Privacy Policy

Geckolyst Solutions Private Limited (“Geckolyst”, “we”, “our”, or “us”) respects your privacy and is committed to protecting personal information processed through our website, software products, applications, and related services.

This Privacy Policy explains the categories of information we may process, how we use and protect it, when it may be disclosed, and the choices and rights available to individuals. This Policy should be read together with any applicable customer agreement, service agreement, data processing agreement, or product-specific privacy notice.

Important: When Geckolyst processes personal information on behalf of a customer, the customer may determine the purposes and means of processing and may be responsible for providing privacy notices and responding to individual requests. Geckolyst processes such information in accordance with applicable agreements, documented instructions, and applicable law.

1. Scope

This Policy applies to personal information processed in connection with:

• The Geckolyst corporate website and online resources.
• Customer relationship management and customer experience platforms.
• Survey, feedback, and customer satisfaction management systems.
• Ticketing, campaign management, and loyalty management solutions.
• Text analytics, voice analytics, and AI-enabled services.
• Customer support, sales, demonstrations, recruitment, and business communications.
• Other Geckolyst products and services that reference this Policy.

This Privacy Policy describes the categories of personal information that we collect or otherwise process, the purposes and means of such processing, the circumstances in which information may be disclosed, the safeguards adopted by us, and the rights and choices available to individuals under applicable data protection laws.

Geckolyst operates in different capacities depending on the nature of the services provided. In relation to information collected for its own business operations, Geckolyst determines the purposes and means of processing. In relation to personal information processed through its platforms on behalf of customers, Geckolyst generally acts as a service provider or Data Processor, processing such information in accordance with the applicable customer agreement and documented instructions.

This Policy applies to individuals whose personal data is processed by Geckolyst, whether collected directly from such individuals or received through customers, authorised integrations or other lawful sources.

Additional terms or privacy notices may apply to specific products, integrations, or services.

This Policy applies to individuals who visit our website, communicate with us, use our products or services, interact with our representatives, or whose personal data is processed through our platforms on behalf of our customers.

The nature and extent of personal data processed will depend on the particular product, service, integration, configuration and purpose for which it is used.

2. Information We Process

Depending on how you interact with Geckolyst and how a service is configured, we may process the following categories of information:

2.1 Contact and business information

• Name, business email address, telephone number, and job title.
• Company name, business address, and other professional details.
• Information submitted through contact forms, enquiries, applications, or support requests.
• Communications and other information exchanged with Geckolyst representatives.

2.2 Account and service information

• Account identifiers, usernames, authentication credentials and other account-related information.
• User roles, access permissions, account configurations and service preferences.
• Records of access to and use of Geckolyst products and services.
• Customer support records, service requests, feedback and technical diagnostic information.

2.3 Customer, survey, and transaction-related information

Depending on the customer's configuration and instructions, our platforms may process survey responses, customer feedback, ratings, service interactions, ticket details, loyalty-related information, transaction references, and other information submitted to or integrated with the relevant service.

2.4 Voice, text, and AI-related information

Where enabled, our services may process call recordings, audio files, transcripts, text comments, interaction metadata, and analytics outputs. AI-enabled features may generate summaries, classifications, sentiment indicators, or other outputs from submitted information.

The collection and processing of voice recordings and other communications must be undertaken by the relevant customer or organisation in compliance with applicable notice, consent, authorisation and recording requirements.

2.5 Technical and usage information

Our website and services may process IP addresses, browser and device details, operating system, access timestamps, application activity, logs, error reports, security events, and cookies or similar technologies where used.

2.6 Information from third parties

We may receive information from customers, authorised integration providers, business partners, and other third parties where permitted and necessary to deliver our services.

• Publicly available sources, where lawfully accessed and relevant to our business purposes.
• Other third parties who are authorised to share such information with us.

We expect information received from third parties to be shared in accordance with applicable law and appropriate authorisations.

We do not intentionally seek to collect personal data beyond what is reasonably necessary for the relevant business or service purpose. Where the nature of the service requires the processing of sensitive or specially regulated information, the relevant processing will be subject to applicable legal requirements and contractual arrangements.

3. How We Use Information

We may use information, as applicable, to:

• Provide, operate, maintain, and support our products and services.
• Manage accounts, user access, and customer configurations.
• Deliver surveys, feedback management, ticketing, analytics, and reporting.
• Process customer-authorised integrations and data exchanges.
• Generate analytics and AI-assisted outputs requested or enabled by customers.
• Respond to enquiries, support requests, and contractual obligations.
• Monitor service performance, troubleshoot issues, and improve reliability.
• Detect, investigate, and prevent fraud, unauthorised access, and security incidents.
• Meet applicable legal, regulatory, and compliance obligations.
• Communicate service announcements and, where permitted, business or marketing information.

We handle customer data in accordance with applicable contracts, customer instructions, and legal requirements. Any use for product improvement, model development, or other secondary purposes should be governed by the applicable agreement, service configuration, and law.

4. Legal Basis and Applicable Laws

We process personal information in accordance with applicable data protection and privacy laws. Depending on the circumstances, processing may be based on consent, contractual necessity, compliance with legal obligations, legitimate interests where recognised by applicable law, or another lawful basis.

For processing governed by Indian law, Geckolyst seeks to comply with the applicable provisions of the Information Technology Act, 2000, the rules made thereunder, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable, and the Digital Personal Data Protection Act, 2023, together with the rules, notifications and regulations issued thereunder, as and when the relevant provisions become applicable and effective.

Where other privacy laws apply, additional rights, notices, and obligations may be relevant.

5. Our Role: Business Contact Data and Customer Data

5.1 Information for which Geckolyst determines the purpose

For information collected through our corporate website, sales enquiries, recruitment processes, and business communications, Geckolyst may determine the purposes and means of processing, subject to applicable law.

5.2 Information processed on behalf of customers

When customers use Geckolyst products to collect or analyse information about their own customers, employees, or other individuals, Geckolyst generally processes that information to provide the contracted services and in accordance with the applicable customer agreement and documented instructions.

The customer is generally responsible for determining the appropriate purpose and lawful basis for collecting that information, providing required notices, and managing individual requests, unless applicable law or the parties' agreement provides otherwise. Where a separate Data Processing Agreement applies, its terms also govern the processing.

Where Geckolyst independently determines the purposes and means of any particular processing activity, its responsibilities in respect of that activity will be determined in accordance with applicable law and the actual nature of the processing, irrespective of the contractual designation of the parties.

6. Sharing and Disclosure

We may disclose information, as appropriate, in the following circumstances:

• Service providers and subprocessors: To approved providers supporting hosting, infrastructure, communications, security, analytics, AI functionality, or other operational requirements.
• Customer-authorised integrations: To third-party systems connected or configured by a customer.
• Professional advisers: To legal, audit, or other professional advisers where necessary.
• Legal requirements: Where disclosure is required by applicable law, a court order, or a lawful request from an authorised authority.
• Business transactions: In connection with a merger, acquisition, restructuring, or transfer of business, subject to appropriate safeguards and applicable law.
• Protection and security: Where reasonably necessary to protect rights, property, safety, or the security of our services.

Where required by applicable law or contract, we use appropriate arrangements for service providers and subprocessors. We do not sell personal information as a business practice.

7. Data Security

Geckolyst uses technical and organisational safeguards designed to protect information against unauthorised access, disclosure, alteration, loss, destruction, and other security risks. Depending on the service and deployment, safeguards may include:

• Access controls and role-based permissions.
• Authentication and account security measures.
• Encryption and secure communications where appropriate.
• Logging, monitoring, and security event review.
• Vulnerability management and security testing.
• Backup, recovery, and business continuity measures.
• Personnel confidentiality obligations and security awareness.
• Supplier and third-party security reviews, where applicable.
• Information security policies and risk management processes.

The specific safeguards may vary by product, service configuration, and deployment. Any claim about certification status or scope should be checked against current certification documentation. No website, application, or transmission method can be guaranteed to be completely secure.

8. Security Incidents

We maintain processes for assessing and responding to suspected or confirmed security incidents affecting information processed through our services. Where an incident affects customer information, Geckolyst will handle communications and notifications in accordance with applicable law, contractual commitments, and the circumstances of the incident.

Customers should refer to their applicable agreement or Data Processing Agreement for any specific notification timelines and cooperation commitments.

9. Retention and Deletion

We retain personal information for no longer than reasonably necessary for the purposes described in this Policy, to provide contracted services, comply with legal obligations, resolve disputes, and enforce agreements.

Retention periods may vary according to the type of information, service configuration, customer instructions, contractual requirements, and applicable law. Where Geckolyst processes information for a customer, retention and deletion are governed by the applicable agreement and customer instructions, subject to legal obligations and technical limitations such as backup and recovery cycles.

When information is no longer required, we will delete it, anonymise it, or otherwise handle it in accordance with applicable requirements and contractual commitments.

10. International Data Transfers

Depending on the hosting arrangement, service provider, or integration, information may be processed or accessed in locations outside the country where it was collected. Where international transfers occur, we will apply safeguards and comply with transfer restrictions required by applicable law and relevant contractual obligations.

Customers are responsible for ensuring that their instructions concerning international transfers are lawful and compatible with their applicable obligations, while Geckolyst remains responsible for the obligations imposed upon it under applicable law and the relevant contractual arrangements.

11. Cookies and Similar Technologies

Our website may use cookies or similar technologies to support essential functionality, remember preferences, understand website usage, and improve performance. The specific cookies used depend on the website features and tools deployed.

Where required, we will provide appropriate information and obtain consent before using non-essential cookies or similar technologies. You may be able to manage cookies through your browser settings or available website preference controls. Disabling certain cookies may affect website functionality.

12. Third-Party Services and Integrations

Our website or products may integrate with or link to third-party services. These services may have their own privacy policies and information-handling practices. Where a customer enables an integration, information may be exchanged with the relevant provider as configured or authorised by that customer. Third-party processing is subject to the provider's applicable terms, policies, and legal obligations.

Geckolyst does not independently control the privacy practices, security arrangements, data retention policies or processing activities of third-party providers operating outside its control.

The processing of personal data by such third parties may be governed by their own privacy policies, contractual terms and applicable legal obligations.

Customers and users are encouraged to review the applicable third-party privacy policies and terms before enabling integrations or sharing personal data with such services.

Where Geckolyst engages a third party as a subprocessor, the applicable contractual and data protection obligations described in this Policy and the relevant customer agreement will also apply.

13. AI and Automated Analysis

Certain Geckolyst products may use AI or automated analytical techniques to process customer-provided data and generate insights, classifications, summaries, or recommendations. The availability and purpose of these features depend on the product configuration and customer instructions.

AI-generated outputs may be incomplete or inaccurate and should be reviewed by an appropriately authorised person where necessary. Where third-party AI providers are used, information may be processed by those providers subject to the applicable service configuration, provider terms, and customer agreement.

Whether data is used for model training, how long it is retained by an AI provider, and what configuration options are available depend on the relevant product and provider arrangements. Customers should refer to their applicable service documentation or agreement for details. We do not make a blanket promise about model training or retention across all possible configurations.

AI-generated outputs may be incomplete, inaccurate, misleading or affected by limitations in the underlying data or technology. Such outputs should not be treated as independently verified facts or as a substitute for appropriate human review, particularly where they may materially affect an individual's rights, interests or access to services.

Geckolyst will not represent AI-generated outputs as error-free or guarantee that automated analysis will produce accurate or complete results in every instance.

14. Your Privacy Rights and Choices

Depending on applicable law and the nature of our processing, individuals may have rights to:

• Request information about the processing of their personal data.
• Request access to personal information, where such a right applies.
• Request correction or updating of inaccurate information.
• Request deletion or erasure where legally available.
• Withdraw consent where processing is based on consent.
• Raise grievances or complaints with the appropriate organisation or authority.
• Exercise other rights provided by applicable privacy law.

Where Geckolyst processes information on behalf of a customer, individuals may need to direct their requests to that customer. Geckolyst will provide assistance in accordance with the applicable agreement and law. We may need to verify identity or authority before responding.

Requests will be handled within the timelines prescribed under applicable law or, where no specific statutory timeline applies, within a reasonable period.

15. Children's Privacy

Our corporate website and business services are not intended to be directed to children unless a particular service is specifically designed and lawfully configured for that purpose. Where customer use of a Geckolyst service involves children's personal data, the customer must ensure that collection and processing comply with applicable legal requirements. Geckolyst will handle such information in accordance with applicable law and contractual obligations.

Where a customer uses a Geckolyst product or service to collect or process personal data relating to children, the customer is responsible for ensuring that such collection and processing are undertaken in accordance with applicable law, including obtaining verifiable parental consent or other required authorisations, where applicable.

Where Geckolyst becomes aware that children's personal data has been collected or processed in circumstances that may violate applicable law or the relevant contractual arrangements, it may take reasonable steps to restrict or suspend the relevant processing and notify the customer, where appropriate.

16. Marketing Communications

We may send business-related updates, product information, or marketing communications where permitted by law. You may opt out of marketing emails by using the unsubscribe option provided in the message or by contacting us. Opting out will not prevent us from sending necessary service-related, transactional, security, or legal notices.

17. Customer Responsibilities

Customers using Geckolyst products and services are responsible, to the extent applicable to their role and processing activities, for:

• Determining and documenting the lawful basis for collecting and processing personal data.
• Providing appropriate and transparent privacy notices to individuals.
• Obtaining valid consent or other required authorisations before collecting or processing personal data.
• Ensuring that personal data shared with Geckolyst has been lawfully collected and may lawfully be disclosed for the relevant purposes.
• Ensuring that the categories of personal data collected are relevant and reasonably necessary for the intended purposes.
• Configuring user access, roles and permissions appropriately.
• Ensuring that integrations, data exchanges and third-party disclosures are properly authorised.
• Establishing appropriate retention periods and providing deletion or return instructions where required.
• Responding to individual privacy requests where the customer acts as the relevant Data Fiduciary or responsible organisation.
• Complying with applicable requirements concerning children's personal data and other specially regulated categories of information.
• Ensuring that the use of AI-enabled features is consistent with applicable law, privacy notices and customer instructions.
• Maintaining appropriate internal policies, procedures and safeguards for the use of Geckolyst products and services.

Customers must not use Geckolyst products or services to collect, process, disclose or otherwise handle personal data in violation of applicable law or the rights of individuals.

Geckolyst may take reasonable measures, including restricting or suspending relevant processing or access, where it reasonably believes that a customer's use of its products or services presents a material legal, regulatory, security or contractual risk.

18. Google API Services (Where Applicable)

If a Geckolyst product integrates with Google API services, access to and use of Google user data will be limited to the purposes disclosed to the user, authorised by the user, and permitted by the applicable Google API terms and policies. Google user data will not be used or transferred except as permitted by those terms, the relevant user authorisation, applicable agreements, and law.

19. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, business practices, legal obligations, or security requirements. The updated version will be published on this page with a revised “Last Updated” date. Where required by applicable law or contract, we will provide additional notice of material changes or obtain consent.

Individuals are encouraged to review this Policy periodically to remain informed about how their personal data is handled.

20. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of personal information, please contact:

Geckolyst Solutions Private Limited
Email: privacy@geckolyst.com
Support: support@geckolyst.com
Website: https://www.geckolyst.com/

We will review and respond to privacy-related requests in accordance with applicable law and our relevant contractual obligations.