Executive Privacy Summary: Taskly is engineered with strict privacy-by-design principles, complying with India's Digital Personal Data Protection Act (DPDP Act, 2023) and international data protection standards. We process enterprise data solely for legitimate workforce, project, and operational management.
1. Introduction & Overview
Welcome to Taskly (operated by CodXpert, "we", "us", or "our"). This Privacy Policy describes our practices regarding the collection, storage, processing, transfer, and protection of digital personal data across our Enterprise Resource Planning (ERP) platform, 1-click attendance timers, project Kanban boards, WhatsApp notification gateways, and client collaboration portals accessible via https://taskly.codxpert.com.
2. Digital Personal Data Protection (DPDP) Act, 2023 Compliance
Statutory Alignment with DPDP Act, 2023
Under the Digital Personal Data Protection Act, 2023 (DPDP Act):
- Data Fiduciary / Data Processor: CodXpert acts as a Data Processor/Fiduciary facilitating workspace operations on behalf of subscribing enterprise organizations.
- Data Principal: Every registered employee, contractor, team member, or client whose digital personal data is stored within Taskly is a recognized Data Principal with full statutory rights.
- Purpose Specification: Personal data is processed solely for specified, lawful, and explicit purposes directly related to enterprise workforce administration and project delivery.
- No Minor/Children Targeting: Taskly is strictly an enterprise business application intended for individuals aged 18 and older. We do not knowingly process personal data of children.
3. Digital Personal Data We Collect
We collect only the minimum personal data necessary to operate our ERP services:
- Identity & Profile Data: Full name, business email address, encrypted password hashes (Bcrypt), contact phone numbers, and profile avatars.
- Operational & Attendance Data: Clock-in/out timestamps, shift profiles, break logs, IP address tags for verification, and task-specific timesheets.
- Project & Collaboration Records: Task assignments, milestones, sprint backlog notes, client bug reports, and file attachments.
- Financial Retainer & Costing Records: Workspace overhead budgets, multi-currency retainers (CAD, INR, AED, USD), dynamic hourly labor cost calculations, and regional partner profit splits.
4. Purpose Limitation & Processing Grounds
In compliance with DPDP principles, personal data is processed strictly for legitimate uses:
- Facilitating multi-tenant project management, task board collaboration, and client milestone delivery.
- Calculating dynamic hourly labor cost allocations without exposing raw confidential payrolls.
- Generating automated, verifiable timesheet compliance records for client billing.
- Delivering automated, time-critical WhatsApp bot alerts (e.g. shift clock-in receipts, task assignments, and security pings).
5. Confidential Financial & Salary Vault
Employee salaries, hourly rate cost multipliers, and partner profit-sharing matrices are protected under strict Role-Based Access Controls (RBAC):
Individual employee salary figures and partner equity matrices are strictly segregated. General workspace staff, peer employees, and external clients have ZERO access to confidential salary vaults.
6. Automated WhatsApp Notification Gateway
Taskly includes an automated WhatsApp gateway for instant operational dispatches:
- Notifications are dispatched exclusively to verified workspace telephone numbers or designated internal coordination groups.
- An automated sliding-window rate limit (60 requests per minute) is enforced to ensure compliance and anti-spam integrity.
- Custom exclusion routing prevents broadcasting sensitive updates to unapproved or third-party phone numbers.
7. Technical & Organizational Security Safeguards
We implement rigorous safeguards to prevent unauthorized data access or security incidents:
- HTTPS/TLS 1.3 Encryption: All data transmitted over public networks is fully encrypted in transit.
- Multi-Tenant Isolation: Airtight tenant scoping guarantees no workspace data can be accessed across organizational boundaries.
- Automated Backups & Redundancy: Encrypted daily backups stored in secure, certified data center environments.
- Session Security & Forced Logout Tracking: Automated monitoring of inactive sessions and instant owner alerts upon unexpected disconnection.
8. Rights of the Data Principal
Under the DPDP Act 2023, you possess comprehensive statutory rights over your digital personal data:
- Right to Access & Information: You may request a summary of personal data being processed and identities of Data Processors.
- Right to Correction & Completion: You can update or rectify any inaccurate or incomplete personal records directly via your user profile.
- Right to Erasure (Right to be Forgotten): You may request permanent deletion of your personal account upon termination of your employment or workspace relationship.
- Right to Withdraw Consent: You have the right to withdraw previously granted consent for elective notifications.
- Right of Grievance Redressal: Access to an established grievance mechanism for prompt resolution of data protection concerns.
9. Grievance Redressal & Contact Officer
In compliance with Section 13 of the DPDP Act 2023, CodXpert has designated a dedicated Grievance Officer to address questions, exercise of Data Principal rights, or security reports:
Grievance Redressal & Privacy Officer
Organization: CodXpert Technology Services
Designation: Data Protection & Grievance Officer
Response SLA: Acknowledged within 24 hours; resolved within statutory timelines under DPDP Act rules.
