GoverIQ™Privacy Policy
1Who We Are
GoverIQ is operated by GoverIQ (OPC) Private Limited, a company incorporated in India with its registered office in Visakhapatnam, Andhra Pradesh, India (CIN: U63119AP2026OPC128441). In this Policy, "GoverIQ", "we", "us", and "our" mean GoverIQ (OPC) Private Limited.
GoverIQ is an Identity Governance and Administration platform. It helps organisations manage identity lifecycle, access requests and approvals, certifications, Segregation of Duties checks, risk, policies, integrations, workflows, and audit evidence.
2Scope
This Policy explains how we collect, use, share, and protect personal data when you visit www.goveriq.com, contact us, or use the GoverIQ platform, and when our customers connect their systems to it.
It does not cover third-party websites, applications, or systems that we do not own or control, even if they are connected to GoverIQ.
3Our Role: Controller or Processor
For data that our customers put into or connect to the platform ("Customer Data"), the customer decides what is processed and why. The customer is the controller (or Data Fiduciary under Indian law) and GoverIQ is the processor (or Data Processor), acting only on the customer's documented instructions under the customer agreement and any data processing agreement.
For website enquiries, demo requests, billing, and our own business contacts, GoverIQ is the controller (or Data Fiduciary).
If you are an employee or user of one of our customers, please contact your organisation first about your data. We will assist them in responding to you.
4Data We Collect
4.1Website and Enquiries
When you contact us or book a demo, we collect only what you submit, such as your name, business email, company name, and message.
When you sign up for a trial, we collect your name, job title, business email, mobile contact number, company details, and the systems you want to connect. We verify the business email with a one-time code and record the sign-up IP address to prevent abuse. We use these details to run the trial and to contact you about it. We keep them as a business contact record after the trial workspace is deleted; you can ask us to delete them at any time at queries@goveriq.com.
The GoverIQ website sets no cookies and runs no advertising or third-party tracking scripts. It stores your light or dark theme choice and your privacy choice in your browser's local storage, which never leaves your device. If you opt in to anonymous analytics, the website sends GoverIQ a count of conversion events, such as starting a trial or requesting a demo, with the page path only and no identifiers. You can withdraw that consent at any time under Cookie preferences in the website footer.
4.2Platform Account Data
Name, business email, job title, department, manager, organisation, role and permissions inside GoverIQ, identity provider metadata, multi-factor authentication settings, and user preferences.
4.3Identity Governance Data (Customer Data)
Depending on what the customer connects and configures, this may include user IDs, usernames, email addresses, display names, department, location, cost centre, manager, employment status, accounts, roles, groups, permissions, entitlements, access requests, business justifications, approval and certification decisions, SoD conflicts, risk scores, policy violations, remediation records, and audit logs.
4.4Integration and Credential Data
Connector configuration, endpoint URLs, field mappings, sync and provisioning status, and error logs. Where customers provide API credentials, tokens, certificates, or keys, we store them encrypted with AES-256-GCM. Access to them is restricted and logged, and they are used only to perform the integrations the customer configures.
4.5Security and Log Data
Sign-in events, IP address, device and browser details, authentication outcomes, API access logs, security alerts, and audit trail records.
5How We Use Data
We use personal data to:
- provide, operate, and secure the platform;
- authenticate users and enforce access controls;
- run the workflows, provisioning, and governance processes the customer configures;
- generate audit evidence and reports;
- detect, investigate, and prevent fraud, abuse, and security incidents;
- provide support and respond to enquiries;
- maintain and improve the reliability and performance of the service;
- comply with legal obligations and enforce our agreements.
We process Customer Data only to provide the service to that customer, and never for our own unrelated purposes.
6Legal Basis
Where the law requires a legal basis, we rely on: performance of a contract; our legitimate interests in operating and securing a business service, balanced against your rights; compliance with legal obligations; your consent, where we ask for it; and, for Customer Data, the customer's instructions.
Under India's Digital Personal Data Protection Act, 2023, the customer as Data Fiduciary is responsible for having a valid basis, including notice and consent where required, for the personal data it processes through GoverIQ.
7What We Do Not Do
- We do not sell personal data or Customer Data.
- We do not use Customer Data for advertising or profiling unrelated to the service.
- We do not use Customer Data to train AI models for other customers or for our own general-purpose models.
- We do not access Customer Data except to provide the service, provide support the customer requests, maintain security, or comply with law.
8Sharing and Subprocessors
We share personal data only with:
- subprocessors that help us run the service, such as hosting, database, email delivery, SMS verification, and AI model providers, bound by written terms at least as protective as this Policy;
- professional advisers under a duty of confidentiality;
- a buyer or successor in a merger, acquisition, or sale of assets, subject to this Policy;
- authorities, courts, or regulators where required by law, after checking that the request is valid and, where lawful, telling the affected customer.
A current list of subprocessors is available on request from queries@goveriq.com. Where required by contract, we give notice before adding or replacing a subprocessor that processes Customer Data.
9International Transfers
Data may be processed outside the country where you or the customer are located. Transfers out of India follow the Digital Personal Data Protection Act, 2023 and any restrictions notified under it. For data from the EU, EEA, or UK, we use lawful transfer mechanisms such as standard contractual clauses. Customers may request a specific hosting region or a dedicated deployment, subject to availability and the customer agreement.
10Retention
We keep personal data only as long as needed for the purposes in this Policy, our agreements, and the law:
- Customer Data: for the term of the customer agreement, then exported or deleted as set out in the Terms of Service.
- Audit and security logs: as long as the customer's configuration or the law requires, including at least 180 days for system logs where Indian CERT-In directions apply.
- Website enquiries: up to 24 months after our last contact, unless a business relationship continues.
- Billing records: as long as tax and accounting laws require.
11Security
We use technical and organisational measures appropriate to an enterprise service, including encryption in transit and at rest, AES-256-GCM encryption for stored credentials, row-level tenant isolation, role-based and least-privilege access, multi-factor authentication, audit logging, monitoring, backups, and environment separation.
No system is completely secure, and we cannot guarantee that unauthorised access will never occur. Security is shared: customers are responsible for their users, credentials, identity provider, connected systems, and configuration.
12Personal Data Breaches
If we confirm a breach affecting Customer Data, we will notify the affected customer without undue delay and within any period required by law or contract, with the information reasonably available to help the customer meet its own obligations. We report incidents to authorities, including CERT-In and the Data Protection Board of India, where the law requires us to.
13AI and Automation
GoverIQ offers AI-assisted features, such as risk explanations, certification hints, role insights, and agents that customers configure. These outputs support human decisions. They are not the sole basis for decisions with legal or similarly significant effects on individuals, and customers are responsible for human review. Agents act only within the permissions the customer grants them, and their actions are recorded in the audit trail.
14Cookies
The GoverIQ website sets no cookies; with your consent it records anonymous conversion events without cookies. The platform uses a small number of cookies, almost all strictly necessary for sign-in and security. See our Cookie Statement for the full list.
15Your Rights
Depending on where you live, you may have the right to access, correct, complete, update, or erase your personal data; to restrict or object to processing; to data portability; to withdraw consent; to nominate another person to exercise your rights (India); and to complain to a regulator.
For Customer Data, we will pass your request to the relevant customer and help them respond. For data we control, write to queries@goveriq.com. We may need to verify your identity before acting. We will respond within the period the law requires, and in any case within 30 days.
16Grievance Officer (India)
In accordance with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:
Name Mounika Kunkupudi
Email queries@goveriq.com
Address GoverIQ (OPC) Private Limited, Visakhapatnam, Andhra Pradesh, India
We will acknowledge grievances promptly and resolve them within 30 days of receipt. If you are not satisfied, you may approach the Data Protection Board of India once it accepts complaints.
17EU, EEA, and UK Residents
Where the GDPR or UK GDPR applies, you may exercise the rights above and complain to your local supervisory authority. Where we act as processor, the customer is the controller and your request should go to them first.
18California Residents
We do not sell or share personal information for cross-context behavioural advertising. Where we act as a service provider, we process personal information only for the customer's business purposes. You may have rights to know, delete, and correct personal information, and not to be discriminated against for exercising them.
19Children
GoverIQ is a business service and is not directed at anyone under 18. We do not knowingly collect children's data. Customers must not submit children's data unless they are legally permitted to and have obtained verifiable parental consent where required.
20Changes to this Policy
We may update this Policy. We will post the new version here with a new "Last Updated" date and, for material changes, notify customers by email or in-app notice before they take effect.
21Contact
GoverIQ (OPC) Private Limited
Registered office Visakhapatnam, Andhra Pradesh, India
CIN U63119AP2026OPC128441
Email queries@goveriq.com