Trust Center · Legal
Certyze Platform Privacy Notice
Effective 19 October 2026. Questions: legal@thinkdatalabs.com
1. About This Notice
This Privacy Notice is effective as of 19 October 2026.
Thinkdata Labs LLP (LLPIN AAI-9081, GSTIN 06AAMFT4128J2ZW), with its registered office at 176 First Floor, Sector-10, Panchkula, Haryana 134112, India, operates the Certyze platform accessible at app.certyze.com. Certyze is a business-to-business software-as-a-service (B2B SaaS) platform designed for Conformity Assessment Bodies (CABs).
This Notice describes how Personal Data is collected, used, stored, shared, and protected through the Platform. It applies to all individuals whose Personal Data is processed on or through the Platform, including CAB administrators, franchisees and representatives, CAB end-client personnel, Thinkdata Labs support personnel, and auditors whose records appear within the Platform regardless of whether those auditors hold a direct login.
By accessing or using the Platform, or by having Personal Data recorded on the Platform by a subscribing CAB, you acknowledge the practices described in this Notice. Defined terms used herein carry the meanings set out in Section 2 (Definitions).
2. Definitions
In this Notice, the following capitalised terms have the meanings set out below.
| Term | Definition |
|---|---|
Auditor | An individual whose records appear on the Platform in connection with audit or assessment activities, whether or not that individual holds a direct login. |
CAB | A Conformity Assessment Body that subscribes to the Platform. |
Data Fiduciary / Controller | The entity that determines the purposes and means of processing Personal Data, as defined under applicable data-protection law. |
Data Processor / Processor | The entity that processes Personal Data on behalf of, and on documented instructions from, a Data Fiduciary / Controller. |
End-Client Personnel | Personnel of a CAB’s end-client whose data is processed through the Platform. |
Personal Data | Any information relating to an identified or identifiable natural person. |
Platform | The Certyze application accessible at app.certyze.com and associated services. |
Subprocessor | A third party engaged by Thinkdata Labs LLP to process Personal Data on behalf of a CAB. |
User | Any individual who accesses or uses the Platform, including CAB administrators, franchisees and representatives, End-Client Personnel, and Thinkdata Labs support personnel. |
3. User Categories
The Platform recognises the following categories of individuals whose Personal Data may be processed:
CAB Administrators: personnel of a subscribing CAB who hold administrative privileges on the Platform, including account configuration, user management, and oversight of certification workflows.
Franchisees and Representatives: individuals operating under a CAB’s franchise, branch, or agency arrangement who access the Platform to perform delegated certification or operational functions.
CAB End-Client Personnel: individuals associated with an organisation that has applied for or holds certification from a CAB, whose data is recorded in connection with applications, audits, non-conformities, or certificates.
Thinkdata Labs Support Personnel: employees or authorised agents of Thinkdata Labs LLP who access the Platform for the purposes of technical support, maintenance, or account administration.
Auditors may have records (including identity, competency, conflict-of-interest declarations, and scheduling data) stored within the Platform by a subscribing CAB, even where no direct login credential is currently enabled for such auditors. Where auditor records are present, the applicable provisions of this Notice apply to that Personal Data.
4. Role Allocation: Data Fiduciary/Controller and Data Processor/Processor
4.1 The allocation of data-protection roles between Thinkdata Labs LLP and each subscribing CAB depends on the category of Personal Data and the purpose of processing.
| Processing Activity | Data Fiduciary / Controller | Data Processor / Processor |
|---|---|---|
CAB workflow data (applications, audits, evidence, non-conformities, certificates, competency records, conflict declarations, scheduling, and related end-client and auditor records) | Subscribing CAB | Thinkdata Labs LLP |
Contracting, billing, and payment metadata | Thinkdata Labs LLP | Not applicable (independent controller) |
Account security and access logs | Thinkdata Labs LLP | Not applicable (independent controller) |
Business contact data for CAB administrators and representatives | Thinkdata Labs LLP | Not applicable (independent controller) |
Legal compliance records | Thinkdata Labs LLP | Not applicable (independent controller) |
Direct platform support data | Thinkdata Labs LLP | Not applicable (independent controller) |
4.2 Where Thinkdata Labs LLP acts as Data Processor, it processes CAB workflow data solely on the documented instructions of the subscribing CAB, unless processing is required by applicable law.
4.3 Where Thinkdata Labs LLP acts as independent Data Fiduciary or Controller, it determines the purposes and means of processing for the categories identified above and is directly responsible for compliance with applicable data-protection obligations in respect of that data.
5. Categories of Personal Data Collected
The Platform may process the following categories of Personal Data, depending on the User category and the features used by the subscribing CAB:
| Category | Examples of Data Elements |
|---|---|
Identity | Full name, photograph, signature, government-issued identifier references |
Role | Job title, designation, organisational affiliation, user-role assignment within the Platform |
Contact | Email address, telephone number, postal address |
Application | Application forms, supporting documents submitted by End-Client Personnel |
Audit | Audit plans, audit reports, findings, observations |
Evidence | Documents, photographs, or files uploaded as audit evidence |
Non-Conformity | Non-conformity reports, corrective action records |
Competency | Qualifications, training records, auditor competency assessments |
Conflict-of-Interest Declarations | Impartiality and conflict declarations submitted by auditors or personnel |
Scheduling | Audit dates, availability, calendar entries, assignment records |
Certificate | Certificate numbers, scope, issuance and expiry dates, certificate status |
Payment Metadata | Transaction references, invoice identifiers, payment status (card or bank details are processed by Razorpay and are not stored on the Platform) |
Usage Analytics | Feature-usage logs, session duration |
Access Logs | Login timestamps, IP addresses, browser and device identifiers |
Security Logs | Authentication events, permission changes, anomaly alerts |
6. Purposes of Processing
Thinkdata Labs LLP and, where applicable, the subscribing CAB process Personal Data for the following purposes:
CAB workflow operations: facilitating applications, audits, evidence collection, non-conformity management, competency tracking, conflict-of-interest declarations, scheduling, and certificate issuance on behalf of the CAB as Data Fiduciary/Controller.
Contract performance: establishing and managing CAB subscription accounts, onboarding Users, and delivering Platform functionality.
Billing: processing invoices and payment metadata in connection with CAB subscriptions.
Account security: authenticating Users, enforcing access controls, and maintaining access and security logs.
Legal compliance: fulfilling obligations under applicable law, responding to lawful requests, and maintaining records required by accreditation or regulatory frameworks.
Platform support: diagnosing issues, responding to support requests, and performing maintenance.
Transactional communications: sending service-related notifications, alerts, and correspondence via email or in-platform messaging.
Personal Data processed through the Platform is not sold, rented, or otherwise disclosed for third-party advertising. The Platform does not conduct product analytics on User content, and no Personal Data or CAB workflow data is used to train shared or third-party artificial intelligence models.
7. Recipients, Subprocessors, and International Transfers
7.1 Thinkdata Labs LLP may share Personal Data with the categories of recipients described below: the subscribing CAB (as Data Fiduciary/Controller for its workflow data), professional advisers, regulatory or law-enforcement authorities where legally required, and the Subprocessors listed in Section 7.2.
7.2 The following Subprocessors are engaged as of 19 October 2026:
| Subprocessor | Service | Infrastructure Location | Transfer Notes |
|---|---|---|---|
Amazon Web Services (AWS) | Production hosting (Amazon Lightsail), Amazon RDS (one separate database per CAB), backups | ap-south-1 (Mumbai, India) | Production data and backups are configured not to leave India. AWS support or service telemetry may involve global processing. |
Brevo | Transactional messaging | France and Belgium | Processing may extend to US/EU infrastructure. |
Google Workspace | Business email | Global or US/EU infrastructure | Email content may be processed outside India. |
Razorpay | Payment processing | India | Payment metadata processed per Razorpay’s own privacy terms. |
7.3 Where Personal Data is transferred outside India, Thinkdata Labs LLP relies on contractual safeguards, including standard contractual clauses or equivalent measures, to provide an adequate level of protection. Thinkdata Labs LLP will update this Section if Subprocessors are added or replaced and will notify subscribing CABs of any such changes in accordance with the applicable data processing agreement.
8. Data Security Measures
8.1 Thinkdata Labs LLP maintains technical and organisational measures designed to protect Personal Data processed through the Platform against unauthorised access, loss, alteration, or disclosure. These measures are proportionate to the nature of the data and the risks involved.
Database Isolation: each subscribing CAB is assigned a separate Amazon RDS database instance, ensuring logical segregation of CAB workflow data.
Encryption: data is encrypted in transit (TLS) and at rest using industry-standard encryption protocols.
Access Controls: role-based access controls restrict Platform access to authorised personnel on a need-to-know basis.
Logging and Monitoring: access logs and security logs are maintained to support audit trails and anomaly detection.
Incident Response: documented incident response procedures govern identification, containment, investigation, and notification of security incidents.
8.2 Thinkdata Labs LLP reviews and updates these measures periodically. No method of transmission or storage is completely secure; however, Thinkdata Labs LLP applies commercially reasonable efforts to safeguard Personal Data in its custody.
9. Data Retention and Deletion
9.1 Retention Period. Thinkdata Labs LLP retains Personal Data processed through the Platform for the duration of the active subscription contract between the subscribing CAB and Thinkdata Labs LLP, plus a period of exactly three (3) months following the effective date of termination or expiry of that contract (the “Retention Period”). Daily incremental backups of the AWS Lightsail infrastructure and database, together with snapshots stored in Amazon S3 for backup and recovery, are retained while the CAB remains active in the Certyze environment. Post-termination handling remains subject to Sections 9.2 and 9.3.
9.2 Deletion of Production Data and Backups. Upon expiry of the Retention Period, Thinkdata Labs LLP will delete the CAB’s production database and all associated backups. Deletion will be completed no later than the last day of the three-month post-termination period, unless a legal hold applies.
9.3 Legal Hold Exception. Where applicable law, regulatory order, or pending litigation requires continued retention, Thinkdata Labs LLP may preserve specified Personal Data beyond the Retention Period for the minimum duration necessary to satisfy the legal obligation. Affected CABs will be notified of any such hold.
9.4 Deletion Confirmation. Following completion of deletion, Thinkdata Labs LLP will provide written confirmation to the CAB’s designated contact, certifying that production data and backups have been removed from all Platform infrastructure within the stated timeframe.
10. Your Rights and the CAB-First Request Route
10.1 Subject to applicable law, you may exercise the following rights with respect to your Personal Data processed through the Platform:
Access: request confirmation of whether your Personal Data is processed and obtain a copy.
Correction: request rectification of inaccurate or incomplete Personal Data.
Erasure: request deletion of Personal Data where no lawful basis for continued processing exists.
Portability: request export of your Personal Data in CSV or PDF format.
Objection: object to processing on grounds relating to your particular situation.
Restriction: request that processing be limited in specified circumstances.
10.2 CAB-First Request Route. Where your Personal Data forms part of CAB workflow data, the subscribing CAB is the Data Fiduciary/Controller. You should direct your request to the relevant CAB in the first instance. Thinkdata Labs LLP will assist the CAB in fulfilling such requests in accordance with its Data Processor/Processor obligations and any applicable data processing agreement.
10.3 Where Thinkdata Labs LLP acts as independent controller (for example, contracting, billing, account security, or direct support data), you may submit your request directly to legal@thinkdatalabs.com. Thinkdata Labs LLP will respond within the timeframe required by applicable law.
11. Automated Decision-Making, Children, and Breach Communication
11.1 Automated Decision-Making. The Platform does not currently employ solely automated decision-making or profiling that produces legal or similarly significant effects on any User. If this position changes, Thinkdata Labs LLP will update this Notice and provide appropriate safeguards before any such processing begins.
11.2 Children. The Platform is a B2B SaaS service directed at CABs and their professional personnel. It is not intended for use by individuals under the age of eighteen (18). Thinkdata Labs LLP does not knowingly collect Personal Data from minors. If Thinkdata Labs LLP becomes aware that it has received Personal Data of a child, it will promptly delete such data and notify the relevant CAB.
11.3 Breach Communication. In the event of a Personal Data breach that is likely to affect the security or privacy of Personal Data processed on the Platform, Thinkdata Labs LLP will, without undue delay: (a) notify each affected subscribing CAB, providing sufficient detail to enable the CAB to assess the breach and fulfil its own notification obligations as Data Fiduciary or Controller; and (b) where Thinkdata Labs LLP acts as independent controller and applicable law requires direct notification to individuals, communicate the breach to affected persons in accordance with that law.
12. Changes to This Notice
12.1 Thinkdata Labs LLP may revise this Notice from time to time to reflect changes in applicable law, Platform functionality, or business operations. Each revised version will display a new effective date at the top of the Notice.
12.2 Where a revision constitutes a material change to the scope of Personal Data processing, the purposes of processing, or the rights available to Users, Thinkdata Labs will notify affected Users by means of an in-Platform banner or a transactional email sent to the address associated with the User’s account, at least fifteen (15) calendar days before the revised Notice takes effect.
12.3 Non-material corrections (typographical fixes, formatting, or clarifications that do not alter substantive obligations) may be published without prior individual notice.
12.4 Continued use of the Platform after the revised Notice takes effect constitutes acceptance of the updated terms. Users who do not agree with a material change should discontinue use of the Platform and contact their CAB or Thinkdata Labs, as applicable, regarding their Personal Data.
13. Governing Law
13.1 This Notice, and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims), shall be governed by and construed in accordance with the laws of India.
13.2 Subject to Section 13.3, the courts at Chandigarh, India, including the Punjab and Haryana High Court, shall have exclusive jurisdiction to settle any dispute arising out of or in connection with this Notice.
13.3 Nothing in this Section limits the right of any data subject to lodge a complaint with a competent data protection authority or to seek remedies available under applicable data protection legislation, including the Digital Personal Data Protection Act, 2023, and rules made thereunder, where such legislation confers independent jurisdiction.
14. Grievance Officer and Contact Information
14.1 Thinkdata Labs LLP has designated the following Grievance Officer for the purposes of applicable data protection law, including the Information Technology Act, 2000 and rules made thereunder. The Grievance Officer is also the primary privacy contact for all inquiries under this Notice.
| Detail | Information |
|---|---|
Designation | Grievance Officer, Thinkdata Labs LLP |
legal@thinkdatalabs.com | |
Registered Address | 176 First Floor, Sector-10, Panchkula, Haryana 134112, India |
LLPIN | AAI-9081 |
14.2 To submit a privacy-related inquiry, complaint, or request concerning Personal Data processed through the Platform, Users should send a written communication to the email address above. Each communication should include the User’s full name, the CAB with which the User is associated (if applicable), a description of the concern, and any supporting details necessary to identify the relevant records.
14.3 The Grievance Officer will acknowledge receipt within seven (7) business days and will endeavour to resolve the matter within thirty (30) days of receipt, or within such other period as required by applicable law.