1. Data Fiduciary
For the purposes of the DPDP Act, Ambadiya Enterprises acts as the Data Fiduciary in respect of personal data processed through the Platform for account administration, authentication, billing, support, security, and product improvement.
Where you upload customer, vendor, employee, or other third-party data into the Platform, you act as the Data Fiduciary for that data and we act as a Data Processor processing such data to provide ERP services to your organisation.
2. Personal data we collect
- Account & identity data: name, mobile number, email address, role, company assignment, login timestamps, and OTP verification records.
- Business & tax identifiers: GSTIN, PAN, UDYAM, legal entity name, registered address, bank details, and invoice prefixes you configure.
- Transactional & financial data: invoices, credit/debit notes, expenses, ledger entries, payment status, tax break-ups, and attachments.
- Payment data: transaction references, payment status, and amounts processed via payment gateways. We do not store full card or UPI credentials.
- Technical & usage data: IP address, browser type, device identifiers, audit logs, and security events.
- Communications: support requests, feedback, and optional AI prompts you submit.
3. Purpose of processing
- Providing and operating the ERP Platform (invoicing, GST compliance, inventory, ledgers, reports, PDF generation, multi-tenant management).
- User authentication via mobile OTP and role-based access control.
- Processing subscription and credit-top-up payments through licensed payment gateways.
- Customer support, service notifications, and product updates.
- Detecting fraud, abuse, unauthorised access, and complying with legal obligations.
We do not sell personal data. We do not use GST, PAN, invoice, or ledger data for unrelated marketing without a separate, explicit consent.
4. Data sharing
We may share personal data with:
- Infrastructure & service providers (cloud hosting, SMS/OTP, email, analytics, payment gateways) bound by confidentiality obligations.
- Professional advisers under a duty of confidentiality.
- Government or regulatory authorities when required by law, court order, or lawful request.
5. Cross-border transfers
Personal data is primarily stored and processed in India. If data is transferred outside India, we will do so only in compliance with the DPDP Act and applicable safeguards.
6. Data retention
We retain personal data for as long as your account is active and as necessary to provide services, comply with statutory retention requirements (including tax and accounting laws), resolve disputes, and enforce agreements.
7. Security practices
We implement reasonable security practices consistent with the IT Act and SPDI Rules, including access controls, encryption in transit (HTTPS/TLS), tenant isolation, authentication controls, and logging. You are responsible for safeguarding login credentials and configuring internal access within your organisation.
8. Your rights under the DPDP Act
Subject to applicable law, Data Principals may have the right to access, correct, erase, and seek grievance redressal for personal data. Requests may be sent to support@sarverp.com or 9811326416.
9. Grievance Officer
Grievance Officer
Ambadiya Enterprises
Email: support@sarverp.com
Phone: 9811326416
We aim to acknowledge grievances within 24 hours and resolve them within 15 days, or within such period as prescribed under applicable law.
10. Children
The Platform is intended for business use and is not directed at children under 18. We do not knowingly collect personal data from minors.
11. Changes to this Policy
We may update this Privacy Policy to reflect legal, technical, or operational changes. Material updates will be posted on this page. Continued use after the effective date constitutes acceptance where permitted by law.
12. Contact
For privacy questions, rights requests, or grievances, contact Ambadiya Enterprises at support@sarverp.com or 9811326416. Full KYC contact details are on our Contact Us page.