Privacy and Data Protection Policy
Version 2.2 · Effective 25 October 2026
This policy applies to everyone whose personal data is handled through DeskGas: distributor owners and staff, their delivery men, and their customers who use a distributor's complaint page.
1. About this policy
This policy explains how Qlooto Technologies, a sole proprietorship of Vaibhav Bhati, House No. 45, B Block, Sector P-3, Phase 3, Greater Noida, Uttar Pradesh 201310 (GSTIN 09AJPPB7916C3Z5) ("Qlooto", "DeskGas", "we") collects, uses, shares, stores, protects and deletes personal data through DeskGas (www.deskgas.com and its sub-domains, including the public complaint pages of distributors).
It is published under, and we follow:
- the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), notified on 13 November 2025, as their provisions come into force;
- the Information Technology Act, 2000 ("IT Act"), including sections 43A, 72A and 79, to the extent in force;
- the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), including rule 4 (privacy policy) and rule 8 (reasonable security practices), to the extent in force;
- the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("Intermediary Rules"), including rule 3 (due diligence and grievance redressal);
- the directions of CERT-In dated 28 April 2022 under section 70B(6) of the IT Act, on reporting cyber incidents and keeping logs.
Words such as "Data Principal", "Data Fiduciary", "Data Processor", "personal data" and "personal data breach" have the meanings given in the DPDP Act.
2. Our two roles
| Whose data | Our role | Who decides and answers to the person |
|---|---|---|
| Distributor owners and staff with DeskGas logins (account data); people who ask for a demo; billing contacts | Data Fiduciary | Qlooto, under this policy |
| A distributor's customers (consumer numbers, names, mobiles, areas, complaints), credit customers, delivery men and staff records (pay, attendance, advances, bank or UPI details) | Data Processor | The distributor, as Data Fiduciary. We process this data only on the distributor's instructions under our Data Processing Terms. |
3. What we collect
| Category | Data | From |
|---|---|---|
| Account data | Name, mobile number, email, role, password (stored only as a one-way hash), whether email and mobile are confirmed, the version of these terms accepted and when | You, at sign-up or when an owner adds a User |
| Agency data | Agency name, oil company, distributor (SAP) code, city, state, address, GSTIN, phone, logo, settings, how you heard about DeskGas | You |
| Business records | Stock, deliveries, cash, collections, expenses, prices, truck invoices, corrections, reports | Distributor's Users |
| Staff and delivery-man records | Names, mobile numbers, designation, joining and leaving dates, pay rules, attendance, advances, shortages, pay slips, bank account / IFSC / UPI ID if entered | Distributor's Users |
| Customer and complaint data | Consumer number, name, mobile, area, credit-customer details; complaints with mobile, optional email, description, photos, OTP verification status and status history | The distributor, and consumers through the public complaint page |
| Billing data | Plans, invoices, GSTIN, amounts, Razorpay payment and order references and status. We never receive or store card numbers, CVV, UPI PIN or net-banking passwords. | You and Razorpay |
| Technical and security data | IP address, browser and device, login attempts and times, session records, the activity (audit) log of changes, support-access sessions, message delivery logs, error logs | Automatically |
| Communications | Emails, demo requests, support conversations, grievances | You |
4. Sensitive data we do not want
DeskGas is not designed to hold passwords of other systems, Aadhaar numbers, PAN of individuals, card details, health, biometric or similar sensitive personal data (as listed in rule 3 of the SPDI Rules). Do not enter such data in free-text fields, notes or uploads.
Bank account and UPI details of staff, if a distributor chooses to enter them for payroll, are financial information under the SPDI Rules. They are entered and controlled by the distributor, shown only to the owner, and protected as described in section 10.
5. Why we use personal data, and on what basis
| Purpose | Basis under the DPDP Act |
|---|---|
| Create and run your account, logins, roles and security | Your consent given at sign-up (section 6), and legitimate use for the service you asked for (section 7(a)) |
| Process, calculate and show your records and reports; run add-ons; send the messages you set up | On the distributor's instructions as Data Processor |
| Confirm email and mobile, send OTPs, password resets and security alerts | Consent; legitimate use |
| Bill you, issue GST invoices, collect payments, keep tax records | Legitimate use (section 7(a)); compliance with law and orders (section 7(d), (e)) including the CGST Act, 2017 and the Income-tax Act |
| Give support, investigate faults, prevent fraud and misuse, keep logs | Legitimate use; compliance with the IT Act and CERT-In directions |
| Reply to demo requests and send service announcements | Your consent, which you can withdraw at any time |
| Meet legal obligations, court orders and lawful requests of authorities; protect our rights | Section 7 of the DPDP Act and applicable law |
6. What we never do
- We do not sell or rent personal data.
- We do not use Customer Data for advertising, or share it with oil companies, other distributors, lenders or marketers.
- We do not use advertising or cross-site tracking cookies.
- We do not make decisions about people by automated means that produce legal effects.
8. Storage location and transfers outside India
Personal data may be stored and processed in India and in other countries where our service providers operate. Under section 16 of the DPDP Act, transfer outside India is permitted except to countries restricted by the Central Government. We will not transfer personal data to a restricted country, and we will follow any localisation or other conditions that apply. By using DeskGas you are informed of such transfers.
9. How we protect it
We maintain reasonable security practices and procedures under section 43A of the IT Act, rule 8 of the SPDI Rules, section 8(5) of the DPDP Act and the DPDP Rules, appropriate to the nature of the data, including:
- encryption in transit (HTTPS/TLS) for all traffic;
- PAN and bank details of delivery men, staff and suppliers, and the keys of the services we connect to, stored encrypted (AES-256) in the database, with the key kept outside it;
- passwords stored only as salted one-way hashes; one-time codes and reset links stored only as hashes and valid for minutes or hours;
- each distributor's data kept apart twice over: by the application, and by the database itself (row-level security), so one distributor's login cannot read or change another's records even if a query is wrong;
- logins: after 3 wrong passwords an "I am human" check, after 5 a 15-minute lock, after 10 the login stays locked until the password is reset, and the account owner is told; logins end after 8 hours without use (1 hour for DeskGas staff); each person can see where they are logged in and log out other devices, and the owner can log any User out everywhere;
- role-based access; 2-step verification for DeskGas staff logins; DeskGas support can open an account only while the owner allows it, for at most 60 minutes at a time, except a logged emergency opening by our Super Admin of which the owner is told at once;
- an append-only activity log that cannot be edited or deleted (it keeps only the last 4 characters of PAN and bank details), login and session logs, and rate limits against guessing and abuse;
- backups: a full copy of the DeskGas database every night, starting at about 3:00 am IST, encrypted (AES-256) on our server before it is sent to off-site storage (Cloudflare R2). Each night's copy is kept for 30 days and the first copy of each month for 12 months, then deleted. Once a month the newest backup is restored into a separate database and checked against the live records;
- least-privilege access for our staff and service providers, and confidentiality obligations on them.
No system is completely secure. You must keep your own logins safe, use strong passwords, and tell us at once about any suspected misuse.
10. If there is a personal data breach
- We will report cyber incidents to CERT-In within 6 hours of noticing them, as its directions of 28 April 2022 require.
- For a personal data breach of data for which we are the Data Fiduciary, we will inform the Data Protection Board of India and the affected people without delay, and give the Board a detailed report within 72 hours (or any longer time it allows), as section 8(6) of the DPDP Act and the DPDP Rules require. We will tell the affected people what happened, the likely consequences, what we are doing and what they can do.
- For data we process for a distributor, we will tell the distributor without undue delay so that it can meet its own duties, and help it as described in the Data Processing Terms.
11. How long we keep it
| Data | Kept for |
|---|---|
| Account, agency and business records, staff and customer data | While the account is active. After it closes: 30 days to allow an export, then deleted or anonymised within a further 60 days. |
| Backups (encrypted) | Each night's copy for 30 days; the first copy of each month for 12 months; then deleted automatically. Data deleted from DeskGas leaves the backups as they roll off. |
| Invoices, payment and tax records | 8 years from the end of the financial year, as the CGST Act, 2017 and the Income-tax Act require. |
| Activity (audit) log of an account | For the life of the account and at least 1 year after it closes. |
| Login, security and traffic logs; message delivery logs | At least 180 days as required by CERT-In, and at least 1 year as required by the DPDP Rules; then deleted. |
| OTP and confirmation records | The code itself is never stored, only a hash; records kept 1 year for security. |
| Demo requests and grievances | 2 years after the last contact, unless longer is needed for a dispute. |
| Anything needed for a legal claim, investigation or order | Until it is finally resolved. |
Under the DPDP Act and Rules we erase personal data when it is no longer needed for its purpose and no law requires us to keep it.
12. Your rights
Subject to the DPDP Act and the Rules, you have the right to:
- access a summary of your personal data we process and the processing activities (section 11);
- correct, complete, update and erase it (section 12), unless we must keep it by law;
- withdraw consent at any time, as easily as you gave it (section 6(4)). Withdrawal does not affect processing done before it, and some services (for example a login) cannot continue without the data;
- grievance redressal (section 13), and to nominate another person to exercise your rights if you die or become incapacitated (section 14).
Many details can be changed directly in DeskGas (My account, Users, Setup). For anything else, write to the Grievance Officer from the email or mobile number registered with us, so that we can verify your identity. We may ask for further proof before acting.
Customers of a distributor (for example someone who registered a complaint): your distributor is responsible for your data. Please contact your gas agency first. If you write to us, we will pass the request to the distributor and help it respond.
You also have duties under section 15 of the DPDP Act: do not give false details, impersonate anyone, or file frivolous complaints.
13. Grievance Officer and how complaints are handled
Under rule 3(2) of the Intermediary Rules, section 13 of the DPDP Act and rule 5(9) of the SPDI Rules, our Grievance Officer is:
Grievance Officer: Manoj Singh
Email: grievance@deskgas.com
Post: Qlooto Technologies, House No. 45, B Block, Sector P-3, Phase 3, Greater Noida, Gautam Budh Nagar, Uttar Pradesh – 201310
Monday to Saturday, 10 am to 6 pm IST, except public holidays.
- We acknowledge a complaint within 24 hours and resolve it within 15 days of receipt, or within 72 hours for requests to remove content that the Intermediary Rules require to be handled faster.
- Requests to exercise your rights under the DPDP Act are answered within the time set by the DPDP Rules, and in any case within 90 days.
- If you are not satisfied, you may appeal to the Grievance Appellate Committee under rule 3A of the Intermediary Rules, or complain to the Data Protection Board of India under the DPDP Act after using our grievance process.
15. Children
DeskGas is for businesses and is not meant for anyone under 18. We do not knowingly collect personal data of children. A distributor must not enter personal data of a child, except as an adult customer's household detail where unavoidable, and is responsible for any consent section 9 of the DPDP Act requires. If you believe a child's data is in DeskGas, write to the Grievance Officer and we will delete it.
16. Service messages and marketing
We send account, security, billing and service messages because they are needed to run DeskGas. Occasional product news is sent only to owners and can be stopped at any time by writing to support@deskgas.com. SMS are sent only through DLT-registered templates under the TRAI rules.
17. Distributors' duties as Data Fiduciaries
A distributor that enters personal data of its customers, delivery men and staff in DeskGas is the Data Fiduciary for that data. It must give the notices and obtain the consents the DPDP Act requires, honour those people's rights, keep the data accurate, and use DeskGas features (such as deactivating staff and editing customer records) to correct or remove data. Details are in the Data Processing Terms.
18. Changes to this policy
We may update this policy. The version and effective date are shown at the top. We will tell account owners about material changes in DeskGas or by email before they take effect. Earlier versions are available on request.