Privacy Policy

1. Who we are and what this policy covers

GAZI WELLNESS PRIVATE LIMITED ("Gazi Wellness", "we", "us") is a private limited company incorporated in India (CIN U10799MH2026PTC466630) with its registered office at S No 40 P No 14, Maldhe, Malegaon, Nashik, Maharashtra, 423203, India. We provide franchise field audit and brand compliance software to franchisors, multi-unit franchisees and their field teams.

This policy explains how we handle personal data in two different roles:

• As a controller (or "business" under California law, and "data fiduciary" under India's DPDP Act) for data about visitors to gaziwellness.si, people who contact us or request a demo, and account information we need to run our customer relationships and bill for the service.
• As a processor (or "service provider" and "data processor") for audit data our customers upload to the Gazi Wellness platform, such as store photos, GPS location, EXIF metadata, voice notes, checklist answers and corrective action records. For this data, our customer, usually a franchisor or franchisee, decides why and how it is processed, and our Data Processing Addendum governs our handling of it.

If you are a store employee or franchisee whose information appears in a Gazi Wellness audit, please contact the franchise system that ran the audit first. We will help them respond to your request.

2. Data we collect from website visitors and prospects

Photos uploaded through the sample scan are used only to produce your report and are deleted 30 days after upload unless you become a customer and ask us to keep them.

3. Data our customers upload (audit data)

When a customer uses Gazi Wellness, their authorized users capture and upload audit data. Depending on how the customer configures the platform, this may include:

• Photos and video of store interiors, exteriors, kitchens, equipment and signage. Photos may incidentally show employees or members of the public.
• GPS coordinates and capture timestamps recorded by the device, and EXIF metadata embedded in image files (such as device model, capture time and orientation).
• Voice notes recorded by auditors and their transcriptions.
• Checklist answers, scores, comments, temperature readings and corrective action records, including the names of people assigned to tasks.
• User account data: name, email, phone number, role, assigned locations and sign-in activity.

We process audit data only to provide the service to the customer, under the customer's instructions. We do not sell audit data, and we do not use photos to identify individuals. Gazi Wellness's Vision AI analyzes brand standards such as signage, cleanliness and equipment condition; it does not perform facial recognition.

4. How we use personal data and our legal bases

Under India's Digital Personal Data Protection Act, 2023, we process personal data for which we are the data fiduciary on the basis of your consent or for legitimate uses permitted by the Act, such as a purpose for which you voluntarily provided the data.

5. How we share personal data

• Subprocessors who host, operate and support the platform under written contracts, listed on our Subprocessors page.
• Within a customer account: audit data is visible to the users the customer authorizes, such as franchisor staff, FBCs, franchisee owners and store managers.
• Integrations a customer chooses to connect, such as a franchise management system or a collaboration tool. Data flows to these services at the customer's direction.
• Professional advisers, auditors and authorities where required by law or to protect our rights.
• A buyer or successor in a merger or acquisition, subject to this policy.

We do not sell personal data, and we do not share it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act.

6. International transfers

We are headquartered in India and host customer data with Amazon Web Services in the United States (us-east-1) and India (ap-south-1). Customers choose a hosting region during onboarding. Our engineering and support teams in India and the United States may access data to provide the service.

Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), the UK International Data Transfer Addendum and equivalent Swiss safeguards, together with supplementary technical measures such as encryption in transit and at rest.

7. Retention

• Audit data: kept for the subscription term according to the retention settings the customer chooses, then deleted within 30 days after the end of the post-termination export window, unless the customer asks us to delete it sooner.
• Account and billing records: kept for the life of the account and up to 8 years afterwards to meet tax and accounting obligations.
• Prospect and marketing data: kept for up to 24 months after your last interaction with us, or until you ask us to delete it.
• Server and security logs: kept for up to 13 months.

8. Your rights

EEA, UK and Switzerland

You may request access to, correction of, erasure of, or restriction of your personal data, object to processing based on legitimate interests, withdraw consent at any time, and request portability. You may also complain to your local data protection authority.

California (CCPA as amended by the CPRA)

California residents may request to know what personal information we collect, use and disclose, to delete it, to correct inaccurate information, and to opt out of sale or sharing (we do neither). We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit. We will not discriminate against you for exercising these rights. You may use an authorized agent, and we honor Global Privacy Control signals as an opt-out of non-essential cookies.

India (DPDP Act 2023)

You may request a summary of the personal data we process about you, correction, completion, updating and erasure of that data, and the names of others with whom it has been shared. You may withdraw consent, nominate another person to exercise your rights in the event of death or incapacity, and raise a grievance with our Grievance Officer. If you are not satisfied with our response, you may approach the Data Protection Board of India.

How to make a request

Email privacy@gaziwellness.si. We will verify your identity before responding and reply within the time required by applicable law, normally within 30 days (45 days for California requests). For audit data, we will pass your request to the customer that controls it and assist them in responding.

9. Security

We encrypt data in transit with TLS 1.2 or higher and at rest with AES-256. Each customer's data is logically isolated by tenant, access is role-based and logged, and photo evidence is hashed at upload so later changes can be detected. Our controls are examined annually in a SOC 2 Type II report, available to customers and prospects under NDA. More detail is on our Security page.

10. Children

Gazi Wellness is a business service and is not directed to children. We do not knowingly collect personal data from anyone under 18 through our website. Store photos may incidentally show minors who are customers or employees; customers should configure capture guidelines to avoid this where practical.

11. Contact and Grievance Officer

Privacy and data protection questions: privacy@gaziwellness.si. Postal address: GAZI WELLNESS PRIVATE LIMITED, Attn: Privacy, S No 40 P No 14, Maldhe, Malegaon, Nashik, Maharashtra, 423203, India.

Grievance Officer (India): Sameer Joshi, Head of Security & Compliance, privacy@gaziwellness.si. We acknowledge grievances within 48 hours and aim to resolve them within 30 days.

We will post changes to this policy on this page and update the date above. For material changes we will notify account administrators by email at least 30 days in advance.