97 Tech Center (“97 Tech Center,” “we,” “us,” or “our”) operates the website 97tech.com and provides Employer of Record (EOR), workforce management, and coworking services from our registered office at E301, Sky Park, Goregaon West, Mumbai, Maharashtra 400104, India.
This policy explains what personal information we collect, why we collect it, how we use and share it, and what rights you have. It applies to visitors to our website, prospective and current clients, employees and consultants engaged under our EOR services, coworking members, and applicants.
1. Who We Are and Our Role
Our role under data protection law depends on the relationship:
- As a business and website operator, we act as a Data Fiduciary (under India’s Digital Personal Data Protection Act, 2023) or Controller (under GDPR-style frameworks) for information we collect about website visitors, client contacts, coworking members, and job applicants.
- As an Employer of Record, we are the statutory employer of the individuals we engage on a client’s behalf, and we act as a Data Fiduciary/Controller for employment, payroll, and statutory compliance purposes. Where we process personal data solely on a client’s documented instructions in connection with their engagement, we act as a Data Processor for that data.
Where we act as a Processor, the client’s own privacy policy governs their use of that data, and our processing is governed by our services agreement with them.
2. Information We Collect
2.1 Website visitors
- Contact details you submit through forms (name, business email, phone number, company name)
- Message content and enquiry details
- Technical data such as IP address, browser type, device identifiers, referring URL, and pages visited
- Cookie and analytics data (see Section 8)
2.2 Clients and prospective clients
- Business contact details for your personnel
- Company registration and billing details
- Information about your headcount, roles, and compensation bands provided to scope an engagement
- Contract, invoicing, and payment records
2.3 Employees and consultants engaged under our EOR services
- Full name, date of birth, gender, photograph, and contact details
- Government identifiers required for statutory compliance, including PAN, Aadhaar, UAN, and ESIC number
- Bank account and payment details
- Employment history, qualifications, and background verification results where applicable
- Salary, benefits, tax, and payroll records
- Attendance, leave, and statutory contribution records
- Performance documentation, where the client has requested performance management support
- Emergency contact and nominee details for statutory benefit purposes
2.4 Coworking members and visitors
- Name, contact details, and organization
- Access credentials, entry logs, and CCTV footage from our premises
- Network usage logs associated with our IT infrastructure
- Billing and payment records
2.5 Job applicants
- CV/resume contents, qualifications, work history, and references
- Interview notes and assessment outcomes
We do not knowingly collect personal information from children under 18. We do not process special category or sensitive personal data beyond what is legally required for employment and statutory compliance.
3. Why We Process Your Information
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and providing quotes | Performance of a contract; legitimate interests |
| Delivering EOR, payroll, and workforce services | Performance of a contract; legal obligation |
| Statutory filings (PF, ESI, TDS, Professional Tax, Gratuity) | Legal obligation |
| Administering benefits and statutory leave | Contract; legal obligation |
| Managing coworking access, security, and IT services | Contract; legitimate interests |
| Invoicing, accounting, and tax records | Legal obligation |
| Site security, fraud prevention, and CCTV monitoring | Legitimate interests; legal obligation |
| Recruitment and candidate assessment | Consent; steps prior to a contract |
| Marketing communications to business contacts | Consent; legitimate interests |
| Improving our website and services | Legitimate interests; consent for non-essential cookies |
Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect processing already carried out, nor does it affect processing we are legally required to continue (for example, retention of statutory payroll records).
4. How We Share Information
We share personal information only where necessary, and with appropriate safeguards in place:
- Clients: Where we act as EOR, we share relevant employment, attendance, performance, and engagement information with the client who engages the individual.
- Government and statutory authorities: Including the Employees’ Provident Fund Organisation, ESIC, the Income Tax Department, and state labour authorities, as required by law.
- Service providers: Payroll processors, banking partners, benefits and insurance providers, background verification agencies, IT and cloud hosting providers, and professional advisors. These parties are bound by confidentiality and data protection obligations.
- Professional advisors: Legal, accounting, and audit professionals, where required.
- Corporate transactions: In connection with a merger, acquisition, or transfer of business, subject to equivalent protections.
- Legal requirements: Where disclosure is required by law, court order, or a valid regulatory request.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
5. International Transfers
We are based in India. If you are located outside India, including in the United States, the United Kingdom, or the European Economic Area, your information will be transferred to and processed in India.
Where we transfer personal data from a jurisdiction that restricts international transfers, we rely on appropriate safeguards, which may include standard contractual clauses, data processing agreements with our clients, or your explicit consent. Clients engaging our EOR services will typically enter into a data processing agreement with us that governs these transfers.
Where our clients or service providers are located outside India, we transfer data only to the extent permitted under applicable Indian law and our contractual commitments.
6. How Long We Keep Information
We retain personal information for as long as necessary to fulfil the purposes described above, and for the periods required by law:
| Category | Typical retention |
|---|---|
| Payroll and statutory employment records | As required under Indian labour and tax law, generally 7–8 years after the employment ends |
| Provident Fund and gratuity records | Per statutory requirements |
| Client contracts and invoices | 8 years from the end of the relevant financial year |
| Website enquiry and marketing data | Up to 3 years from last contact, or until you opt out |
| CCTV footage | Typically 30–90 days, unless retained for an active security or legal matter |
| Unsuccessful job applications | Up to 12 months, unless you ask us to delete sooner |
When retention periods expire, we securely delete or anonymise the information.
7. Your Rights
Depending on where you are located and the law that applies to you, you may have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate or incomplete information
- Request erasure of your information, subject to our legal retention obligations
- Withdraw consent where processing is based on consent
- Object to or restrict certain processing
- Request a copy of your information in a portable format
- Nominate another individual to exercise your rights in the event of death or incapacity (under India’s DPDP Act)
- Lodge a complaint with a supervisory authority, including the Data Protection Board of India
California residents additionally have rights to know, delete, correct, and opt out of sale or sharing under the CCPA/CPRA, and the right not to be discriminated against for exercising those rights. As noted, we do not sell or share personal information for advertising purposes.
To exercise any of these rights, contact us using the details in Section 11. We will respond within the timeframes required by applicable law. We may ask you to verify your identity before acting on a request.
If you are an employee or consultant engaged under our EOR services and your request concerns data held on a client’s instructions, we may need to refer your request to that client.
8. Cookies and Analytics
Our website uses cookies and similar technologies to operate the site, remember your preferences, and understand how the site is used. Essential cookies are necessary for the site to function. Analytics and marketing cookies are used only where permitted, and where required, only with your consent.
You can control cookies through your browser settings. Disabling certain cookies may affect site functionality.
9. Security
We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, including access controls, network segmentation and managed VLANs, encrypted transmission of payroll and banking data, CCTV and access control at our premises, confidentiality agreements with all personnel, and vendor due diligence.
No system is completely secure. If a personal data breach occurs that is likely to result in risk to affected individuals, we will notify the Data Protection Board of India and affected individuals as required by law, and will notify affected clients without undue delay.
10. Changes to This Policy
We may update this policy from time to time. The “last updated” date at the top reflects the most recent version. Where changes are material, we will provide reasonable notice through the website or directly for clients and engaged personnel.
11. Contact and Grievance Officer
For questions about this policy, to exercise your rights, or to raise a complaint about how we handle personal information:
97 Tech CenterE301, Sky Park, Goregaon West, Mumbai, Maharashtra 400104, India
Email: [email protected]
Phone: +91 8779509491
Grievance Officer (as required under Indian law):
Sandeep Walavalkar, Head of OperationsEmail: [email protected]
We will acknowledge grievances promptly and respond within the timeframe prescribed under applicable Indian law. If you are not satisfied with our response, you may escalate to the Data Protection Board of India, or to your local supervisory authority if you are outside India.