karmaalab privacy policy

Karmaa Lab Pvt. Ltd. ("KarmaaLab", "we", "our", or "us") is a software technology company incorporated under the Companies Act, 2013, with its registered office in Bengaluru, Karnataka, India. We design, develop, and operate a portfolio of enterprise and consumer software products including LearnNet, eSamwad, Rewardify, EventNet, HRI, and SigmaPi.

This Privacy Policy describes how KarmaaLab collects, uses, stores, shares, and protects personal data across all of our products, platforms, websites, and services (collectively, "Services"). It applies to:

• Visitors to our website at www.karmaalab.com

• Prospective clients who enquire about or evaluate our products

• Client organisations that subscribe to and use our products

• Authorised users of our products acting on behalf of client organisations

• Individuals whose data is processed through our products as part of a client's operations

• Partners, vendors, and other third parties who interact with KarmaaLab

By accessing our website or using any of our Services, you acknowledge that you have read and understood this Privacy Policy. If you are accessing our Services on behalf of an organisation, you represent that you have the authority to bind that organisation to this Policy.

KarmaaLab operates in different data roles depending on the context:

As Data Fiduciary (Controller)
KarmaaLab acts as Data Fiduciary when we determine the purposes and means of processing personal data. This applies to:

• Data collected from website visitors

• Data collected from prospective clients and leads

• Data collected from partners and vendors

• User account and platform access data

As Data Processor
KarmaaLab acts as Data Processor when we process personal data on behalf of our client organisations — for example, employee data processed through HRI, learner data processed through LearnNet, or member data processed through eSamwad. In these cases, the client organisation is the Data Fiduciary and KarmaaLab processes data only as instructed under a Data Processing Agreement.

3.1 Website and Marketing Data

When you visit www.karmaalab.com or interact with our marketing channels, we may collect:

• Name, email address, phone number, and company name (when submitted via contact, demo request, or newsletter forms)

• IP address, browser type, operating system, and device information

• Pages visited, time spent, referral source, and navigation behaviour

• Cookie and tracking data as described in our Cookie Policy

3.2 Client and Prospect Data

When organisations engage with KarmaaLab for product evaluation or subscription, we collect:

• Company name, industry, size, and registered address

• Contact details of designated representatives (name, role, email, phone)

• Commercial information (subscription tier, billing details, contract terms)

• Communications and correspondence during the sales and onboarding process

3.3 User Account Data

When individuals are provisioned access to any KarmaaLab product, we collect:

• Full name, email address, and role designation

• Authentication credentials (stored in hashed, non-recoverable form)

• Login timestamps, session data, and device information

• In-platform activity logs and feature usage data

3.4 Product-Specific Data

Each KarmaaLab product processes data specific to its function. Detailed data inventories for individual products are available in the product-specific privacy notices linked below:

• LearnNet — Learner, instructor, and institutional data

• eSamwad — Member profiles, social interactions, and community content

• Rewardify — Consumer identity, purchase events, and reward redemption data

• EventNet — Attendee registration, session attendance, and event interaction data

• HRI — Employee records, performance data, and workforce analytics inputs

• SigmaPi — Business metrics, operational data, and analytics configurations

3.5 Vendor and Partner Data

When we engage vendors, contractors, or partners, we collect:

• Business and contact information of representatives

• Bank account and payment details for vendor transactions

• Communications and documents exchanged during the engagement

• Directly from you — through website forms, product registration, onboarding, support requests, and direct communications

• Automatically — through cookies, server logs, and analytics tools when you use our website or products

• From client organisations — when clients upload or integrate data as part of using our products

• From third-party integrations — when our products connect to third-party systems at a client's direction

• From public sources — company information from public directories or professional platforms, for prospecting purposes only

KarmaaLab processes personal data on the following legal bases under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable law:

Contractual Necessity — Processing required to deliver our products and services under a client agreement or to fulfil a service request.

Legitimate Interests — Processing for purposes such as product improvement, security monitoring, fraud prevention, and business development, where our interests are not overridden by individual rights.

Consent — Processing based on freely given, specific, and informed consent — particularly for marketing communications and non-essential cookies.

Legal Obligation — Processing required to comply with applicable laws, regulatory requirements, or lawful government orders.

Delivering and Operating Our Products
To provision, maintain, and improve our products and services for clients and their authorised users.

Client Relationship Management
To manage commercial relationships, process renewals, issue invoices, and provide account support.

Marketing and Communications
To send product updates, thought leadership content, event invitations, and promotional communications to prospects and clients who have opted in or where permitted under applicable law. You may opt out at any time.

Security and Fraud Prevention
To authenticate users, detect unauthorised access, monitor for threats, and protect the integrity of our platforms and data.

Analytics and Product Development
To analyse anonymised, aggregated usage patterns to improve our products, features, and user experience. No identifiable personal data is used for product development without explicit consent.

Legal and Compliance
To meet our obligations under applicable law, respond to lawful regulatory requests, and enforce our contracts.

Recruitment
To evaluate applications and manage the hiring process for candidates who apply to work at KarmaaLab.

7.1 We Do Not Sell Data

KarmaaLab does not sell, rent, or trade personal data to any third party for their own commercial purposes under any circumstances.

7.2 Within KarmaaLab

Data may be shared across KarmaaLab's internal teams (engineering, support, sales, finance, legal) strictly on a need-to-know basis for the purposes described in this Policy.

7.3 Service Providers and Subprocessors

We engage third-party service providers to support our operations including cloud infrastructure, payment processing, email delivery, analytics, and security monitoring. These providers process data only on our instructions under contractual data processing agreements and are prohibited from using data for their own purposes. A current list of our key subprocessors is available upon request.

7.4 Client-Directed Sharing

Within our products, clients may configure integrations with third-party systems. Any data shared through such integrations at the client's direction is the client's responsibility and subject to their agreements with those third parties.

7.5 Partners

Where KarmaaLab operates through channel partners or resellers, relevant commercial and contact information may be shared with the applicable partner to facilitate the client relationship. Such sharing is disclosed to clients at the time of engagement.

7.6 Legal and Regulatory Disclosure

We may disclose personal data where required by applicable law, court order, or regulatory authority in India or applicable jurisdictions. We will notify affected parties of such requests to the extent permitted by law.

7.7 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of KarmaaLab's business or assets, personal data may be transferred to the successor entity. Affected parties will be notified and data will remain subject to equivalent protections.

We retain personal data only for as long as necessary for the purposes for which it was collected and to meet our legal obligations:

Data CategoryRetention PeriodWebsite visitor and lead data24 months from last interactionClient contact and account dataDuration of relationship + 5 yearsUser account and session data24 months from last active loginProduct-processed client dataDuration of subscription + 60 days post-terminationFinancial and billing records7 years (statutory requirement)Candidate and recruitment data12 months from application close (or duration of employment)Legal communicationsDuration of dispute + applicable limitation period

Anonymised, aggregated data — from which no individual can be identified — may be retained indefinitely for analytics and benchmarking purposes.

KarmaaLab implements comprehensive technical and organisational measures to protect personal data:

Technical Measures

• Encryption of data at rest (AES-256) and in transit (TLS 1.3)

• Multi-factor authentication for internal systems access

• Role-based access controls with least-privilege principles

• Regular penetration testing and vulnerability assessments

• Automated threat detection and incident response systems

• Secure software development lifecycle with security reviews at each stage

Organisational Measures

• Data protection training for all staff with access to personal data

• Documented data handling procedures and access policies

• Vendor due diligence and contractual security requirements

• Designated data protection point of contact

• Data breach response plan with defined client notification timelines

In the event of a data breach affecting personal data, KarmaaLab will notify affected clients and, where required by law, relevant regulatory authorities without undue delay.

Individuals whose data KarmaaLab processes as a Data Fiduciary have the following rights under the DPDP Act, 2023 and applicable law:

Right to Access — Request confirmation of whether we hold your personal data and obtain a copy.

Right to Correction — Request correction of inaccurate, outdated, or incomplete personal data.

Right to Erasure — Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected or where you withdraw consent, subject to legal retention obligations.

Right to Grievance Redressal — Raise a complaint about our data handling practices and receive a timely response.

Right to Withdraw Consent — Where processing is based on consent, withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

Right to Nominate — Nominate an individual to exercise your data rights in the event of death or incapacity, as provided under the DPDP Act.

For data processed by KarmaaLab as a Data Processor on behalf of a client organisation, please contact your employer or the relevant client organisation directly, as they are the Data Fiduciary.

To exercise your rights as a Data Principal in relation to data held by KarmaaLab as Fiduciary, contact us at: privacy@karmaalab.com

We will respond to all verified requests within 30 days.

KarmaaLab's primary operations and data infrastructure are based in India. Where personal data is transferred to or processed in countries outside India, we ensure that appropriate safeguards are in place in accordance with the DPDP Act, 2023 and applicable data transfer regulations, including contractual protections with receiving entities.

KarmaaLab's products are designed for business and institutional use. We do not knowingly collect or process personal data relating to children under the age of 18 directly. Where our products are used by educational institutions to manage learner data that may include minors, such processing occurs under the authority and responsibility of the institution as Data Fiduciary, subject to appropriate consents obtained by the institution.

Our website and products may contain links to third-party websites or services. KarmaaLab is not responsible for the privacy practices of third-party sites. We encourage you to review the privacy policies of any third-party services you access through our platforms.

KarmaaLab may update this Privacy Policy periodically to reflect changes in our practices, products, or applicable law. Material changes will be communicated via email to registered contacts and via notice on our website at least 30 days before taking effect. The updated policy will display the revised effective date. Continued use of our Services after the effective date constitutes acceptance of the revised Policy.