Privacy Policy

This Privacy Policy ("Policy") is issued by WEAFS ("WEAFS," the "Company," "we," "us," or "our") and governs the collection, use, processing, storage, disclosure, transfer, and protection of Personal Data obtained through weafs.com and any subdomain thereof (the "Site"), through the WEAFS Digital, WEAFS Smart, and WEAFS Sustainable platform modules and any associated applications, APIs, dashboards, or connected devices (collectively, the "Platform"), and through any related consulting, implementation, support, or professional services engagements (collectively with the Site and the Platform, the "Services").

This Policy applies to visitors, prospective customers, customers, authorized users of a customer's account, workforce data subjects whose data is processed by a customer through the Platform, job applicants, vendors, and any other natural person whose Personal Data we Process in connection with the Services (each, a "Data Subject," "you," or "your"). This Policy is provided to give you notice of how we Process Personal Data, consistent with Applicable Law, and does not by itself constitute your consent to any Processing for which Applicable Law requires consent. Where consent is required (for example, under the DPDP Act or the GDPR), we obtain it through a separate consent mechanism, such as a form checkbox, cookie banner, or explicit opt-in, at the relevant point of collection.

Section 3 explains, and this Policy applies differently depending on, whether WEAFS is acting as a data fiduciary or controller, or as a data processor or service provider, with respect to a given item of Personal Data. Where WEAFS Processes Personal Data on behalf of a customer as a data processor (for example, operational, workforce, or machine-generated data submitted to the Platform by a customer organization), this Policy is supplemented, and where inconsistent, superseded, by the Data Processing Agreement described in Section 3 and any order form or master services agreement executed between WEAFS and that customer, and Data Subjects whose Personal Data is processed in that capacity should direct privacy inquiries to the relevant customer organization in the first instance, who acts as the data fiduciary, data controller, or business under applicable law.

• "Aggregated Data" means Customer Data or other data that has been aggregated, statistically combined, and processed using de-identification techniques such that it does not identify a Data Subject and cannot reasonably be re-identified using means reasonably likely to be used, taking into account the cost, time, and technology reasonably available. Data from which only direct identifiers (such as names or account numbers) have been removed, without more, is not Aggregated Data if a Data Subject remains reasonably identifiable from the remaining data.
• "Applicable Law" means all data protection, privacy, and related laws and regulations applicable to the Processing of Personal Data under this Policy, as in force and amended from time to time, including the Digital Personal Data Protection Act, 2023 of India, together with the rules, notifications, and codes of practice issued or notified thereunder from time to time (collectively, the "DPDP Act"), the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). References in this Policy to the DPDP Act mean the Act and its implementing rules as actually notified and in force at the relevant time; where a specific obligation depends on rules not yet notified, we will implement it within the timeframe those rules prescribe once notified.
• "Customer" means a business entity that has entered into an agreement with WEAFS for access to the Platform or Services.
• "Customer Data" has the meaning given in our Terms of Service, and generally means operational, workforce, or business data, including any Personal Data contained within it, submitted to, or generated through use of, the Platform by or on behalf of a Customer.
• "Data Fiduciary" and "Data Processor" have the meanings given under the DPDP Act, and correspond respectively to "Controller" and "Processor" under the GDPR and UK GDPR, and to "Business" and "Service Provider" under the CCPA, as the context requires.
• "Data Processing Agreement" or "DPA" means WEAFS's standard data processing terms governing WEAFS's Processing of Personal Data contained within Customer Data on a Customer's behalf, as described in Section 3.
• "Personal Data" means any information relating to an identified or identifiable natural person, and includes "personal information" and "personal data" as those terms are defined under Applicable Law.
• "Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
• "Sensitive Personal Data" means any category of Personal Data that is classified as sensitive, special category, or otherwise subject to heightened protection under the Applicable Law governing the relevant Data Subject's Personal Data (which may, depending on that Applicable Law, include categories such as health data, biometric or genetic data, financial account information, precise geolocation, racial or ethnic origin, or government identifiers). The precise categories treated as Sensitive Personal Data, and the obligations attaching to them, are determined by the Applicable Law that applies to the relevant Data Subject, and not by a single universal list.
• "Subprocessor" means any third party engaged by WEAFS to Process Personal Data contained within Customer Data in order to provide the Services, as described in Section 9.

WEAFS acts in different capacities depending on the source and purpose of the Personal Data involved, and the rights and obligations that apply differ accordingly.

• Data Fiduciary / Controller: WEAFS acts as a Data Fiduciary (under the DPDP Act) or Controller (under the GDPR and UK GDPR) with respect to Personal Data that WEAFS collects for its own purposes, independent of any specific customer's instructions — for example, Personal Data of Site visitors, prospective customers, newsletter subscribers, job applicants, vendors, and WEAFS's own personnel. Sections 4 through 8, 10, and 11 of this Policy primarily describe WEAFS's practices in this capacity.
• Data Processor: WEAFS acts as a Data Processor (under the DPDP Act) or Processor (under the GDPR and UK GDPR) with respect to Personal Data contained within Customer Data that a Customer or its Authorized Users submit to the Platform, which WEAFS Processes solely on that Customer's documented instructions (as set out in the Terms of Service and the applicable order form) to provide the Services. In that capacity, the Customer is the Data Fiduciary, Controller, or business responsible for establishing its own lawful basis for Processing, for providing notices to and obtaining consents from the relevant Data Subjects (including its employees, contractors, and other workforce members whose data it submits to the Platform), and for responding to Data Subject requests concerning that Customer Data, except to the extent the DPA provides otherwise.

WEAFS's standard Data Processing Agreement, reflecting applicable processor obligations under the DPDP Act, the GDPR, and comparable Applicable Law, is available to Customers on request and, upon execution or acceptance by the parties, is incorporated by reference into, and forms part of, the Terms of Service and this Policy, governing in the event of any conflict as to the Processing of Personal Data within Customer Data.

We collect Personal Data through multiple channels and by multiple means, which may include direct submission, automated collection, derivation, and receipt from third parties, as further described below. Not every category below applies to every Data Subject, and the specific data collected depends on the nature of your interaction with the Services.

• Identity and contact data: full name, business email address, phone number, job title, company name, and mailing address, submitted through contact forms, demo requests, consultation bookings, newsletter subscriptions, or account registration.
• Account and authentication data: usernames, hashed credentials, authentication tokens, role and permission assignments, and account activity logs.
• Commercial and transactional data: billing details, invoicing history, purchase orders, and communications relating to quotes, proposals, and contracts, excluding full payment card numbers, which are processed exclusively by our third-party payment processors and are never stored on our systems in unencrypted or complete form.
• Operational, machine, and workforce data submitted by Customers to the Platform as Customer Data, in our capacity as Data Processor, including production data, inventory data, PLC and IoT sensor telemetry, maintenance logs, and workforce scheduling, attendance, or performance data, which may incidentally contain Personal Data of a Customer's employees, contractors, or supply chain partners. Machine and sensor telemetry is typically not, by itself, linked to an identifiable individual; where a Customer configures the Platform to associate such telemetry with an identifiable operator, shift, or employee record, that associated data is treated as Personal Data and Processed under the same Data Processor terms described in Section 3.
• Technical and device data: IP address, browser type and version, device identifiers, operating system, referring and exit pages, and approximate geolocation derived from IP address.
• Usage data collected through the Platform itself (such as pages viewed, session duration, and feature usage within an authenticated account) and, where described in Section 7, through cookies and similar technologies on the Site.
• Recruitment data: resumes, cover letters, work history, references, and interview notes submitted through the Careers section of the Site.
• Correspondence data: the content of any communication you send to us by email, chat, or web form, including any Personal Data voluntarily included in that correspondence.
• Publicly available or third-party sourced data: information obtained from professional networking platforms, business databases, data enrichment vendors, and publicly accessible sources, used for legitimate business development purposes and obtained in accordance with the applicable source's own terms and Applicable Law.

We do not intentionally solicit Sensitive Personal Data through the Site, and you should not submit Sensitive Personal Data to us through general contact or inquiry forms except where a specific form requests it and states the purpose of collection. The Terms of Service separately prohibit a Customer from submitting Sensitive Personal Data as part of Customer Data unless expressly permitted under an executed Order Form or DPA, precisely because the Platform is not designed by default to apply the heightened controls that such data may require.

We Process Personal Data for the purposes described below. Because the GDPR/UK GDPR and the DPDP Act use different, non-interchangeable legal grounds for Processing, we identify each separately below rather than presenting a single blended basis. Where the GDPR, UK GDPR, or a similar adequacy-based framework applies to a Data Subject, the first parenthetical identifies the corresponding basis under that framework (for example, consent, performance of a contract, legitimate interests, or legal obligation). Where the DPDP Act applies to a Data Principal, the second parenthetical identifies the applicable ground under that Act, which is either that Data Principal's consent or, where applicable, one of the specified "legitimate uses" enumerated in Section 7 of the DPDP Act; "legitimate interests" under the GDPR is a distinct concept from a DPDP Act "legitimate use" and is not, by itself, a valid basis for Processing under the DPDP Act.

• To provide, operate, maintain, and support the Platform and Services, including provisioning accounts, processing transactions, and delivering requested consultations or demonstrations (GDPR/UK GDPR: performance of a contract; legitimate interests) (DPDP Act: your consent, or, where applicable, your voluntary provision of Personal Data for this specified purpose as a legitimate use under Section 7).
• To communicate with you regarding inquiries, support requests, service notifications, security alerts, and administrative matters (GDPR/UK GDPR: performance of a contract; legitimate interests; legal obligation, where applicable) (DPDP Act: your consent, your voluntary provision of Personal Data for this specified purpose, or compliance with a legal obligation).
• To send marketing, product update, and promotional communications, where you have opted in or where such communications are otherwise permitted under Applicable Law, and to allow you to opt out at any time (GDPR/UK GDPR: consent; legitimate interests) (DPDP Act: your consent).
• To personalize, evaluate, and improve the Site and Platform, including through product analytics, usability testing, and Aggregated Data as described below (GDPR/UK GDPR: legitimate interests) (DPDP Act: your voluntary provision of Personal Data for this specified purpose, or, for Aggregated Data, no basis is required because it is no longer Personal Data).
• To detect, investigate, and prevent fraud, security incidents, unauthorized access, and violations of our Acceptable Use Policy or applicable Terms of Service (GDPR/UK GDPR: legitimate interests; legal obligation) (DPDP Act: a legitimate use recognized under Section 7, or compliance with a legal obligation).
• To comply with legal, regulatory, tax, accounting, and audit obligations, and to respond to lawful requests from courts, regulators, and government authorities (GDPR/UK GDPR: legal obligation) (DPDP Act: compliance with a legal obligation, or a legitimate use recognized under Section 7).
• To establish, exercise, or defend legal claims, and to enforce our contractual rights (GDPR/UK GDPR: legitimate interests) (DPDP Act: your consent, or a legitimate use recognized under Section 7).
• To evaluate employment or engagement applications submitted through the Careers section (GDPR/UK GDPR: performance of a contract; legitimate interests; consent, where required) (DPDP Act: your consent, or, where applicable, a legitimate use relating to employment recognized under Section 7).
• To carry out corporate transactions, including any actual or prospective merger, acquisition, financing, reorganization, or sale of assets, in which Personal Data may be reviewed or transferred as part of the transaction (GDPR/UK GDPR: legitimate interests) (DPDP Act: your consent, or, where applicable, a legitimate use recognized under Section 7).
• For any other purpose disclosed to you at the point of collection, or to which you otherwise consent.

Where we send marketing communications by email, SMS, WhatsApp, or similar channels, we do so in accordance with the electronic marketing and telecommunication rules applicable in your jurisdiction (such as India's rules on commercial communications, the EU/UK ePrivacy rules, and equivalent anti-spam laws elsewhere), and provide an unsubscribe or opt-out mechanism in each such communication.

Use of Customer Data for AI/ML training. WEAFS does not use Customer Data in an identifiable form, including any identifiable Personal Data contained within it, to train artificial intelligence or machine learning models that are made generally available to other customers or third parties, and does not disclose Customer Data in identifiable form to a third party for that purpose, without the relevant Customer's prior written consent. WEAFS may create Aggregated Data from Customer Data and use that Aggregated Data, which by definition no longer identifies any Data Subject, for product improvement, internal and customer-facing analytics, developing and improving WEAFS's own artificial intelligence and machine learning features, and industry benchmarking (legitimate interests, applied only to data that is no longer Personal Data once aggregated and de-identified). This paragraph, and WEAFS's use of Aggregated Data generally, does not authorize, and must not be read to authorize, the use of identifiable Customer Data or identifiable Personal Data for any purpose beyond providing the Services, except as separately agreed with the relevant Customer.

We do not sell Personal Data to third parties in exchange for monetary consideration. We do not currently share Personal Data with third parties for cross-context behavioral advertising. If this changes, we will update this Policy and provide the opt-out rights and mechanism required under the CCPA or other Applicable Law before doing so.

Certain features of the Platform use artificial intelligence, machine learning, or other automated analysis of operational, machine, and workforce data submitted by a Customer, including predictive maintenance alerts, anomaly detection, forecasting, and similar analytical outputs ("AI Output"). These features are used to support Customer's own operational and business decisions; WEAFS does not use them to make decisions about individual Data Subjects on a Customer's behalf.

AI Output is generated by automated means, is provided for decision-support purposes only, and is designed to be reviewed by a Customer's own qualified personnel before being relied or acted upon; it is not intended to, and does not, produce legal or similarly significant effects concerning an individual Data Subject without human review by the Customer. Customer, as the party operating and configuring the Platform in respect of its own workforce and operations, is responsible for how it uses, reviews, and acts on AI Output, and for ensuring appropriate human review before any decision affecting an individual is made in reliance on it, consistent with the disclaimers in the Terms of Service. Where a specific feature does involve solely automated decision-making producing legal or similarly significant effects on a Data Subject, we will provide the additional information and safeguards required by Applicable Law.

Machine, production, and PLC telemetry submitted to the Platform is generally equipment-level data and does not itself identify a natural person. Where a Customer links that telemetry to an identifiable operator, shift record, or employee (for example, workforce scheduling or performance data associated with machine output), WEAFS Processes the resulting Personal Data solely as a Data Processor on that Customer's instructions, as described in Section 3, and the Customer, as the employer and Data Fiduciary or Controller for its own workforce, is responsible for providing any notice to, and obtaining any consent from, its employees or contractors required under Applicable Law before submitting their Personal Data to the Platform.

Certain features of the Platform rely on third-party cloud infrastructure and third-party artificial intelligence or machine learning model providers to Process Customer Data and generate AI Output. Those third parties act as Subprocessors under Section 9, are bound by data protection obligations materially consistent with this Policy and the DPA, and Process such data solely to provide the relevant feature, not for their own independent purposes. Where commercially and technically available from a given AI Subprocessor, WEAFS configures or contracts for that Subprocessor not to retain Customer Data beyond what is necessary to provide the feature and not to use Customer Data to train that Subprocessor's own general-purpose models. Customers may request, as described in Section 9, specific information about a given AI Subprocessor's identity, processing location, data retention practices, and whether it trains on submitted data.

The Site currently uses only cookies and similar local storage mechanisms that are strictly necessary for the Site to function, such as maintaining basic session state and security. As of the Effective Date of this Policy, the Site does not deploy analytics cookies, advertising or marketing cookies, or other non-essential tracking technologies, and does not use a cookie consent banner because no consent-requiring technology is currently active.

If WEAFS begins using analytics, advertising, or other non-essential Tracking Technologies on the Site, we will update this Policy to describe the categories used, the purposes for which they are used, and how to exercise any applicable choices, and, where required by Applicable Law, we will implement and present an appropriate consent or preference mechanism before activating those technologies. We do not currently respond to browser-based "Do Not Track" signals, as no uniform industry standard for such signals has been adopted and no discretionary tracking is currently active for such signals to affect.

Authenticated areas of the Platform (as distinct from the public Site) may use functional cookies or local storage necessary for login sessions and application state; these are strictly necessary to deliver the Services to Authorized Users and are addressed, where applicable, in the Terms of Service and any DPA rather than through a public cookie-consent mechanism.

We disclose Personal Data only as reasonably necessary for the purposes described in this Policy, and to the categories of recipients described below, each of which is bound by contractual, statutory, or equivalent obligations of confidentiality and data protection appropriate to the sensitivity of the data disclosed.

• Subprocessors and service providers, including cloud hosting providers, communications and email delivery platforms, customer relationship management systems, payment processors, analytics providers, and third-party AI model providers, described further in Section 9, who Process Personal Data solely on our instructions and for the purposes for which it was disclosed.
• Affiliates and related entities within the WEAFS corporate group, for internal administrative, operational, and reporting purposes consistent with this Policy.
• Customers and their Authorized Users, where the Personal Data of one individual is visible to another as an inherent function of the Platform (for example, workforce records visible to an administrator of a Customer's account).
• Professional advisors, including legal counsel, auditors, and insurers, where necessary to obtain advice or manage risk.
• Government authorities, regulators, courts, and law enforcement agencies, where disclosure is required by law, legal process, or a valid governmental request, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• A successor entity in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or substantially all of our assets, subject to standard confidentiality arrangements.
• Any other third party where you have provided explicit consent to the disclosure.

WEAFS engages Subprocessors, including cloud hosting and infrastructure providers, storage providers, communication and notification platforms, analytics providers, and third-party AI model providers, to Process Personal Data within Customer Data in order to provide the Services. Each Subprocessor is bound by data protection obligations materially consistent with this Policy and, where applicable, the DPA.

A current list of Subprocessors that materially Process Customer Data, including the identity, processing location, and function of each, is available to Customers on written request to the contact in Section 23; WEAFS aims to respond to such a request within 10 business days. This is additionally addressed in the Terms of Service and, where executed, the DPA, including the notice period WEAFS provides before engaging a new material Subprocessor and the process for a Customer to raise an objection.

WEAFS is headquartered in India, and our primary infrastructure and personnel are located in India. For Customers and Data Subjects located in India, Personal Data is generally hosted and Processed on infrastructure located in India, except to the extent a Subprocessor's infrastructure, a Customer's own configuration (for example, a selected cloud region), or a specific feature (such as a third-party AI model provider) requires Processing outside India, in which case the safeguards described below apply.

Where we transfer Personal Data originating in the European Economic Area, the United Kingdom, or Switzerland to India or another jurisdiction not recognized as providing an adequate level of protection, we execute appropriate safeguards recognized under Applicable Law with the relevant recipient before the transfer, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum. Where we transfer Personal Data of Data Principals located in India to a jurisdiction outside India, we do so in a manner consistent with the DPDP Act and any notification issued by the Central Government restricting such transfers. The specific recipients, processing locations, and transfer mechanism applicable to a given Customer's Customer Data depend on that Customer's Order Form and the Subprocessors used to deliver the relevant feature; a Customer may request current details, and copies of the relevant transfer mechanism, using the procedure in Section 9. By using the Services, you acknowledge such cross-border Processing to the extent it occurs.

We retain Personal Data only for as long as reasonably necessary to fulfil the purposes for which it was collected. The periods below are the target retention periods we apply to production systems as part of our data lifecycle management practices; actual deletion occurs in the ordinary course of our scheduled data lifecycle and backup processes described below, and may vary based on the nature of a specific request, dispute, or legal obligation.

• Marketing, contact-form, and demo-request data: up to 24 months from your last interaction with us, if it does not result in a customer relationship, after which it is deleted or anonymized unless you have separately opted in to continued marketing contact.
• Account and authentication data for Customers and Authorized Users: for the duration of the applicable subscription term, plus up to 90 days following termination or expiration to permit data export and account wind-down, as described in the Terms of Service, after which it is deleted unless a longer period is required by Applicable Law.
• Operational, machine, and workforce Customer Data: in accordance with the retention schedule agreed with the relevant Customer in an Order Form or DPA, or, absent such agreement, for the duration of the applicable subscription term plus the export and deletion windows described in the Terms of Service.
• Billing, invoicing, and financial records: generally retained for up to eight years to meet statutory recordkeeping obligations under applicable Indian tax, accounting, and corporate law, or such other period as Applicable Law requires.
• Recruitment data: up to 12 months after the relevant recruitment process concludes, unless you consent to longer retention for consideration for future openings.
• Technical, security, and access logs: up to 12 months for security monitoring and audit purposes, or longer where relevant to an ongoing investigation, dispute, or legal claim.

Where a specific retention period above is superseded by a longer period required by Applicable Law (for example, limitation periods for legal claims, or statutory audit requirements), we retain the data for that longer period. When data is deleted from production systems, corresponding copies held in encrypted backups, disaster-recovery replicas, and archived logs are not deleted instantaneously; they are overwritten or expire in the ordinary course of our backup rotation and log-retention cycle, generally within 90 days of deletion from production systems, and are not separately accessed or used before that cycle completes.

We implement and maintain administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, and destruction, calibrated to the sensitivity of the data involved. These safeguards include, among others, encryption of data in transit, role-based access controls, logical segregation of each Customer's Customer Data from that of other customers on shared infrastructure, network segmentation, logging and monitoring, and periodic internal security review. This Section describes our security program and is not a warranty that any specific safeguard is, or will remain, effective against every possible threat.

Our security practices are informed by widely recognized frameworks, including practices commonly associated with ISO/IEC 27001. WEAFS is not currently certified under ISO/IEC 27001 or any other third-party security certification or attestation scheme, and no statement in this Policy or elsewhere on the Site should be read as a representation that WEAFS holds such a certification unless expressly stated otherwise in writing.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security of Personal Data. Section 13 describes how we respond to a Personal Data breach.

Where WEAFS is acting as a Data Processor and confirms a Personal Data breach affecting Customer Data, WEAFS will notify the affected Customer without undue delay, and in any event within the timeframe required under Applicable Law or the DPA, together with the information reasonably available to WEAFS regarding the nature of the breach, the categories and approximate volume of data affected, and the remediation steps taken or planned. As between WEAFS and the Customer, and except where the DPA or Applicable Law provides otherwise, the Customer, as Data Fiduciary or Controller, is responsible for assessing whether the breach triggers a notification obligation to any supervisory authority, regulator, Data Subject, or Data Principal, and for making any such notification.

Where WEAFS is acting as a Data Fiduciary or Controller (for example, with respect to Personal Data of Site visitors, marketing contacts, job applicants, vendors, or WEAFS's own personnel), WEAFS will assess any Personal Data breach affecting that data and, where required by Applicable Law, notify the affected Data Subjects and the competent supervisory authority (which, under the DPDP Act, is the Data Protection Board of India) within the timeframe prescribed by Applicable Law.

Subject to the conditions, exceptions, and verification requirements set out in Applicable Law, you may have the right to: (a) obtain confirmation of, and access to, the Personal Data we hold about you; (b) request correction of inaccurate or incomplete Personal Data; (c) request erasure of Personal Data no longer necessary for the purposes for which it was collected; (d) request restriction of, or object to, certain Processing; (e) request portability of Personal Data you provided to us in a structured, commonly used format; (f) withdraw consent at any time where Processing is based on consent, without affecting the lawfulness of Processing before withdrawal; (g) lodge a complaint with a competent supervisory authority; and (h) not be subject to a decision based solely on automated Processing that produces legal or similarly significant effects concerning you, subject to the exceptions in Section 6.

These rights apply to Personal Data for which WEAFS acts as Data Fiduciary or Controller. If your Personal Data was submitted to the Platform by your employer or another organization as Customer Data, WEAFS Processes it as a Data Processor on that organization's instructions, and you should direct your request to that organization in the first instance, consistent with Section 3; WEAFS will provide reasonable assistance to that organization in responding to your request as required by the DPA.

To exercise any of the rights described in Section 14, submit a request to info@weafs.com, describing the right you wish to exercise and providing sufficient information for us to locate your Personal Data and verify your identity. We will only request the minimum identity information reasonably necessary to verify you are the Data Subject (or their authorized representative or nominee) before acting on a request, and will not require you to create an account or provide identity documents beyond what is proportionate to the request. We may decline a request, in whole or in part, to the extent permitted or required by Applicable Law, including where the request is manifestly unfounded, excessive, or would adversely affect the rights of another person.

We aim to acknowledge a verified request within 5 business days and to substantively respond within 30 days of verification, or such shorter period as required by Applicable Law (for example, the timeframe prescribed under the DPDP Act or, for California residents, the 45-day period under the CCPA, subject to any permitted extension). Where a request is complex or We reasonably require additional time, we will notify you of the extension and the reason for it within the initial response period.

In accordance with the DPDP Act, the Information Technology Act, 2000, and other Applicable Law requiring the designation of a point of contact for data protection matters, WEAFS has designated a Grievance Officer for data protection matters, reachable at info@weafs.com or by post at: Grievance Officer, WEAFS, No. 9, Chokkammal Nagar, Sathankuppam, Kelambakkam, Thirupporur, Chengalpattu District, Tamil Nadu – 603110, India. Any Data Principal with a grievance regarding the Processing of their Personal Data by WEAFS acting as Data Fiduciary may submit that grievance in writing to this contact.

We will acknowledge a grievance within 5 business days and endeavor to resolve it within the timeframe prescribed by Applicable Law, and in any event within 30 days from the date of receipt. If you are not satisfied with our response, you may escalate your grievance to the Data Protection Board of India or another competent supervisory authority, as applicable.

The Services are directed at businesses and are not directed at, or intended for use by, individuals under the age of 18, or the age of legal majority or digital consent in the relevant jurisdiction, whichever is higher. We do not knowingly collect Personal Data from children directly through the Site. If we become aware that we have inadvertently collected such Personal Data without appropriate parental, guardian, or lawful-guardian consent, we will take reasonable steps to delete it promptly. If you believe a child has provided us with Personal Data, contact us using the details in Section 23. Where a Customer submits Personal Data of a child as part of Customer Data (for example, as part of workforce or beneficiary records), the Terms of Service place responsibility on that Customer for ensuring such submission complies with Applicable Law, including any required verifiable parental or guardian consent.

The Site and Platform may contain links to, or integrations with, third-party websites, applications, and services not owned or controlled by WEAFS, including a Customer's existing ERP, PLC, or sensor systems integrated with the Platform, and third-party cloud infrastructure or AI model providers described in Sections 6 and 9. This Policy does not apply to, and we are not responsible for, the privacy practices of any third party acting independently of WEAFS. We encourage you to review the privacy policy of any third-party site or service before providing Personal Data to it.

This Section applies only to the extent the CCPA applies to WEAFS's Processing of your personal information. If you are a California resident and the CCPA applies, it provides you with specific rights, including the right to know the categories and specific pieces of personal information we have collected about you, the right to request deletion of personal information, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising any of these rights. We have not sold personal information for monetary consideration in the preceding twelve months, and, as described in Section 7, we do not currently share personal information for cross-context behavioral advertising. You may submit a request to exercise these rights, or ask a question about this Section, using the procedure in Section 15.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the rights described in Section 14 apply to you as set out in the GDPR, the UK GDPR, and equivalent Swiss law, and you have the right to lodge a complaint with your local data protection supervisory authority, without prejudice to any other administrative or judicial remedy. You may submit a request to exercise these rights using the procedure in Section 15.

For Personal Data of Data Principals located in India, WEAFS acts as a "Data Fiduciary" as defined under the DPDP Act with respect to Personal Data collected directly through the Site for our own purposes, and as a "Data Processor" with respect to Personal Data submitted by a Customer to the Platform for Processing on that Customer's behalf and instructions, as described in Section 3. Where we act as Data Fiduciary, you may exercise the rights of access, correction, erasure, grievance redressal, and nomination available under the DPDP Act using the procedure in Section 15 and the grievance process in Section 16.

We may update this Policy from time to time to reflect changes in our practices, the Services, or Applicable Law. The "Effective Date" at the top of this Policy indicates when it was last revised. Where a change is material, we will provide additional notice as required by Applicable Law, which may include posting a notice on the Site or sending an email notification. Your continued use of the Services after a revised Policy takes effect constitutes acceptance of the revised Policy to the extent permitted by Applicable Law.

Questions, requests, and grievances regarding this Policy or our data practices may be directed to info@weafs.com, or to the general contact details published in the footer of the Site and on our Contact page. We will make reasonable efforts to respond within the timeframes described in Sections 15 and 16.