their names, with their company and the time of the visit, so the welcome screen at reception can greet them by name. We hold nothing else about visitors in the ERP.
Email to our department mailboxes
Where a department mailbox (for example sales, purchase, accounts or regulatory) is connected to the ERP, the ERP reads new messages in it: the sender, recipients, date, subject, text and attachments. It stores them with the record they concern and sends the emails our staff write.
WhatsApp messages
For contacts who agreed to receive WhatsApp messages, and staff who opted in to alerts: the phone number, the messages we send (for example an invoice number, amount and due date, or dispatch details), whether each was delivered and read, and the replies you send us.
Device and session data
The ERP sets only the cookies it needs to work. There are no advertising or analytics cookies.
- erp_session and portal_session: keep you signed in to the ERP or the customer portal. They hold a random token; the server keeps only its hash.
- erp_locale (your language), erp_nav (whether the menu is collapsed) and theme (light or dark).
- erp_display and erp_kiosk: identify a paired TV display or attendance kiosk. They are set on those devices only.
- erp_email_connect: a short-lived message shown after an administrator connects a mailbox.
The ERP records the IP address and browser of each sign-in session, the IP address of each portal sign-in code request, and the IP address of attempts to pair a kiosk or display, to keep accounts secure and to limit repeated attempts. Our hosting provider also processes IP addresses and request details to deliver and protect the service.
4. Why we use it, and on what basis
We use personal data only for these purposes:
- Running our business with you: enquiries, quotations, orders, manufacturing, quality control, dispatch, invoicing, payments and the customer portal. Where you or your company gave us the data for this, we rely on that (DPDP Act section 7, voluntarily provided data) or on your consent.
- Employment: attendance, leave, payroll, expense claims and access to the ERP, which are legitimate uses for employment purposes under section 7 of the DPDP Act.
- Meeting the law: GST invoices, e-invoices and e-way bills, accounts and audit, tax deduction, provident fund, ESI and professional tax, and the records our manufacturing licences and product approvals require.
- Security: signing you in, limiting access by role, keeping the audit trail, and preventing misuse and fraud.
- Messages you agreed to: WhatsApp messages to customer contacts and WhatsApp alerts to staff are sent only with consent, which you can withdraw at any time.
Where we rely on your consent, you can withdraw it at any time by contacting us (section 12). Withdrawing does not affect what was done before, and we may still keep data the law requires us to keep.
No decision with legal or similar effect on you is made by automated means alone. A person reviews every AI suggestion (section 6).
5. Who receives it
Inside Trunish, each person sees only what their department needs (need-to-know). For example, production staff do not see customer names, and production formulas are never shown to sales, accounts, quality, regulatory or customers.
We use these service providers, who process data on our behalf and only for the purposes below:
- Cloudflare, Inc. hosts the ERP: the application, its database and file storage, including the nightly backups. It holds all the data described in this policy, and processes IP addresses and request details to deliver and protect the service.
- Google LLC provides Gmail for our department mailboxes. Through the Gmail API the ERP sends the emails our staff write and reads new messages in the connected mailboxes. The ERP pages also load fonts and icons from Google Fonts, which receives your IP address and browser details.
- Meta Platforms (WhatsApp Business Platform) delivers WhatsApp messages. It receives the recipient's phone number and the message, and gives us delivery updates and replies.
- Anthropic PBC, only when AI suggestions on incoming email are switched on: see section 6.
- Fynamics, our GST Suvidha Provider, passes data to the Goods and Services Tax Network (GSTN) and the National Informatics Centre (NIC) to verify GSTINs and to generate e-invoices and e-way bills. It receives GSTINs, the business names and addresses on invoices, the goods, quantities and values, and transport details such as the transporter, vehicle number and distance.
We also share personal data when we must or need to:
- with government authorities, regulators and courts, where the law requires it (for example GST, income tax, PF, ESI and drug and cosmetic regulators);
- with banks, to make and receive payments, including salaries;
- with our auditors, chartered accountants and lawyers, who keep it confidential;
- with a buyer or successor of our business, under the same protections.
We do not sell personal data, we do not use it for advertising, and we do not share it with anyone for their own marketing.
6. Gmail data and AI suggestions
Gmail data
The ERP connects only to Trunish's own department mailboxes, each one connected by an administrator signed in as that mailbox. It asks Google for two permissions: to send email from the mailbox, and to read new messages, download their attachments and label them as processed. It never deletes mail and never reaches anyone's personal mailbox.
Trunish ERP's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular, we use Gmail data only to send our business emails and to file incoming emails against the records they concern, with suggestions for staff to check. We do not use it for advertising, we do not sell it, and people read it only as part of their work on those records, for security, or where the law requires. We do not use Gmail data to develop, improve or train general AI or machine-learning models.
AI suggestions on incoming email
If an administrator switches on AI reading, an email that comes from an address recorded as a contact of exactly one of our customers or suppliers is sent to Anthropic's API for processing, so the ERP can suggest an update (for example a supplier's dispatch details or a customer's payment advice). What is sent is:
- the sender's address, the customer's or supplier's name, the time received and the subject;
- the plain text of that email;
- our document numbers mentioned in it;
- up to three of its PDF attachments.
Nothing else from the ERP is sent: no other records, no prices or stock, no production formulas, and nothing from unknown senders. Under Anthropic's commercial terms, content sent through its API is processed to give the answer and is not used to train its models. The answer is only a suggestion: a member of staff checks it, can change every field, and decides whether to accept it.
7. Transfers outside India
Our cloud and messaging providers (Cloudflare, Google, Meta and Anthropic) run data centres in several countries, so personal data may be stored or processed outside India. We transfer data only as the DPDP Act allows, and not to any country the Government of India has restricted. Each provider is bound by contract to protect the data and to use it only to provide its service to us.
8. How long we keep it
- Accounting and GST records (invoices, credit notes, bills, e-invoices, e-way bills, ledgers, payments and the records behind them): at least eight years, in line with the Goods and Services Tax and Companies Act requirements, and longer where an assessment, audit, inspection or dispute needs them.
- Manufacturing, quality and regulatory records (batch records, test results, certificates of analysis, approvals and licences): for as long as the law and our licences require.
- Staff records: during employment and afterwards for as long as labour, tax and social security laws require.
- The audit trail of who viewed, changed or approved what: for as long as the records it describes. It cannot be edited.
- Emails and WhatsApp messages: for as long as the record they concern.
- Sessions and sign-in codes: sessions end when you sign out or they expire; portal sign-in codes work once, for 10 minutes.
- Backups: the whole database is backed up every night. Daily copies are kept for 90 days, and the copy from the first of each month is kept for the long term so records can be restored.
When we no longer need personal data for its purpose or by law, we delete it or remove what identifies you. A user who leaves keeps their name on the past records they made; their contact details and access are removed.
9. How we protect it
We keep reasonable security practices and procedures, as the SPDI Rules and the DPDP Act require, including:
- access by role and need-to-know, enforced on the server, so each person sees only what their work needs;
- sign-in with a personal PIN, stored only as a salted hash, with the account locked for a while after repeated wrong PINs;
- one-time email codes for the customer portal;
- an audit trail of who viewed, changed and approved what, which cannot be edited;
- encryption in transit (HTTPS) for every page, file and message;
- mailbox sign-ins stored only encrypted (AES-256-GCM), with the key kept outside the database;
- keys and passwords for outside services kept as secrets in our hosting account, never in the database or the code;
- nightly backups, checked after they are written.
No system is perfectly secure. If a personal data breach happens, we will inform the Data Protection Board of India and the people affected as the DPDP Act requires.
10. Your rights
Under the DPDP Act you have the right to:
- access: a summary of the personal data we hold about you and how we use it, and who we have shared it with;
- correction: have inaccurate or incomplete data corrected, completed or updated;
- erasure: have data erased when it is no longer needed for its purpose, unless the law requires us to keep it;
- withdraw consent where we rely on it, for example to WhatsApp messages;
- grievance redressal: have a complaint about how we handle your data answered;
- nominate someone to exercise these rights for you if you die or become unable to.
To use any of these rights, write to the grievance officer (section 12) from the email address we know you by, or tell us how to confirm who you are. We will reply within one month, or sooner where the law requires. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.
Staff can also correct their own details with HR, and portal users with their contact at Trunish.
11. Children
Trunish ERP and the customer portal are for businesses and their staff. They are not directed at children, and we do not knowingly process the personal data of anyone under 18 through them.
12. Grievance officer
Questions, requests and complaints about personal data go to our grievance officer:
- Name
- Grievance Officer
- info@trunish.com
- Address
- Trunish Lifescience Private Limited, Block No-56, GF, Type-C3, At Post-Umra, Umra, Umra 394248, Gujarat
13. Changes to this policy
We may update this policy when the ERP or the law changes. The date at the top shows when it last changed. For significant changes we will tell users in the ERP or by email before they take effect.
14. Contact us
For anything else about this policy, contact Trunish Lifescience Private Limited:
- Legal name
- Trunish Lifescience Private Limited
- CIN
- U24100GJ2020PTC112965
- Address
- Block No-56, GF, Type-C3, At Post-Umra, Umra, Umra 394248, Gujarat
- info@trunish.com
- Phone
- 02621299100