Privacy policy

1. Who we are and how to contact us

ReachIQ provides a cloud-based customer relationship management (CRM) service for business-to-business companies. In this policy, "ReachIQ", "we", "us" and "our" refer to ReachIQ CRM, a business based in India, which operates the ReachIQ website and service.

For any question or request about privacy, contact our privacy team at support@reachiqcrm.com with the subject line "Privacy", or call +91 7624867502.

2. Scope and our roles

This policy covers personal data we collect through our website (including demo, contact, newsletter and careers forms) and personal data about the people who sign up for and use ReachIQ. For this data, ReachIQ is the controller (under the EU and UK GDPR) and the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023).

Our customers use ReachIQ to store information about their own prospects, contacts and business partners ("Customer Data"). For Customer Data, the customer decides why and how it is processed and is the controller or Data Fiduciary. ReachIQ processes Customer Data only on the customer's instructions, as a processor, under our Terms of service. If your information is held in ReachIQ by one of our customers, please contact that company directly. We will support them in responding to you.

3. Personal data we collect

• Account information: name, work email address, company name, job title, role and password. Passwords are stored by our authentication provider in hashed form and are never visible to us.
• Profile and settings: preferences you choose, such as language, date format, landing page and notification settings.
• Form submissions: information you send through our demo, contact, newsletter and careers forms, such as name, email, company, team size, message and, for job applications, a profile link.
• Activity records: when you make changes in ReachIQ, our audit log records your name, the action taken, the type of record and the time, so that administrators of your company can see who changed what.
• Technical information: IP address, browser type, device information and request logs collected by our hosting provider to deliver, secure and troubleshoot the service.

4. How we use personal data and our legal bases

• To create and manage your account and provide the CRM service. Legal basis: performance of a contract.
• To authenticate you, keep your session secure, prevent fraud and misuse, and maintain audit records. Legal basis: legitimate interests and performance of a contract.
• To respond to demo requests, enquiries and job applications. Legal basis: legitimate interests, or steps taken at your request before entering into a contract.
• To send service communications such as account confirmation and password reset emails. Legal basis: performance of a contract.
• To send our newsletter where you have subscribed. Legal basis: consent, which you may withdraw at any time.
• To comply with legal obligations and respond to lawful requests. Legal basis: legal obligation.

Where India's Digital Personal Data Protection Act, 2023 applies, we process your personal data on the basis of your consent or for the legitimate uses permitted by that Act, such as providing a service you have requested.

5. How we share personal data

We do not sell personal data, and we do not share it for third-party advertising. We share personal data only with:

• Service providers (sub-processors) that host and operate ReachIQ on our behalf under written contracts that require them to protect the data. These currently include Vercel Inc. (website and application hosting) and Supabase Inc. (database, authentication and authentication emails). Our website also uses Vercel Web Analytics to count visits. It does not use cookies or identify individual visitors.
• Your company's administrators, who can see account information and audit records for users in their workspace.
• Authorities or other parties where required by law, or to protect the rights, safety and security of ReachIQ, our customers or others.
• A successor organization in connection with a merger, acquisition or sale of assets, subject to equivalent protections.

6. International transfers

Our service providers may store and process data in countries other than your own, including the United States. Where personal data from the European Economic Area, the United Kingdom or other regions with transfer restrictions is transferred, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Transfers from India are made in accordance with the Digital Personal Data Protection Act, 2023 and any restrictions notified under it.

7. How we protect personal data

We use technical and organizational measures appropriate to the risk, including encryption of data in transit using HTTPS, encryption at rest provided by our database provider, separation of each company's data using row-level security, role-based access within each workspace and an audit log of record changes. No method of transmission or storage is completely secure, but we work continuously to protect your information. If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law.

8. How long we keep personal data

• Account and Customer Data: for as long as the account is active. When a company asks us to delete its account, its records are erased from our active systems. Residual copies in provider backups are removed in line with those providers' backup cycles.
• Form submissions: for as long as needed to respond and follow up, and in any case no longer than 24 months unless a business relationship continues.
• Job applications: for up to 12 months, so we can consider you for future roles, unless you ask us to delete them sooner.
• Technical logs: for the limited period set by our hosting provider for security and troubleshooting.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and obtain a copy;
• correct inaccurate or incomplete data;
• delete your data (erasure);
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• nominate another person to exercise your rights in the event of death or incapacity (India); and
• lodge a complaint with a data protection authority, or, in India, with the Data Protection Board of India after first raising your grievance with us.

To exercise any of these rights, email support@reachiqcrm.com. We will respond within the time required by applicable law, and generally within 30 days. We may need to verify your identity before acting on a request.

10. Grievance redressal

If you have a concern or complaint about how we handle your personal data, please contact our Grievance Officer at support@reachiqcrm.com with the subject line "Grievance". We will acknowledge your grievance promptly and aim to resolve it within the period prescribed under applicable law.

11. Cookies and similar technologies

We use a small number of strictly necessary cookies to keep you signed in, and your browser's local storage to remember display preferences. We do not use advertising or cross-site tracking cookies. See our cookie policy for details.

12. Children

ReachIQ is a service for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy to reflect changes to our service or legal requirements. We will update the date at the top of this page and, for material changes, notify account holders by email or within the service before the change takes effect.