This policy explains how personal data is handled on www.hsef.in and the shared HSEF services (sign-in, support and usage measurement when they are switched on). It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP Act). Each HSEF application may have its own notice that adds to this one.
Who is responsible
HSEF is a brand of Syetu, a sole proprietorship run by Syetu, Mumbai, India. For the purposes of the DPDP Act, Syetu is the Data Fiduciary for the data described here.
When an organisation uses an HSEF application for its own staff and contractors (for example permits, incidents or studies), that organisation decides what is recorded. It is the Data Fiduciary for that content, and HSEF processes it on its behalf.
What we collect
- Messages you send us: name, email, optional phone number, the app concerned and your message.
- Support requests: your name, email, the app and page you were on, your browser type and app version, your messages and any files you attach. If you ask for help from inside an HSEF application while signed in, the application tells us your user number there so we can find your earlier requests. Emails you send to the support address are stored the same way.
- Account details if you have an HSEF account: name, email, password (stored only as a one-way hash), sign-in times.
- Technical records: the pages requested, browser type, and your IP address with the last part removed, kept to protect the service and fix errors.
- Visit counts on every HSEF site: the page, the site that linked to it, browser, operating system and device type, and the country, state and city looked up from your IP address (the IP address itself is not stored). With your consent, also a random visitor number in a cookie — see the cookie policy.
- Cookies: only those listed in the cookie policy.
- Payments for paid applications are handled by our payment gateway (Cashfree Payments). We receive the payment status and invoice details, never your card or bank credentials.
Why we use it
- To answer your messages and provide the services you sign up for.
- To keep the services secure, prevent misuse and investigate faults.
- To meet legal, tax and accounting obligations.
- To count visits, so we know which tools and pages are used and can improve them. Page views are counted without identifying anyone; following visits from page to page and across HSEF sites happens only with your consent. You can change this choice at any time from the "Cookie choice" link on every site.
We rely on your consent, or on the legitimate uses allowed by Section 7 of the DPDP Act (for example, data you give us voluntarily for a stated purpose). We do not sell personal data or use it for advertising.
How long we keep it
- Contact messages: until handled, then archived and deleted 365 days after archiving.
- Support requests, their messages and files: until closed, then deleted 365 days after closing. The private link to a request stops working 30 days after it is closed.
- Visit counts: individual page views 90 days; daily totals (no individual visits) 760 days.
- Help-article feedback ("Was this helpful?") is stored only as a count, not linked to you.
- Copies of emails we send: 30 days.
- Error and security logs: 90 days.
- Database backups: the most recent 7 copies.
- Accounts: while the account is active, then deleted or anonymised unless the law requires us to keep records longer (for example invoices).
Who we share it with
Only service providers we need to run HSEF: our hosting provider, our email service and, for paid applications, the payment gateway. Each processes data only on our instructions. We disclose data to authorities only when the law requires it.
How we protect it
All traffic uses HTTPS. Passwords are hashed, secrets are encrypted, access to administration is limited and logged, and IP addresses are shortened before they are stored.
Your rights
Under the DPDP Act you can ask us for a summary of the personal data we hold about you, ask us to correct, complete, update or erase it, withdraw a consent you gave, and nominate another person to exercise these rights if you die or become unable to. Send requests to the grievance officer below; we may ask you to confirm your identity first. If you are not satisfied with our response, you may complain to the Data Protection Board of India.
Children
HSEF services are meant for working professionals. We do not knowingly process the personal data of anyone under 18 without verifiable consent from a parent or lawful guardian.
Grievance officer
Syetu
Email: info@syetu.com
Post: Mumbai, India
Changes to this policy
We will update the date at the top when this policy changes, and announce significant changes on this site.