AUTOSCAL

1. Who We Are

Autoscal is a product and platform operated by Spark Eighteen Lifestyle Private Limited, a company incorporated under the laws of India, with its registered office at 4589, Sector B-5 & 6, Vasant Kunj, New Delhi – 110070, India. Spark Eighteen Lifestyle Private Limited is referred to in this Policy as "Autoscal", "we", "us", or "our". Autoscal is a cloud-based, multi-tenant Software-as-a-Service (SaaS) platform providing Human Resources, payroll, recruitment, project management, and workforce analytics services.

For privacy-related enquiries, please contact us at:

Data Protection Contact: DPO@sparkeighteen.com

Email: DPO@sparkeighteen.com

Address: 4589, Sector B-5 & 6, Vasant Kunj, New Delhi – 110070, India

2. Scope of This Policy

This Privacy Policy applies to all personal data processed through the Autoscal platform and governs the following categories of individuals:

• Tenant Administrators — Company HR/Admin personnel who configure and manage the platform on behalf of their organisation.
• Employees (Users) — Individuals onboarded by a tenant company as platform users.
• Managers — Team leads with approval authority over subordinate employees.
• Candidates — External job applicants who submit information via public-facing application forms.
• Super Administrators — Autoscal platform-level administrators (internal).

This Policy also covers data processed through third-party integrations (Fitbit, Google Calendar, Microsoft Outlook, Slack, Calendly, and others) where Autoscal acts as a data processor on behalf of the tenant company (data controller).

Autoscal implements data protection measures consistent with applicable privacy regulations, including the GDPR, India's DPDP Act 2023, and other relevant frameworks. Autoscal continuously reviews and enhances its privacy and security controls as the platform and regulatory landscape evolve.

3. Data Controller & Processor Distinction

Autoscal operates as a data processor on behalf of each tenant company, which acts as the data controller for their employees' personal data. This means:

• Each tenant company determines the purposes and means of processing employee data within the platform.
• Autoscal processes personal data solely on the documented instructions of the tenant.
• A Data Processing Agreement (DPA) is entered into with every tenant. Autoscal uses commercially reasonable efforts to ensure all data processing relationships are governed by appropriate contractual protections.
• Autoscal's Super Administrator role has platform-level access across all tenant organisations for platform maintenance, support, security, and compliance purposes only. Such access is governed by Autoscal's internal Super Administrator Access Policy, applying the minimum-necessary-access principle. Access is restricted to a limited number of authorised personnel, is subject to audit logging retained for a minimum of 12 months, and is exercised only to the extent necessary to fulfil the applicable operational purpose. Autoscal will notify the relevant tenant organisation prior to any Super Administrator access to their data, except where immediate access is required for security incident response or where prior notice is prohibited by law.

4. Data We Collect

5. How We Collect Data

We collect personal data through the following methods:

• Directly from you — When you register, complete profile forms, submit leave requests, upload documents, or interact with any platform feature.
• From your employer (tenant) — Your HR or Admin team may input or import your employment and payroll data.
• Via OAuth integrations — When you authorise connections to Google Calendar, Microsoft Outlook, Slack, or Fitbit, data is received from those platforms with your explicit consent.
• From third-party services — IFSC bank verification via Razorpay API, interview scheduling via Calendly, and meeting links via Zoom/Google Meet.
• Automatically — Login timestamps, IP addresses, and browser metadata are captured by backend systems for security and audit purposes.
• From public forms — Candidates submit data via unauthenticated public application forms without requiring a platform account.

6. Why We Process Your Data (Purpose & Lawful Basis)

We process personal data only where we have a lawful basis to do so. The following table sets out our lawful bases per data category. For users located in India, processing is carried out in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable lawful uses under Indian law. Where required under the DPDP Act, 2023, consent shall be free, specific, informed, unconditional, and capable of being withdrawn by the Data Principal at any time.

7. Third-Party Services & Data Sharing

We share data with third-party providers only where necessary to deliver platform functionality. Autoscal does not sell personal data and does not share personal data for cross-context behavioural advertising. Autoscal uses commercially reasonable efforts to ensure third-party providers maintain appropriate data protection standards, whether via formal Data Processing Agreements (DPAs), standard contractual terms, or equivalent mechanisms. Autoscal is not responsible for the privacy or security practices of third-party services once data is transmitted to or processed by those services under the user's instruction.

Note: Each integrated third-party service is governed by its own Terms of Service and Privacy Policy. We encourage you to review those policies. By using integrated features, you also agree to the applicable third-party terms.

8. File Uploads & Storage

The platform accepts and stores the following types of files:

• Profile photographs
• Candidate resumes (PDF, DOC formats)
• Reimbursement receipts (images, PDF)
• Client documents (MSA, SOW, Rate Cards)
• Payslips (system-generated PDFs)
• Exit documents (relieving letters, NOC)
• Internal policy documents and onboarding materials

All files are stored in secure cloud object storage on Amazon Web Services (AWS ap-south-1, Mumbai, India). Access to files is controlled via time-limited presigned URLs with expiration. File access is role-gated under our RBAC system, designed to ensure users can access only files they are authorised to view.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Policy, or as required by applicable law.

10. Your Privacy Rights

Depending on your location and applicable data protection laws (including GDPR, India's DPDP Act 2023, CCPA, and equivalent laws), you may have the following rights in relation to your personal data:

• Right to Access — You may request a copy of all personal data we hold about you.
• Right to Rectification — You may request correction of inaccurate or incomplete personal data.
• Right to Erasure (‘Right to be Forgotten’) — You may request deletion of your personal data, particularly for health and wellness data. Where erasure cannot be completed in full due to legal or contractual retention obligations, we will provide you with a written explanation identifying the specific legal basis for retention and the categories of data affected.
• Right to Data Portability — You may request your personal data in a structured, commonly used, machine-readable format.
• Right to Restrict Processing — You may request that we limit how we use your personal data in certain circumstances.
• Right to Object — You may object to processing based on legitimate interests, including participation in wellness or analytics programmes.
• Withdrawal of Consent — Where processing is based on your consent (e.g., Fitbit, Google Calendar, Slack), you may withdraw consent at any time by disconnecting the integration within your account settings. Withdrawal does not affect lawfulness of prior processing.
• Right to Lodge a Complaint — You have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction if you believe your data has been mishandled.

To exercise any of these rights, please contact us at DPO@sparkeighteen.com. We will respond within 30 days of receiving your request, in accordance with applicable law.

11. Health & Biometric Data — Special Provisions

The wellness and health tracking module on Autoscal involves the collection of special category data as defined under GDPR Article 9 and equivalent regulations. The following provisions apply:

12. Candidate & Job Applicant Provisions

If you are a job candidate submitting an application via Autoscal's public-facing forms, the following applies:

• Data collected includes: name, email address, phone number, resume/CV, education history, and work experience.
• A consent checkbox is presented on the application form before submission. By submitting your application, you consent to the processing of your data for recruitment purposes.
• Candidate data is accessible only by the tenant company to which you applied. It is not accessible by other tenant organisations on the platform.
• Your data will be retained for a maximum of 1 year following rejection or withdrawal of application, after which it will be securely deleted unless you consent to being considered for future roles.
• You may request deletion of your candidate data at any time by contacting DPO@sparkeighteen.com.

13. Security Measures

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

• HTTPS / TLS encryption — All data in transit between your browser and our servers is encrypted using TLS.
• Password hashing — Passwords are never stored in plain text; they are stored using industry-standard hashing algorithms.
• JWT bearer token authentication — Secure session management using JSON Web Tokens.
• Role-Based Access Control (RBAC) — Over 90 granular permission scopes (VIEW / CREATE / EDIT / DELETE) ensure users access only data relevant to their role.
• Multi-tenancy data isolation — Multi-tenant architecture designed to maintain data separation between tenant organisations at the application level.
• Presigned URLs with expiration — File access is controlled via time-limited URLs.
• OAuth 2.0 — Industry-standard protocol for all third-party integrations.
• Encryption at rest — Data stored on our cloud infrastructure is encrypted at rest using industry-standard encryption mechanisms supported by our cloud infrastructure provider (AWS ap-south-1, Mumbai, India).

Despite our best efforts, no security system is impenetrable. In the event of a data breach that is likely to result in a risk to your rights and freedoms, where legally required, Autoscal will notify the relevant supervisory authority and affected users without undue delay and within applicable legal timelines (which may include 72 hours under GDPR or equivalent periods under other applicable laws).

While Autoscal implements commercially reasonable safeguards, the platform is provided on an ‘as available’ basis and uninterrupted or error-free operation cannot be guaranteed. Autoscal shall not be liable for any loss or damage arising from temporary unavailability of the platform due to maintenance, infrastructure issues, or circumstances beyond its reasonable control.

14. Cookies & Local Storage

Autoscal uses secure session management mechanisms to maintain authenticated sessions. Session tokens are cleared upon logout. Autoscal does not currently use advertising cookies or cross-site tracking technologies.

Note: Session tokens are cleared upon logout. Autoscal evaluates authentication and session management mechanisms in line with evolving security standards and will update this Policy to reflect material changes. Users are responsible for maintaining the security of devices used to access the platform.

15. AI Assistant

Autoscal includes an AI-powered chat assistant within the platform. When you use the AI Assistant:

• Your query text is transmitted to Autoscal's AI backend service for processing. Query content may be processed by a third-party AI model provider acting as an approved sub-processor under a Data Processing Agreement. The identity of the applicable AI provider will be listed in our Sub-processor Register, available on request.
• Query content may include information you voluntarily type into the assistant interface.
• We do not use your queries to train AI models without your explicit consent.
• Query logs are retained for a period of 30 days for security, debugging, and quality monitoring purposes, after which they are securely deleted.
• The AI Assistant can be enabled or disabled by your Tenant Administrator in platform settings.

16. International Data Transfers

Autoscal's primary data hosting is on Amazon Web Services (AWS ap-south-1, Mumbai, India), meaning your data is stored within India. Certain third-party integrations (such as Fitbit, Google, Microsoft, and Slack) may process data outside India. Where data is transferred internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
• Compliance with cross-border transfer provisions under India's Digital Personal Data Protection Act 2023 (DPDP Act), where applicable.
• Data Processing Agreements (DPAs) with all third-party processors.
• Verification that recipient countries provide an adequate level of data protection, or alternative transfer mechanisms are in place.

17. Children's Privacy

The Autoscal platform is not designed for or directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted personal data through our platform, please contact us immediately at DPO@sparkeighteen.com and we will take steps to delete such data promptly.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Notify all active users via email and/or in-platform notification prior to the change taking effect.
• Update the ‘Effective Date’ at the top of this document.
• Where required by law, obtain fresh consent from affected users.

We encourage you to review this Policy periodically. Continued use of the platform after the effective date of an updated Policy constitutes acceptance of changes that do not materially affect your rights or the basis on which we process your personal data. Where a material change affects the lawful basis for processing personal data or introduces new categories of processing, we will seek your explicit consent before the change takes effect, where required by applicable law. Continued use of the platform shall not be deemed to constitute consent to such material changes.

19. Contact Us & How to Exercise Your Rights

For any questions, concerns, or requests relating to your personal data or this Privacy Policy, please contact:

We will acknowledge your request within 5 business days and provide a full response within 30 days of receiving your request, in accordance with applicable law. This Privacy Policy is governed by the laws of the Republic of India. Any disputes arising from this Policy shall be subject to the exclusive jurisdiction of the courts of New Delhi, India. Where requests are complex or numerous, we may extend this period by a further 60 days; we will inform you of any such extension within the initial 30-day period, stating the reasons for the delay, as required by applicable law.