Privacy Policy

This policy explains how Inway Communications ("Reach by Inway®", "Inway", "we", "us") collects, uses, shares, stores and protects personal data. It applies to reach.bz and to the websites and catalogues we host for our Clients.

This policy is an electronic record under the Information Technology Act, 2000 and needs no signature. It should be read with our Terms of Service, Cookie and Analytics Policy and Data Processing Terms. If you do not agree with it, please do not use Reach.

1. Our two roles

• Client account data. For the people and businesses who register with Reach, Inway decides why and how the data is used, so Inway is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
• Visitor data on Client websites. For the visitors and customers of a website or catalogue hosted by a Client, the Client is the Data Fiduciary and Inway is its Data Processor. This policy does not govern what a Client does with personal data outside Reach. Each Client must comply with the law and obtain the consent it needs; Inway is not liable for a Client's breach of law. See our Data Processing Terms for Clients.

2. What we collect from Clients

Sensitive personal data. Some of what we handle is sensitive personal data or information under the Information Technology (Reasonable Security Practices) Rules, 2011: your password, payment or bank details collected by a payment provider, and your GSTIN. We do not ask for health, biometric or other special categories of data, and you should not send them to us.

3. What we collect from visitors of Client websites

Where a Client enables analytics, we process the following for that Client: pages viewed, time on page, device and browser type, operating system, approximate location, IP address, referral source, clicks on call and WhatsApp buttons, and form submissions, including the name, phone number, email address and message a visitor types. Through Microsoft Clarity this may include session recordings and heatmaps of how a visitor moves and clicks.

4. How we use data

We use personal data to provide, secure and support the Service; to create and manage your account; to bill you and meet legal and tax obligations; to send service messages such as login codes, invoices, renewal and security notices; to give Clients their analytics; to detect and prevent fraud, abuse and illegal activity; to answer requests, grievances and complaints; for internal analysis, auditing and research to improve the Service; and to comply with a legal or regulatory requirement or a request from a court or government authority.

We send promotional messages only where you have consented, and you can withdraw that consent at any time. See clause 9 of the Terms of Service for marketing consent, including the DND and NCPR position.

5. Basis for processing

We process personal data on your consent, given when you register, when you tick a consent box and when you submit a form, or for the other lawful purposes the DPDP Act permits, such as performing the service you asked for, complying with law, and responding to a medical or security emergency.

You may withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing already carried out lawfully, and we may no longer be able to provide the service that needs that data.

6. Sharing

We do not sell personal data, and we do not give Client information to third parties for their own marketing. Our service providers are not permitted to market their own services to you using data we share.

We share data only as needed, with service providers who work for us under confidentiality and security obligations:

• cloud hosting and server providers, and Amazon Web Services for media storage and content delivery;
• email and messaging providers, such as Brevo, to send login codes and notices;
• analytics providers: Google Analytics and Microsoft Clarity;
• domain registrars and DNS providers, where a domain is bought or connected through us;
• payment processors, and our professional advisers such as accountants, lawyers and auditors.

Payment providers may collect your card or bank details directly. Those details are used only for billing and are handled on the provider's secure systems. We do not verify or store them, and we are not liable for the acts or omissions of a payment provider or for a dispute between you and one.

We also disclose data where the law, a court or a government authority requires it, or where we reasonably believe it is necessary to protect our rights, our users or the public, or to prevent fraud or credit risk. If the business is sold, merged or restructured, data may transfer to the successor, which must protect it at least as well as this policy requires.

We may publish or share aggregated or anonymised statistics that cannot identify any individual.

7. Where data is stored

Media files are stored with Amazon Web Services in Mumbai, India. Some providers listed above, such as Google and Microsoft, may process data outside India. We transfer data abroad only as the DPDP Act and Government notifications permit, and we require recipients to protect it in line with this policy.

We offer the Service worldwide. If you register from outside India, you accept that your data is processed in India and by the providers listed above.

8. Retention

We keep personal data while your account is active and for as long as needed for the purposes in this policy. After closure we delete or anonymise it within a reasonable period, except:

• billing, tax and GST records, which we keep for at least 8 years as the law requires;
• records needed to handle a dispute, claim or investigation, which we keep until it ends;
• backups, which expire on their normal cycle.

Visitor analytics data is kept as set by the Client and by the analytics provider's own settings.

9. Security

We use encryption in transit (HTTPS) and at rest for stored media, access controls, private storage with no public access, firewalls, backups, signed software updates, logging and monitoring. Only a limited number of authorised people can reach personal data, and they are bound by confidentiality.

No system is completely secure, and the internet carries risk. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

10. Children

Reach is meant for business use by adults. We do not knowingly collect the personal data of a child, meaning anyone under 18, without the verifiable consent of a parent or guardian, and where an account is held for a minor the parent or guardian must register it in their own details. We do not track a child's behaviour or direct advertising at a child. If we learn that we hold a child's data without that consent, we will delete it within a reasonable time. A parent or guardian who believes a child has given us data should write to support@reach.bz.

11. Your rights

You may ask us to give you a summary of the personal data we hold about you and who we have shared it with; to correct, complete or update it; to erase it where it is no longer needed and the law does not require us to keep it; to withdraw your consent; and to nominate another person to exercise your rights if you die or cannot act for yourself. You may also raise a grievance. How to do this, and how to escalate, is in our Data Protection Rights and Grievance Redressal page.

You can also view and change much of your account information yourself in your Reach dashboard.

12. Cookies and analytics

See the Cookie and Analytics Policy.

13. Links and third-party content

Client websites and third-party sites have their own policies and cookies, which we do not control. We are not responsible for them or for the accuracy of their content, and a link is not an endorsement.

14. Social accounts

Where Reach lets you connect a social media or third-party account for sign-in or publishing, you can disconnect it at any time. When you do, the authentication credentials we hold for it, including tokens, identifiers and session data, are deleted from our systems.

15. Changes

We may amend this policy. The current version is always on reach.bz with its effective date, and we will tell you by email or in your dashboard about a material change. Please review this page from time to time.

16. Governing law

This policy is governed by the laws of India. Any dispute about it is subject to the exclusive jurisdiction of the courts at Coimbatore, Tamil Nadu.

17. Severability

If any part of this policy is held invalid, that part is ineffective only to that extent and the rest continues to apply.

18. Contact

Inway Communications (Reach by Inway®) No. 301, 3rd Street Extension, 100 Feet Road, Gandhipuram, Coimbatore 641012, Tamil Nadu, India GSTIN 33AUIPM6453D2ZP · support@reach.bz · reach.bz Grievance Officer: Ms. Shalini · +91 98434 20001