Privacy Policy

1. INTRODUCTION

AAPNA INFOTHEEK PRIVATE LIMITED (“AAPNA“, “we“, “our“, or “us“) is committed to protecting the privacy, confidentiality, and security of information processed through Mera Work and its related websites, applications, software, products, and services.

Mera Work is a workforce productivity intelligence platform that enables organisations to manage workforce productivity, attendance, application and website usage, activity, screenshots, reporting, and related workplace information.

This Privacy Policy explains how AAPNA collects, uses, processes, stores, protects, retains, and discloses information when you:

• visit our website;
• create or access an account;
• use Mera Work;
• use our applications or software;
• request a demonstration or trial;
• contact our sales or support teams;
• participate in implementation or onboarding activities; or
• otherwise interact with AAPNA or Mera Work.

This Privacy Policy should be read together with the following policies and terms published on the Mera Work website, as applicable:

• Terms of Service
• Service Level Agreement (SLA)
• Cancellation and Refund Policy
• Shipping and Exchange Policy

Certain customers, particularly enterprise customers, may also enter into additional contractual documents with AAPNA, such as an Enterprise Subscription Agreement, Enterprise Software License & Support Agreement, or other applicable agreements. Where such documents apply, they may contain specific provisions governing data processing, security, confidentiality, retention, service levels, and other matters.

In the event of any inconsistency between this Privacy Policy and an applicable executed Customer agreement, the executed Customer agreement shall prevail to the extent of the inconsistency.

2. ABOUT AAPNA

Mera Work is provided by:

AAPNA INFOTHEEK PRIVATE LIMITED

Registered Office:
57, Charak Sadan, Vikas Puri,
New Delhi – 110018, India

For privacy-related questions or requests:

Email: support@mera.work
Website: https://mera.work

3. SCOPE

This Privacy Policy applies to information processed by AAPNA in connection with:

• Mera Work;
• the Mera Work website;
• Mera Work applications and software;
• desktop applications and agents;
• free trials and demonstrations;
• customer onboarding and implementation;
• technical support;
• professional services;
• sales and business communications;
• customer and user accounts; and
• other services provided by AAPNA.

This Privacy Policy applies to both:

• Cloud-hosted (SaaS) deployments; and
• Customer-hosted (On-Premise) deployments,

subject to the responsibilities described in this Privacy Policy and any applicable Customer agreement.

4. ROLES OF AAPNA AND THE CUSTOMER

For Customer Data processed through Mera Work on behalf of an organisation, unless otherwise required by applicable law:

• the Customer acts as the Data Controller, Data Fiduciary, or equivalent entity under applicable law; and
• AAPNA acts as the Data Processor or equivalent service provider to the extent AAPNA processes Personal Data on behalf of the Customer.

The Customer is responsible for:

• determining the purposes of data collection and processing;
• determining the lawful basis for processing;
• determining which Personal Data is processed through Mera Work;
• configuring Mera Work appropriately;
• providing legally required privacy notices;
• obtaining required permissions, approvals, or consents;
• informing employees and users about applicable data processing; and
• complying with applicable employment, labour, workplace monitoring, privacy, cybersecurity, and data protection laws.

AAPNA does not determine the Customer’s employment, workforce management, monitoring, or business purposes for using Mera Work.

AAPNA does not provide legal, employment, HR, regulatory, or compliance advice.

Where AAPNA processes Personal Data directly for its own purposes, such as website enquiries, sales communications, account management, billing, security, or business administration, AAPNA may act as the Controller or equivalent entity under applicable law.

5. INFORMATION WE COLLECT

Depending on how you interact with AAPNA and Mera Work, we may collect and process the following categories of information.

5.1 Account and Business Information

This may include:

• name;
• work email address;
• telephone number;
• designation;
• organisation name;
• business address;
• account identifiers;
• login credentials;
• authentication information;
• billing information; and
• information provided during account registration or onboarding.

5.2 Device and Technical Information

This may include:

• device type;
• device identifiers;
• operating system;
• IP address;
• browser information;
• application version;
• network information;
• system configuration;
• diagnostic information;
• error logs; and
• system performance information.

5.3 Workforce and Activity Information

Depending on the Customer’s configuration and use of Mera Work, the platform may process:

• employee or user information;
• attendance records;
• application usage;
• website usage;
• login and logout information;
• productivity metrics;
• activity information;
• screenshots;
• screen monitoring information;
• live monitoring information;
• activity logs;
• productivity reports;
• device information; and
• other information configured or uploaded by the Customer.

The Customer determines which categories of Personal Data are processed through Mera Work.

5.4 Support and Communication Information

This may include:

• support tickets;
• service requests;
• email communications;
• meeting information;
• technical troubleshooting information;
• feedback;
• survey responses; and
• other communications with AAPNA.

5.5 Customer-Provided Information

Customers may upload, submit, or otherwise process documents, files, records, reports, images, screenshots, employee information, or other information through Mera Work.

Such information may constitute Customer Data and is generally processed by AAPNA on behalf of the Customer in accordance with the applicable agreement.

6. HOW WE USE INFORMATION

AAPNA may process information for the following purposes.

6.1 Providing Mera Work

We may process information to:

• provide Mera Work functionality;
• create and manage accounts;
• authenticate users;
• provide workforce productivity functionality;
• provide attendance and activity functionality;
• generate reports and analytics;
• provide dashboards;
• maintain system availability;
• deliver purchased services; and
• provide implementation and onboarding services.

6.2 Technical Support and Maintenance

We may process information to:

• provide technical support;
• investigate incidents;
• troubleshoot technical issues;
• diagnose software problems;
• maintain service reliability;
• provide software maintenance;
• provide Updates and Upgrades; and
• respond to customer requests.

6.3 Security and Fraud Prevention

We may process information to:

• detect unauthorised access;
• prevent misuse;
• investigate security incidents;
• protect the security and integrity of Mera Work;
• monitor system performance;
• identify vulnerabilities;
• prevent fraud or abuse; and
• enforce applicable contractual and security requirements.

6.4 Product Improvement

Subject to applicable law and contractual restrictions, AAPNA may process technical, diagnostic, statistical, aggregated, anonymised, or de-identified information to:

• improve Mera Work;
• improve performance and reliability;
• develop new functionality;
• analyse product usage trends;
• improve security; and
• develop analytics and product capabilities.

AAPNA does not sell Customer Data or use Customer Data for advertising purposes.

Where reasonably practicable, AAPNA will use aggregated, anonymised, or de-identified information for product improvement and analytics.

6.5 Business and Administrative Purposes

We may also process information for:

• billing and payment processing;
• contract administration;
• account management;
• maintaining business records;
• responding to lawful requests;
• complying with applicable laws;
• protecting our legal rights; and
• managing corporate operations.

7. LEGAL BASIS FOR PROCESSING

Depending on applicable law and the circumstances, AAPNA may process Personal Data based on:

• performance of a contract;
• compliance with legal obligations;
• legitimate business interests where legally permitted;
• consent;
• Customer instructions; or
• another lawful basis available under applicable law.

Where AAPNA processes Personal Data on behalf of a Customer, the Customer remains responsible for determining the appropriate lawful basis for its processing activities.

8. CUSTOMER DATA AND OWNERSHIP

Customer Data remains the property and under the control of the Customer.

AAPNA does not claim ownership of Customer Data.

AAPNA may access or process Customer Data only to the extent reasonably necessary to:

• provide the contracted services;
• perform implementation;
• provide support;
• troubleshoot technical issues;
• perform maintenance;
• provide Professional Services;
• provide Updates and Upgrades;
• maintain security;
• comply with applicable law; or
• perform other activities authorised by the Customer or permitted under the applicable agreement.

AAPNA may create and use aggregated, anonymised, or de-identified information that does not identify the Customer or an individual user for legitimate business purposes including service improvement, analytics, security, product development, and statistical analysis.

9. SAAS AND ON-PREMISE DATA RESPONSIBILITIES

9.1 SaaS Deployment

For Cloud-hosted SaaS deployments, AAPNA is responsible for security and operational controls within infrastructure under AAPNA’s control, including, as applicable:

• application security;
• hosting infrastructure;
• managed databases;
• software updates;
• security patches;
• infrastructure security;
• platform monitoring; and
• operational security controls.

The Customer is responsible for:

• user account management;
• password security;
• endpoint security;
• internet connectivity;
• internal access management;
• Customer configurations; and
• Customer Data exported from the platform.

9.2 On-Premise Deployment

For Customer-hosted On-Premise deployments, Customer Data remains within the Customer Environment and under the Customer’s control, except where AAPNA temporarily accesses or stores Customer Data for agreed implementation, support, troubleshooting, migration, or other Services.

AAPNA is responsible for the security of the Licensed Software, including, as applicable:

• software security;
• software updates;
• security patches;
• bug fixes;
• authentication and authorisation mechanisms within the Licensed Software;
• secure software development practices; and
• technical support.

The Customer is responsible for the security and operation of its Customer Environment, including:

• servers;
• operating systems;
• databases;
• storage;
• networking;
• firewalls;
• VPN configuration;
• Active Directory or identity services;
• SSL certificates;
• endpoint security;
• backup and disaster recovery;
• internet connectivity; and
• other infrastructure within the Customer Environment.

AAPNA shall not be responsible for Security Incidents originating solely from vulnerabilities, failures, misconfiguration, or compromise within the Customer Environment.

10. DATA STORAGE AND LOCATION

For SaaS deployments, Customer Data may be stored and processed using infrastructure operated by AAPNA or its authorised service providers.

Data may be hosted or processed in India or other jurisdictions where reasonably necessary for:

• service delivery;
• infrastructure operations;
• system reliability;
• technical support;
• redundancy;
• business continuity; or
• disaster recovery.

For On-Premise deployments, Customer Data remains within the Customer Environment except where otherwise expressly agreed or temporarily accessed by AAPNA for the provision of Services.

11. DATA RETENTION

11.1 SaaS Deployment

Unless otherwise agreed in the applicable Order Form or contractual agreement, Customer Data is retained on a rolling ninety (90) day basis during the active Subscription Term.

Accordingly, Customer Data older than ninety (90) days may be automatically deleted from the production environment as part of Mera Work’s standard data retention policy.

The Customer may export available Customer Data using the data export functionality available within Mera Work.

Following termination or expiry of a SaaS subscription, the Customer may export available Customer Data for the period specified in the applicable agreement or Order Form. After that period, AAPNA may securely delete or permanently anonymise remaining Customer Data unless retention is required by applicable law or otherwise agreed in writing.

11.2 On-Premise Deployment

Customer Data remains within the Customer Environment and under the Customer’s control.

The Customer is responsible for:

• data retention;
• backup;
• archival;
• restoration;
• deletion; and
• compliance with applicable record retention requirements.

AAPNA does not automatically delete Customer Data stored within the Customer Environment.

Where AAPNA temporarily stores Customer Data for support, troubleshooting, migration, implementation, or other agreed Services, such data shall be securely deleted upon completion of the applicable Services unless otherwise agreed in writing or required by applicable law.

12. DATA SECURITY

AAPNA maintains administrative, technical, and organisational measures designed to protect information against unauthorised access, disclosure, alteration, destruction, loss, or misuse.

Depending on the applicable service and deployment model, security measures may include:

• encryption of data in transit using industry-standard protocols;
• encryption of stored data where supported;
• role-based access controls;
• authentication and authorisation controls;
• secure password management;
• security logging and monitoring;
• vulnerability management;
• secure software development practices;
• infrastructure monitoring where applicable;
• controlled administrative access;
• backup and recovery controls; and
• personnel confidentiality obligations.

AAPNA may improve or modify these measures from time to time to address evolving security risks, technologies, product functionality, and operational requirements.

No system or method of electronic transmission or storage can be guaranteed to be completely secure.

13. CONFIDENTIALITY

AAPNA requires employees, contractors, and authorised service providers who have access to Customer Data to be subject to appropriate confidentiality obligations.

Access to Customer Data is limited to personnel who require such access for providing the Services or performing authorised business or operational functions.

14. SUBPROCESSORS AND THIRD-PARTY SERVICE PROVIDERS

AAPNA may engage trusted third-party service providers and Subprocessors where reasonably necessary to provide Mera Work and related Services.

Such providers may support:

• cloud hosting;
• infrastructure;
• storage;
• communications;
• customer support;
• payment processing;
• analytics;
• security;
• monitoring;
• email delivery; and
• other operational functions.

AAPNA shall exercise reasonable care in selecting relevant service providers and shall require appropriate confidentiality and security obligations where applicable.

AAPNA remains responsible for its Subprocessors to the extent required by applicable law and the applicable Customer agreement.

Upon reasonable written request, AAPNA may provide information regarding the categories of Subprocessors used in delivering the applicable Services.

15. SECURITY INCIDENTS

AAPNA maintains procedures for identifying, investigating, responding to, and managing Security Incidents.

If AAPNA becomes aware of a confirmed Security Incident affecting Customer Data under AAPNA’s control, AAPNA shall, subject to applicable law and the applicable Customer agreement:

• notify the affected Customer without undue delay;
• investigate the Security Incident;
• use commercially reasonable efforts to contain and mitigate its impact;
• implement appropriate corrective actions; and
• provide reasonable updates as information becomes available.

For On-Premise deployments, AAPNA shall not be responsible for Security Incidents originating solely within the Customer Environment.

Notification of a Security Incident shall not constitute an admission of liability.

16. INTERNATIONAL DATA TRANSFERS

Information may be transferred across geographic regions where reasonably necessary for:

• service delivery;
• system reliability;
• technical support;
• infrastructure operations;
• business continuity;
• disaster recovery; or
• other legitimate business purposes.

Where Customer Data is transferred across national borders, AAPNA and the Customer shall comply with applicable laws governing such transfers.

Where required by applicable law, appropriate safeguards shall be implemented for such transfers.

17. CUSTOMER AND DATA SUBJECT RIGHTS

Subject to applicable law and the applicable agreement, Customers may:

• request reasonable information regarding AAPNA’s security practices;
• request assistance relating to Security Incidents;
• request reasonable assistance relating to lawful data subject requests;
• export available Customer Data from SaaS deployments; and
• access Customer Data stored within the Customer Environment for On-Premise deployments.

Where AAPNA processes Personal Data on behalf of a Customer, individuals should generally direct requests concerning Customer-controlled Personal Data to the relevant Customer or organisation.

AAPNA may provide reasonable assistance to Customers in responding to lawful requests, subject to applicable law, confidentiality, security considerations, and the applicable agreement.

Additional assistance beyond standard support may be provided as Professional Services.

18. COOKIES AND WEBSITE TECHNOLOGIES

The Mera Work website may use cookies, pixels, tags, analytics technologies, and similar technologies to:

• operate the website;
• remember preferences;
• understand website usage;
• measure performance;
• improve user experience;
• analyse marketing effectiveness; and
• maintain website security.

Third-party services used on our website may also use cookies or similar technologies in accordance with their own privacy policies.

Where required by applicable law, appropriate cookie controls or consent mechanisms will be provided.

19. SALES, MARKETING AND BUSINESS COMMUNICATIONS

If you contact AAPNA, request a demo, start a trial, download resources, participate in an event, or otherwise interact with our sales or marketing activities, we may process information such as:

• name;
• business email;
• telephone number;
• organisation;
• designation;
• communication history; and
• information relevant to your business requirements.

We may use this information to:

• respond to enquiries;
• arrange demonstrations;
• provide requested information;
• manage trials;
• provide onboarding;
• communicate about our products and services; and
• conduct legitimate business development activities.

Where permitted by applicable law, we may send promotional communications.

You may opt out of promotional communications using the unsubscribe mechanism provided in the communication or by contacting us.

Opting out of marketing communications will not prevent us from sending transactional, security, service, or contractual communications that are necessary to provide the requested Services.

20. PAYMENTS AND BILLING

Where you purchase services from AAPNA, billing and payment information may be processed by AAPNA and, where applicable, third-party payment processors.

This may include:

• billing contact information;
• billing address;
• transaction details;
• invoice information;
• payment status; and
• information necessary for financial administration.

Payment card information may be processed directly by third-party payment providers where applicable and may not be stored by AAPNA in full.

21. CHILDREN’S DATA

Mera Work is designed for business and organisational use and is not intended for children under eighteen (18) years of age.

AAPNA does not knowingly collect Personal Data directly from children through its public website or services.

Where a Customer uses Mera Work to process information relating to individuals under eighteen (18), the Customer is responsible for ensuring that such processing is lawful and complies with applicable requirements.

22. DATA ACCURACY

AAPNA relies on Customers and users to provide accurate and current information.

Where AAPNA processes Customer Data on behalf of a Customer, the Customer is responsible for the accuracy, completeness, legality, and integrity of that Customer Data.

AAPNA does not independently verify Customer Data unless expressly required as part of the contracted Services.

23. CUSTOMER CONFIGURATION AND USE

Mera Work provides configurable functionality that may allow Customers to determine:

• which users are monitored;
• which information is collected;
• monitoring frequency;
• screenshot and activity collection;
• access permissions;
• retention settings where available;
• reporting configurations; and
• administrator access.

The Customer is responsible for configuring and using Mera Work appropriately and lawfully.

AAPNA is not responsible for unlawful, excessive, inappropriate, or unauthorised processing resulting from Customer configuration, Customer instructions, or Customer use of the platform.

24. DISCLOSURE OF INFORMATION

AAPNA may disclose information where reasonably necessary to:

• provide the requested Services;
• comply with applicable legal obligations;
• respond to lawful governmental or regulatory requests;
• protect the rights, property, or security of AAPNA, its customers, users, or others;
• prevent fraud, abuse, or security threats;
• enforce applicable agreements; or
• operate the business through authorised service providers.

AAPNA does not sell Customer Data.

AAPNA does not use Customer Data for advertising purposes.

25. BUSINESS TRANSFERS

If AAPNA undergoes a merger, acquisition, restructuring, financing, sale of assets, or similar corporate transaction, information relevant to the business may be transferred to the relevant successor or acquiring entity, subject to applicable law and appropriate confidentiality and security protections.

26. RECORD RETENTION AND LEGAL REQUIREMENTS

AAPNA may retain information for as long as reasonably necessary to:

• provide Services;
• maintain business and financial records;
• comply with legal obligations;
• resolve disputes;
• enforce agreements;
• prevent fraud;
• maintain security; or
• establish, exercise, or defend legal claims.

Retention periods may vary depending on the nature of the information, applicable law, contractual obligations, and operational requirements.

27. COMPLIANCE AND CERTIFICATIONS

AAPNA maintains an information security program appropriate to the Services it provides.

AAPNA supports compliance with applicable privacy and security laws, including the Digital Personal Data Protection Act, 2023 (India), to the extent applicable to AAPNA’s role and obligations.

AAPNA may obtain or maintain additional certifications, assessments, or compliance frameworks from time to time.

Nothing in this Privacy Policy constitutes a representation that AAPNA currently holds a particular certification or compliance status unless expressly confirmed in writing.

The Customer remains responsible for determining the regulatory and legal requirements applicable to its own processing activities and use of Mera Work.

28. SECURITY AND PRIVACY DUE DILIGENCE

Customers may request reasonable information regarding AAPNA’s privacy and security practices for legitimate vendor due diligence purposes.

Subject to confidentiality and security considerations, AAPNA may provide:

• security questionnaires;
• policy summaries;
• compliance documentation;
• available certifications;
• audit reports approved for customer sharing; and
• other reasonable security information.

AAPNA shall not be required to disclose:

• source code;
• confidential security configurations;
• information relating to other customers;
• information that could reasonably compromise the security of the Services; or
• other confidential information that AAPNA is not permitted to disclose.

Additional audit, assessment, or security assistance may be provided as Professional Services.

29. CUSTOMER RESPONSIBILITIES

Customers are responsible for:

• ensuring lawful use of Mera Work;
• determining the lawful basis for their processing activities;
• configuring system settings appropriately;
• informing employees and users about applicable data collection and processing;
• obtaining required permissions, approvals, or consents;
• managing user access permissions;
• maintaining appropriate endpoint security;
• maintaining Customer infrastructure for On-Premise deployments;
• maintaining appropriate backups where applicable;
• complying with applicable laws; and
• ensuring that Customer Data submitted to Mera Work may lawfully be processed.

AAPNA is not responsible for unlawful configuration, misuse, unauthorised monitoring, or unlawful processing by a Customer or its users.

30. THIRD-PARTY WEBSITES AND SERVICES

Mera Work may contain links to third-party websites, services, or applications.

AAPNA does not control and is not responsible for the privacy practices, content, security, or policies of third-party services.

Users should review the applicable privacy policies of third-party services before providing Personal Data to them.

31. CHANGES TO THIS PRIVACY POLICY

AAPNA may update this Privacy Policy from time to time to reflect:

• changes in applicable laws;
• changes to Mera Work;
• changes in security practices;
• changes in business operations;
• new features or services;
• changes in third-party service providers; or
• other operational requirements.

Updated versions will be published on the official Mera Work website with the revised “Last Updated” date.

Where required by applicable law, AAPNA will provide additional notice or obtain consent for material changes.

32. CONTRACTUAL DOCUMENTS AND PRECEDENCE

This Privacy Policy provides a general description of AAPNA’s privacy practices.

Certain customers, particularly enterprise customers, may have additional contractual documents governing their relationship with AAPNA, including an Enterprise Subscription Agreement, Enterprise Software License & Support Agreement, Order Form, Data Processing & Security Addendum (DPSA), SLA, or other applicable agreements.

Where such documents apply, the specific terms contained in the applicable executed agreement shall govern the relevant relationship and processing activities.

In the event of any inconsistency between this Privacy Policy and an applicable executed Customer agreement, the executed Customer agreement shall prevail to the extent of the inconsistency.

33. CONTACT US

For privacy, data protection, or security-related questions, requests, or concerns, please contact:

AAPNA INFOTHEEK PRIVATE LIMITED
Email: support@mera.work
Website: https://mera.work

When contacting us regarding a Customer account or Customer Data, please provide sufficient information for us to identify the relevant Customer organisation and request.