Comify Solutions Private Limited
Last updated:
This Privacy Policy explains how Comify Solutions Private Limited (“Comify”, “we”, “us” or “our”) collects, uses, stores, protects and shares personal data when you visit our website, create or use a business account, contact us, use the Comify Capture Chrome extension, or otherwise interact with our sales, support, marketing or event activities (collectively, the “Services”). It also explains the choices and rights available to you under applicable law.
This Policy should be read together with any specific privacy notice presented at the point of collection, our Terms of Use, applicable customer agreements and any Cookie Notice made available for the relevant Service.
This Policy has been prepared having regard to the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”), to the extent currently applicable, and the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), as and when their relevant provisions become applicable.
Comify provides a business-to-business customer engagement and software platform. The role in which Comify processes personal data depends on the relevant processing activity.
Where Comify determines the purpose and means of processing personal data relating to website visitors, prospective customers, customer representatives, authorised platform users or other persons interacting directly with Comify, Comify acts as the Data Fiduciary (or the entity responsible for such processing under applicable law).
Where a business customer uses the Services to process personal data relating to its own customers, prospects, employees or other individuals (“Customer Data”), the business customer ordinarily determines the purpose and means of processing and Comify processes such Customer Data on the customer's documented instructions, the applicable customer agreement and applicable law. In such circumstances, Comify ordinarily acts as a Data Processor.
Individuals whose personal data forms part of Customer Data should ordinarily direct privacy requests to the relevant business customer. Comify will provide reasonable assistance to that customer in accordance with the applicable agreement and law.
We collect personal data reasonably necessary for the relevant specified purpose. Depending on how you interact with the Services, this may include:
To the extent the SPDI Rules apply, certain information, including passwords or authentication credentials and financial information, may constitute sensitive personal data or information. Comify collects or processes such information only where necessary for a permitted purpose and subject to the consent, notice, security and other requirements applicable to such information. Comify does not ordinarily seek health, biometric, sexual-orientation or other sensitive information through its website or routine B2B onboarding unless specifically required for a lawful and specified purpose.
A business customer may upload, transmit, integrate or otherwise make Customer Data available through the Services. The categories of Customer Data are determined by that customer and may include names, email addresses, mobile numbers, communication content, engagement information and other personal data required for the workflows configured by the customer. Comify does not independently determine the customer's purpose for processing such Customer Data and processes it only to provide the contracted Services, maintain security, comply with documented instructions and meet applicable legal obligations.
When you access or use the website or platform, we may automatically receive information such as IP address, browser and device type, operating system, language, approximate location derived from IP address, referring URL, access time, pages or features used, error and diagnostic data, login and security events, and cookie or similar identifiers. We use this information to operate and secure the Services, prevent misuse, diagnose problems, measure performance and understand usage where permitted by law.
We may obtain personal data directly from you; from the business customer that creates or administers your account or supplies Customer Data; from integrations and communication channels configured by an authorised customer; from service providers supporting authentication, hosting, support, analytics, billing or communications; automatically through the website, platform, cookies and logs; and from public business sources or referrals where collection and use are lawful and reasonably expected for the relevant business purpose.
If you provide another individual's personal data to us, you must be authorised to do so and must ensure that any notice, consent or other requirement under applicable law has been satisfied.
Depending on the interaction, Comify may process personal data to:
Comify processes personal data for lawful and specified purposes. Where currently applicable law requires consent, including for collection or processing of sensitive personal data or information under the SPDI Rules, Comify will obtain and manage such consent in the manner required by law.
Once the relevant substantive provisions of the DPDP Act and DPDP Rules become applicable, Comify will, where it acts as Data Fiduciary, process personal data for a lawful purpose on the basis of consent or a legitimate use permitted under the DPDP Act. Where personal data has been voluntarily provided for a specified purpose, Comify may process such data for that purpose to the extent permitted by the DPDP Act, including where the Data Principal has not indicated that she does not consent to such use.
Where Comify acts as a Data Processor for Customer Data, the relevant business customer is responsible for establishing the lawful basis or condition for processing, providing required notices, obtaining required consent and responding to Data Principal requests. Comify will support the customer in accordance with the applicable agreement and law.
Comify maintains reasonable technical and organisational safeguards appropriate to the nature and risk of the processing and applicable legal requirements. Depending on the relevant system and processing activity, these safeguards may include encryption or other protection of data in transit and at rest, role-based and least-privilege access controls, authentication controls, logging and monitoring, vulnerability and change-management measures, backups and business-continuity measures, workforce confidentiality and security awareness, vendor due diligence and contractual security obligations.
No method of transmission or storage is completely secure. Accordingly, while Comify takes reasonable measures to protect personal data, absolute security cannot be guaranteed.
If Comify becomes aware of a personal data breach, it will take reasonable steps to contain, investigate and remediate the incident. Where Comify acts as Data Fiduciary, it will provide notices to affected individuals and competent authorities, including the Data Protection Board of India once the relevant DPDP provisions are applicable, in the manner and within the timelines required by applicable law.
Where Comify processes affected Customer Data solely as a Data Processor, Comify will notify and assist the relevant business customer in accordance with the applicable customer agreement and legal requirements, so that the customer may assess and discharge its own notification and response obligations.
Personal data may be processed or stored in India and, depending on the service provider, integration, customer configuration or nature of the Service, in other jurisdictions. Any cross-border processing or transfer will be undertaken subject to applicable Indian law, including any restriction or requirement notified by the Central Government under the DPDP Act and DPDP Rules once applicable, and subject to appropriate contractual and security measures.
A business customer's agreement or configuration may impose additional data-location or transfer requirements for Customer Data, which Comify will follow as agreed. Personal data processed in another jurisdiction may also be subject to lawful access requirements applicable in that jurisdiction.
We retain personal data only for so long as reasonably necessary to serve the specified purpose for which it is processed and for such additional period as may be required to comply with applicable law, maintain necessary business and security records, resolve disputes or enforce agreements.
When retention is no longer necessary, we erase, de-identify or anonymise personal data using reasonable measures, subject to applicable legal and technical constraints. Data in backups may remain for a limited backup cycle and will remain protected until overwritten or securely deleted.
The Services are designed for businesses and authorised adult users and are not directed to individuals under 18 years of age. Comify does not knowingly solicit personal data directly from children for its own purposes. Where Comify learns that it has collected a child's personal data in circumstances that are not permitted by applicable law, it will take reasonable steps to delete or otherwise appropriately address that data.
A business customer may use the Services in a context involving Customer Data relating to a child. In such circumstances, the customer is responsible for determining whether the processing is permitted and for obtaining any parental or guardian consent or authorisation required by applicable law. Comify processes such Customer Data on the customer's documented instructions and may require appropriate assurances or safeguards.
Depending on the nature of the personal data and the law applicable to the processing, you may request review, correction or updating of information provided by you, withdraw consent where processing is based on consent, or raise a grievance concerning Comify's handling of your personal data. Withdrawal of consent may affect Comify's ability to provide a feature or Service that genuinely requires the relevant information, but will not affect processing already lawfully carried out.
Once the relevant substantive provisions of the DPDP Act and DPDP Rules become applicable, and where Comify acts as Data Fiduciary, Data Principals will be able to exercise the rights available under that framework, including the right to obtain prescribed information about processing, seek correction, completion, updating or erasure of personal data, withdraw consent, seek grievance redressal and make a nomination in accordance with applicable law.
If a request concerns Customer Data for which a business customer determines the purpose and means of processing, the relevant business customer is the primary point of contact. Comify may refer the request to that customer or assist the customer in responding in accordance with the applicable agreement and law.
You may submit a privacy request or grievance by emailing [email protected] or [email protected], or by using available account settings or unsubscribe controls. Please provide sufficient information to identify the relevant account or interaction and describe the request clearly. Comify may take reasonable steps to verify the request before acting on it.
Where the SPDI Rules apply, the Grievance Officer will address grievances concerning the processing of sensitive personal data or information expeditiously and, in any event, within one month from receipt of the grievance. Once the relevant DPDP grievance provisions become applicable, Comify will publish and observe a reasonable grievance response period not exceeding 90 days, or such other period as may be prescribed under applicable law.
Comify may refuse or limit a request where permitted by applicable law, including where continued retention or processing is necessary for a lawful purpose, compliance obligation, security requirement, fraud prevention or legal claim.
When a user uses the Comify Capture Chrome extension, Comify may collect the email or other content that the user expressly selects for capture, including the sender, subject, body text and other selected content required for the requested capture functionality.
Selected content is transmitted to Comify's relevant extension or service infrastructure to provide the requested capture, preview and related workflow. Comify does not use captured content for unrelated advertising and limits disclosure to the relevant account or business customer, contracted infrastructure or service providers required to provide and secure the function, or lawful authorities where disclosure is required by law.
Depending on the account and context, Comify may process captured content as a Data Processor for the relevant business customer. The user and customer are responsible for ensuring that they are authorised to capture and submit the selected content.
A user may request export, correction or deletion of extension data by contacting [email protected], subject to verification, the relevant business customer's instructions and any applicable legal, contractual or security retention requirement.
We may update this Policy from time to time to reflect changes in the Services, processing practices or applicable law. The revised date will appear at the top of this Policy. Where a change materially affects the purposes of processing, categories of personal data, recipients or rights of individuals, Comify will provide such additional notice and obtain fresh consent to the extent required by applicable law. An update to this Policy will not, by itself, authorise a materially new purpose where applicable law requires separate consent or notice.
For questions about this Policy, Comify's processing of personal data, or to exercise a privacy right, you may contact:
| Company | Comify Solutions Private Limited |
|---|---|
| General privacy contact | [email protected] |
| Grievance Officer | Anurag Srivastava |
| Designation | Grievance Officer |
| Grievance email | [email protected] |
The Grievance Officer will acknowledge, review and respond to grievances within the period required by applicable law. Where a grievance relates to Customer Data controlled by a business customer, Comify may coordinate with or refer the matter to that customer so that the request can be addressed by the appropriate Data Fiduciary or responsible entity.