Your rights, and how to use them

Who to ask

• You are an employee using a company’s Stemzo workspace. Your employer is the Data Fiduciary for that data, so your employer decides most requests. Stemzo is its Data Processor and will pass your request to your company’s administrators within 3 working days and help them answer, so you can ask either of us.
• You sent an enquiry, hold an account or pay for a workspace. Stemzo is the Data Fiduciary, so we answer. (For the stemzo.in website the answering business is Gorkha Corporation, trading as Stemzo; the same desk takes the request.)

What you can ask for

• Access: a summary of your personal data, what we do with it, and the companies it has been shared with (the identities of the fiduciaries and processors, with a description of what was shared). In the app, Download my data gives you a copy of your own records (it does not include other people’s data, or your ID photos, which you can view in the app). The companies your data can be shared with are on the sub-processors page; ask us if you need more and we will give it.
• Correction, completion and updating of anything wrong, missing or out of date.
• Erasure. We erase unless the law requires the record to be kept (for example payroll, tax and statutory attendance records, which are kept for periods of 5 to 8 years or more; see the retention section). We or your employer will say so if that applies. In the app, an erasure request goes to your employer’s Founder and GM and can be carried out only after your employment has ended. It removes straight away what no rule requires keeping (for example phone notification settings, selfies and visit photos, ID photos, and personal tasks), and moves old Aadhaar and Voter ID files in Google Drive to the bin. Records that the company’s retention rules say must stay (for example KYC details and location until the end of their period, and payroll, tax and attendance records for the statutory period, with your name replaced and your employee ID kept in those records so they still add up) are removed when that period ends. Business records such as delivery photos and expense bills belong to the employer, and are deleted on the retention schedule if the company’s Founder has switched on the automatic clean-up. You are told what is kept, and until when.
• Stop marketing messages, in one click. Send an email to customer@stemzo.ai with the subject “Unsubscribe” (the subject is filled in for you). We stop within 7 days, usually sooner, and keep only a short note that you opted out so that we do not write to you again. Founders and administrators of a workspace can also switch “Marketing messages” off in the app under My settings > Privacy. Every marketing email and WhatsApp message also says how to stop. Hindi: “Unsubscribe” विषय के साथ ईमेल भेजें; हम 7 दिन में रोक देंगे। Marketing is always optional and never a condition of any service.
• Change the website analytics choice. Use “Cookie settings” in the footer of stemzo.ai or stemzo.in to accept or decline Google Analytics; declining stops it at once.
• Withdraw consent, wherever we rely on it (for example the enquiry forms, or an optional item an employer adds). It is as easy as giving it: send us one email, or use the same screen in the app. Withdrawing does not undo earlier use, and we may decline a service that needs the data.
• Grievance: tell us what went wrong with how your data was handled or with a request.
• Nominate another person to exercise these rights for you if you die or become unable to act. Send the nominee’s name and contact details; we record them with your data and act on them when we are shown proof of the death or incapacity. See also the Terms.

How to ask

1. In the app: My settings > My privacy.
2. By email: customer@stemzo.ai. Use the email address you sign in with or gave on the form. You can also write to the registered office or phone the Grievance Officer (details below).
3. What we need from you (the identifier): your name, the email address registered in the workspace or used on the form (or the phone number you gave), and the company name if you work in a workspace. We may ask one question to confirm it is you, so that we do not give your data to someone else. Tell us what you want (access, correction, erasure, withdraw consent, grievance, nomination). You do not need to give a reason.

What to expect

• We confirm we have your request within 2 working days and aim to answer within 15 days.
• We will resolve a complaint about how your personal data was handled within one month of receiving it.
• We will answer every request within 90 days, which is the longest the Rules allow for a grievance reply and which we apply to every request. If we need more than 15 days we tell you before day 15, with the new date.
• Every reply includes the Privacy and Grievance Desk’s contact details.
• Asking costs nothing and does not affect your job or your relationship with us.

Privacy and Grievance Desk and Grievance Officer

If you are not satisfied: the Data Protection Board of India

Please use the Privacy and Grievance Desk first, as the law expects you to use the grievance route before going further. If you are still not satisfied, you may complain to the Data Protection Board of India, the body set up under the Digital Personal Data Protection Act, 2023. The Board works as a digital office and, at the time of writing, has not published an address or form that we can safely point to, so we print none; please use the channel the Board publishes. We will add its contact details here when the Government announces them. Nothing in our terms or policies waives your right to complain to the Board or to go to a court.

The Act also asks people not to make false or frivolous complaints or to pretend to be someone else.

Version

Version 3.3, effective 6 October 2026, last reviewed 6 October 2026. It replaces version 3.2 of 6 October 2026; your rights are unchanged and the version moves with the privacy policies, which now describe more completely what is deleted and when. Version 3.2 replaced version 3.1 of 5 October 2026 and added how to stop marketing messages (one email, honoured within 7 days) and how to change the website analytics choice. Version 3.1 aligned the erasure paragraph with the app and added the company's Corporate Identity Number. Version 3.0 added the one-month grievance response, the identifier and nomination details and the retention periods. Stemzo India Private Limited, CIN U17090WB2025PTC284806, registered office 40/27, Mangturam Compound, Siliguri - 734005, West Bengal, India; telephone +91-7797100055; email customer@stemzo.ai.