Privacy Policy

Effective Date: 16 May 2026 | Version 2.0 (supersedes the 12 July 2025 edition)

1. Introduction

Delisys Technologies Ltd and its Partners value your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the OPS360 platform and related services, including mobile applications, AI assistant, e-signature, file management, communication, payment, audits, document summarization, and incident reporting tools.

We comply with applicable data protection laws including the UK GDPR and the UK Data Protection Act 2018 (United Kingdom), the California Consumer Privacy Act as amended by the CPRA, and other applicable US state privacy laws (United States), and the Digital Personal Data Protection Act 2023 (“DPDP Act”) (India).

“Delisys Technologies Ltd and its Partners” (also “we”, “us”, “our”) means Delisys Technologies Ltd (company number 11490073) together with its authorised affiliates and sub-processors who process personal data solely under Delisys’s instructions and the safeguards described in this Policy, our Data Processing Agreement, and our Sub-processor List.

Data Protection Officer: dpo@ops360.net

2. About Our Services

2.1 Roles (Controller / Processor)

OPS360 is primarily a business-to-business (B2B) platform.

• When your organization provides you access, your organization is the Data Controller / Data Fiduciary for that processing, and Delisys Technologies Ltd and its Partners act as the Data Processor for service delivery. Both this policy and your organization’s privacy policies may apply.
• For our public website, marketing, sales enquiries and demo/contact requests, Delisys Technologies Ltd is the Data Controller and this Policy applies directly to you.

2.2 Our Services

• Platform Services (projects, tasks, team collaboration, management tools)
• Mobile Applications (iOS/Android, with offline capabilities)
• AI Services (assistants, document summarization, analytics)
• E-Signature Services (digital signing, compliance tracking)
• File Management (cloud storage, sharing, version control)
• Communication (chat, WhatsApp integration, notifications)
• Payments & Billing (invoicing, transactions, subscription management)
• Audits & Compliance Tools (location-based audits, incident management, reporting)

2.3 Children’s Data

OPS360 is a workplace platform intended for business use by adults. Our services are not directed to children, and we do not knowingly collect personal data from anyone under 18 years of age. Where the DPDP Act (India) or other applicable law treats an individual as a child, we will not process their personal data without verifiable parental/guardian consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If we learn we have collected a child’s data without the required consent, we will delete it.

3. Information We Collect (Notice at Collection)

• Identifiers / Personal Information: Name, email, phone, company, login credentials
• Platform Usage Data: Projects, tasks, forms, chat, AI interactions
• Financial Information: Payment details, invoices, tax IDs
• E-Signature Data: Signed documents, audit trails, IP/device details
• HR & Payroll Data: Employee records, attendance and leave, salary, statutory deductions (e.g. tax, National Insurance) and pension details, processed on your instruction as employer
• Recruitment Data: Candidate applications, CVs, interview notes and ratings (where you use the Recruitment module)
• Visitor Data: Visitor logs, host details and check-in photos (where you enable the Visitor Manager module)
• Mobile Data: Location, camera, device info, offline cache (all optional, see Section 12)
• Technical / Internet Activity: Analytics, performance logs, IP addresses, cookies
• Communication Data: Messages, files, WhatsApp records, notifications
• Sensitive Personal Information: Only where you choose to provide it (e.g., biometric verification for e-signature); processed strictly on consent and never sold or shared

This also serves as the Notice at Collection for US (CCPA/CPRA) purposes. We collect these categories for the business purposes in Section 4, retain them per our Data Retention Policy, and do not sell personal information (see Section 16.2).

4. How We Use Your Information

• Service Delivery (Contract Performance): Operate OPS360, process payments, support e-signatures, enable communication, deliver mobile features
• Business Operations (Legitimate Interests): Improve services, ensure security, prevent fraud, provide support
• With Consent: Marketing, location access, camera access, biometric verification, optional integrations
• Legal Compliance: Meet financial, audit, and regulatory requirements

5. Information Sharing

We do not sell your personal data, and we do not “share” it for cross-context behavioural advertising as defined under US state privacy laws. We disclose information only to:

• Service Providers / Sub-processors: Microsoft Azure, MongoDB Atlas, Stripe, PayPal, Razorpay, Azure OpenAI, Google (incl. Vision API, Analytics, Business Profile APIs, and YouTube API Services, governed by the Google Privacy Policy), Firebase, WhatsApp Business (Meta), and Azure Communication Services. All under contract and listed in our Sub-processor List
• Legal/Regulatory Authorities: When required by law
• Business Transfers: If OPS360 is merged, acquired, or assets sold
• Emergency Situations: To protect safety and security

5.1 YouTube API Services

OPS360's Social Planner uses YouTube API Services to let you connect your YouTube channel, publish and manage videos, and view channel and video analytics. When you connect a YouTube channel, we access and store the data necessary to provide these features (your channel profile, the OAuth tokens Google issues, and the analytics we retrieve on your behalf).

By using these features you also agree to the YouTube Terms of Service, and our use of information received from the YouTube API is governed by the Google Privacy Policy (http://www.google.com/policies/privacy). We use YouTube data only to provide the Social Planner features you have authorised, and never to build advertising profiles or for any purpose inconsistent with your consent.

You can disconnect your YouTube channel from OPS360 at any time from Social Planner → Platforms. Disconnecting deletes the stored tokens and channel data from OPS360 and revokes our access with Google. You can additionally review or revoke OPS360's access to your Google account directly via Google's security settings page.

5.2 Google Business Profile API

OPS360's Review Manager uses the Google Business Profile APIs to let you connect the Google Business Profile locations you own or manage, read the reviews and ratings customers leave on those locations, and post replies back to Google on your behalf. When you connect a location, we access and store only the data necessary to provide these features (your selected account and location identifiers, the review content and ratings we retrieve, and the OAuth tokens Google issues).

OPS360's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Business Profile data solely to provide the Review Manager features you have authorised (reading and replying to your reviews); we do not transfer or sell this data, do not use it for advertising, and do not allow humans to read it except where you explicitly permit it, for security or compliance purposes, or as required by law.

You can disconnect a Google Business Profile location from OPS360 at any time from Review Manager → Integrations. Disconnecting deletes the stored tokens and synced review data from OPS360 and revokes our access with Google. You can additionally review or revoke OPS360's access to your Google account directly via Google's security settings page.

5.3 LinkedIn APIs

OPS360's Social Planner uses the LinkedIn APIs to let you connect a LinkedIn account, publish posts to your personal profile or to the LinkedIn Pages you administer, and view engagement figures for the posts OPS360 published. Connecting is entirely optional and is initiated by you.

When you connect a LinkedIn account we access and store only what these features require: your LinkedIn member identifier, name, email address and profile picture; the OAuth access and refresh tokens LinkedIn issues; and the identifiers and names of the Pages you administer, so you can choose where to publish. The content you publish is content you supply in OPS360.

We do not read your LinkedIn inbox, connections or feed, and we do not retrieve or store other members' profiles or their comments on your posts. The engagement figures we retrieve are aggregate counts for posts published through OPS360 — not information about the individuals who engaged. We do not sell LinkedIn data, do not use it for advertising, and do not use it to build profiles of LinkedIn members.

You can disconnect a LinkedIn account from OPS360 at any time from Social Planner → Connections. Disconnecting deletes the stored tokens and profile data from OPS360. You can additionally review or revoke OPS360's access directly from LinkedIn's permitted services settings. Your use of these features is also subject to the LinkedIn User Agreement and LinkedIn Privacy Policy.

6. Data Security

• Encryption: AES-256 (at rest), TLS 1.2 or higher (in transit)
• Access Controls: MFA, role-based permissions, least-privilege managed identities
• E-Signature Security: Audit trails, device fingerprinting, fraud prevention
• Organizational Safeguards: Staff training, access reviews, incident response

7. Data Retention & Deletion

See our Data Retention Policy for full per-category retention periods.

• Data is retained only as long as necessary for the service plus any legally required period
• Business account admins manage user deletion/export requests in-app
• OPS360 directly handles deletion of entire business accounts (tenants), on verified data-subject request, or when legally required
• Automatic deletion runs according to documented schedules
• Backups: Deleted data is removed from active systems promptly and ages out of encrypted in-region backups within the backup retention window stated in the Data Retention Policy
• Connected third-party accounts (e.g. YouTube/Google): Authorisation tokens are stored only for as long as the connection is active and used solely for the features you authorised. Disconnecting the account (Social Planner → Platforms) deletes the stored tokens and associated data from OPS360 and revokes our access with the provider. You may also revoke OPS360's access to your Google account at any time via Google's security settings page.

8. Data Residency

OPS360 enforces regional data residency. Your data is stored and processed in the region matching your organization’s selected Operating Country:

• UK customers: Data stored and processed in the United Kingdom
• India customers: Data stored and processed in India
• USA customers: Data stored and processed in the United States

Data remains within the customer’s region/country and is not transferred abroad except where strictly required for a specific feature (e.g., global payment networks, WhatsApp delivery) with appropriate safeguards, see Section 10 and the Sub-processor List. Each region uses its own database cluster and in-region encryption keys.

Note: support for additional regions (e.g., EU) is planned and will be added to this Policy when available.

9. Your Rights

Depending on your jurisdiction, you may exercise the rights below. Where your data is processed on behalf of your employer (Controller), requests are routed through your business account admin; you may also contact us directly. We will not discriminate against you for exercising your rights.

• Access / Know: obtain a copy of, and information about, your personal data
• Rectification / Correction, correct inaccurate data
• Erasure / Deletion, request deletion (subject to legal exceptions)
• Portability, receive/export your data in a portable format
• Restriction / Objection, restrict or object to processing based on legitimate interests
• Withdraw consent, for any consent-based processing, as easily as it was given
• Automated decisions, request human review of solely-automated decisions
• Authorised agent, you may use an authorised agent (we may verify identity/authority)

To exercise rights or raise a concern: privacy@ops360.net (or your account admin). You also have the right to complain to your regulator (see Section 15).

10. International Data Transfers

• UK: UK International Data Transfer Agreement / Addendum to the EU SCCs, or an adequacy decision, with supplementary measures where required
• India: transfers only as permitted under the DPDP Act and any government notifications in force
• USA: contractual protections (SCCs where applicable) plus encryption and security controls

Our default position is no cross-border transfer of your personal data outside your Operating Region.

11. Cookies and Tracking

OPS360 uses cookies and similar technologies for essential functions and, only with your prior opt-in consent, analytics and marketing. Non-essential cookies are off by default; you can accept, reject, or change your choices at any time via our consent banner / preferences centre. See our Cookie Policy for the full cookie table and details.

11.1 Email Open and Click Tracking

Marketing email can carry a small invisible image (a tracking pixel) and links that pass through a redirect before reaching their destination. Together these record that a message was opened, when, and which links were followed. This is handled by Microsoft Azure Communication Services, our email sub-processor, and is configured per sending domain.

Where OPS360 is the controller — our own marketing email to you — we use this only where we have your opt-in consent to receive that mail, and you can withdraw it at any time using the unsubscribe link in any message or by contacting us. Transactional email you receive because you use the service is not tracked for marketing purposes.

Where OPS360 is the processor — email a customer sends to their own contacts using our platform — tracking is a setting that customer controls on their own sending domain, and it is off by default. That customer is the controller for those messages: they decide whether to enable it, and they are responsible for the notice given to, and any consent obtained from, their own recipients. If you received marketing email from a business that uses OPS360, please refer to that business’s privacy notice and direct your rights requests to them; we will assist them in responding.

Open tracking is not reliable as a measure of individual behaviour: some mail providers pre-fetch images automatically, which registers as an open the recipient never made.

12. Mobile App Permissions

• Location (site audits)
• Camera (scans, photos)
• Storage (offline caching)
• Notifications (alerts)
• Microphone (voice messages)

All permissions are optional and controlled by the user.

13. Data Breaches

• Supervisory authorities notified within 72 hours of awareness where required (UK ICO; India Data Protection Board; relevant US authorities)
• Affected users/business admins notified without undue delay where there is a high risk to rights
• Remediation and prevention steps taken immediately

14. Updates to This Policy

We may update this Privacy Policy for legal, operational, or feature reasons. We will not make material changes without notice, significant changes will be communicated to business account admins and users, and the Effective Date and Version above will be updated. Continued use after the stated effective date constitutes acceptance of non-material updates.

15. Contact Information

Delisys Technologies Ltd and its Partners
Registered Address: Suite 5, 22-26 Nottingham Road, Stapleford, Nottingham NG9 8AA, United Kingdom
Company Number: 11490073
General Email: info@ops360.net
Website: https://ops360.net

Privacy Contacts:

Data Protection Officer: dpo@ops360.net
Privacy Team: privacy@ops360.net
India Grievance Officer (DPDP Act): grievance.in@ops360.net, for data principals in India; we respond within DPDP Act timelines

Regulatory Authorities:

UK: Information Commissioner’s Office (ICO) – https://ico.org.uk
USA (California): California Privacy Protection Agency / California Attorney General’s Office
India: the Data Protection Board of India (established under the DPDP Act 2023)

16. Jurisdiction-Specific Provisions

16.1 United Kingdom (UK GDPR & Data Protection Act 2018)

• Lawful basis for each processing activity is documented (see Section 4)
• Rights: access, rectification, erasure, restriction, portability, objection, automated-decision rights
• Right to lodge a complaint with the Information Commissioner’s Office (ICO)
• International transfers use the UK IDTA/Addendum or adequacy (see Section 10)

16.2 United States (CCPA/CPRA & other state laws)

• Right to Know the categories and specific pieces of personal information collected, used, and disclosed (see Section 3)
• Right to Delete and Right to Correct personal information (subject to exceptions)
• Right to Opt Out of Sale/Sharing, we do not sell or “share” personal information for cross-context behavioural advertising; our cookie banner lets you decline analytics/marketing cookies
• Right to Limit Use of Sensitive Personal Information, used only as needed to provide the requested service
• Right to Non-Discrimination for exercising privacy rights
• Requests by you or an authorised agent to privacy@ops360.net; we verify identity before fulfilment
• Applies in California and, on a comparable basis, in other US states with applicable privacy laws

16.3 India (DPDP Act 2023)

• We process personal data of Data Principals on a lawful basis provided by the Data Fiduciary
• Rights: access, correction, completion, updating, erasure, grievance redressal, and nomination
• Withdraw consent at any time, as easily as it was given
• Grievance Officer contact in Section 15; grievances resolved within DPDP Act timelines, escalation to the Data Protection Board of India
• Children’s data handled per Section 2.3 (verifiable parental consent; no tracking/targeted ads to children)
• Personal data of India customers stored and processed in India (see Section 8)

17. Final Provisions

• Acceptance: Using OPS360 means you accept this policy.
• Changes: We notify users of material changes per Section 14; we will not change this Policy without updating the Effective Date and Version.
• Governing Law: Laws of England and Wales, with additional compliance to the local laws of the regions served (UK, USA, India).
• Entire Agreement: This Privacy Policy + Terms of Service + (for business customers) the Data Processing Agreement and Sub-processor List form the complete privacy framework.

If you do not agree, discontinue use and uninstall OPS360 applications.