1. Our Role Under GDPR

Mavrilo (operated by Innovaira Softwares Private Limited) acts as a data processor for the personal data of your customers that you manage through our CRM and social media tools. You are the data controller. We process data only according to your instructions and this agreement.

2. Lawful Basis for Processing

We process personal data on the following lawful bases:

Contract performance — to deliver the Service you have subscribed to.
Legitimate interests — to operate, secure, and improve the platform.
Legal obligation — to comply with applicable laws and regulations.
Consent — for optional communications and marketing (which you can withdraw at any time).

3. Data We Process

We process the following categories of personal data on your behalf:

Account and workspace information (name, email, organisation).
Social media content and analytics data you authorise us to access.
CRM contact data you enter into the platform.
Usage and activity logs generated while using the Service.

4. Data Storage and Transfers

All primary data is stored on servers located in India. We do not transfer personal data to countries outside India except where strictly necessary to operate sub-processors (e.g., payment gateways) that provide equivalent data protection guarantees.

5. Sub-processors

We engage the following categories of sub-processors:

Payment processing — Razorpay (India)
Email delivery — transactional email provider
Infrastructure — cloud server provider (India region)

All sub-processors are bound by data processing agreements and provide equivalent data protection safeguards.

6. Your Rights as a Data Subject

Under GDPR and the Indian Digital Personal Data Protection Act (DPDPA), you have the right to:

Access — obtain a copy of your personal data.
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion of your data ("right to be forgotten").
Portability — receive your data in a machine-readable format.
Restriction — limit how we process your data in certain circumstances.
Objection — object to processing based on legitimate interests.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Data Retention

We retain personal data for as long as your account is active or as required to fulfil legal obligations. Upon account deletion, personal data is removed within 30 days except where retention is required by law (e.g., financial records for 7 years).

8. Security Measures

We implement appropriate technical and organisational measures including AES-256 encryption at rest, TLS encryption in transit, role-based access controls, and regular security audits to protect personal data against unauthorised access, loss, or disclosure.

9. Data Breach Notification

In the event of a data breach affecting your personal data, we will notify you within 72 hours of becoming aware of the breach, as required by applicable law.

10. Contact & DPO

For data protection matters, contact our team at [email protected] or write to:
Innovaira Softwares Private Limited, Plot No. 178-179, Kh. No. 10/5, Qutub Vihar, DC Goyla, South West Delhi, Delhi – 110071, India.

GDPR & Data Processing