This Privacy Notice applies specifically to Aistra UC (“UC”), Aistra’s unified commerce, customer engagement, digital experience, and/or AI-enabled customer interaction solutions (as applicable), and should be read together with the Aistra Master Privacy Policy available on the Aistra website.
If there is any inconsistency between this Privacy Notice and the Aistra Master Privacy Policy in relation to the processing of personal data specifically within UC, this Privacy Notice shall prevail to the extent of such inconsistency.
1. INTRODUCTION
Aistra Private Limited and/or its relevant affiliates (“Aistra”, “we”, “us”, or “our”) respect your privacy and are committed to handling personal data responsibly, transparently, and in accordance with applicable law.
This Privacy Notice explains how personal data may be collected, used, stored, shared, transferred, and otherwise processed in connection with Aistra UC, including where UC is deployed for:
- digital customer engagement,
- unified commerce operations,
- customer support interactions,
- marketing or service communications,
- conversational interfaces,
- analytics, workflow orchestration, or
- other customer experience enablement use cases.
Depending on the implementation, Aistra may act as:
- a data fiduciary / controller in limited circumstances (for example, where we collect data directly from website visitors, demo requests, or product inquiries); and/or
- a data processor / service provider acting strictly on behalf of enterprise customers and in accordance with their documented instructions and applicable law.
2. SCOPE OF THIS NOTICE
This Privacy Notice applies to personal data processed in connection with:
- use of Aistra UC by Aistra customers and their authorised users;
- data submitted through UC-enabled interfaces, portals, forms, chat interfaces, support channels, or communication workflows;
- customer, prospect, end-user, or representative information processed through UC by or on behalf of enterprise customers;
- technical, usage, telemetry, and diagnostic information associated with the operation, security, and performance of UC.
This Privacy Notice does not replace customer-specific contractual arrangements, including:
- master service agreements,
- data processing addendums,
- implementation statements of work,
- enterprise security schedules, or
- client-issued privacy notices applicable to their own end users.
In the event of any conflict between this Privacy Notice and applicable customer agreements, including data processing agreements or negotiated contractual terms, such agreements shall prevail to the extent of the conflict.
3. CATEGORIES OF PERSONAL DATA WE MAY PROCESS
Customers are expected to configure and use UC in a manner consistent with applicable data minimisation principles and should avoid submitting unnecessary personal data.
Depending on how UC is configured, deployed, or used, the categories of personal data that may be processed include:
3.1 Identity and Contact Information
- name
- email address
- phone number
- business designation
- company name
- customer account identifiers
- user profile information
3.2 Customer Interaction Data
- support queries
- chat or conversational inputs
- ticketing information
- feedback submissions
- service requests
- communication preferences
- transcripts of interactions (where enabled)
- Your learning progress, quiz scores, and completion status
- Your completion certificate (name and date only)
Note: Why we hold it: To deliver your learning program and issue your completion certificate, as contracted with your institution.
3.3 Commerce and Transaction-Related Data
- order or service request references
- customer account or subscription references
- delivery or fulfilment-related details
- purchase history or transaction metadata
- service usage records
- product or service preference information
Important: UC is not intended to require storage of full payment card information unless explicitly integrated through compliant third-party providers. Any payment processing, if applicable, should be governed by the relevant payment provider’s privacy and security terms.
3.4 Device, Technical, and Usage Data
- IP address
- browser type
- device identifiers
- operating system details
- session logs
- timestamps
- access logs
- feature interaction data
- system diagnostics
- crash or error logs
3.5 Communications and Preference Data
- email interaction data
- campaign engagement data
- opt-in/opt-out preferences
- response history
- channel preference settings
- consent records, where applicable
3.6 AI / Automation-Related Input and Output Data
Where UC includes AI-enabled functionality, Aistra may process:
- prompts, queries, or structured inputs submitted to the system
- automated summaries
- workflow outputs
- generated response suggestions
- classification or routing outputs
- intent or sentiment indicators (where enabled)
3.7 Customer-Provided or Customer-Controlled Data
Enterprise customers may upload or configure additional data sets for business use cases. Such data may include personal data to the extent determined and controlled by the customer.
Aistra does not require customers to upload sensitive personal data unless specifically necessary, contractually agreed, and supported by appropriate safeguards.
Customers remain responsible for ensuring that any personal data uploaded or configured with UC is lawfully collected, disclosed, and processed in accordance with applicable law.
4. SOURCES OF PERSONAL DATA
We may obtain personal data from:
- directly from customers and authorised users;
- end users interacting with UC-enabled channels;
- enterprise customers who configure or upload data into UC;
- website forms, demo requests, or support requests;
- integrations with third-party systems authorised by the customer;
- cookies or similar technologies (where applicable);
- internal logs, monitoring tools, and service diagnostics.
5. PURPOSES OF PROCESSING
Aistra processes personal data only for the legitimate and limited purposes described in this Privacy Notice and does not use such data for unrelated or incompatible purposes.
We may process personal data for the following purposes:
5.1 To Provide and Operate UC
- provision of unified commerce and customer engagement services
- enabling customer communications and service interactions
- account setup, authentication, and access control
- order, service, or workflow enablement
- routing, escalation, and service orchestration
5.2 To Support AI-Enabled Features
- powering automated workflows
- generating or recommending responses
- intent detection, categorisation, summarisation, or routing
- improving relevance, performance, and efficiency of configured use cases, subject to appropriate operational oversight where applicable.
5.3 To Maintain Security and Integrity
- monitoring for abuse, fraud, misuse, or unauthorised access
- threat detection and incident response
- vulnerability management
- system logging and audit support
- enforcing contractual and platform usage controls
5.4 To Improve Product Performance
- product analytics
- troubleshooting
- feature usage analysis
- service optimisation
- quality assurance
- reliability engineering
5.5 To Communicate with Customers
- responding to inquiries
- onboarding and implementation support
- account management
- service notices
- release notes
- operational or security alerts
5.6 To Comply with Legal or Contractual Obligations
- maintaining audit trails
- responding to lawful requests
- dispute resolution
- internal governance and compliance reviews
- enforcement of contractual rights
6. LEGAL BASIS / BASIS OF PROCESSING (INDIA-ALIGNED)
Where applicable under Indian law, Aistra processes personal data:
- with the knowledge and, where required, consent of the relevant individual;
- for specified and lawful business purposes;
- to perform or support contractual services requested by customers;
- to comply with applicable legal obligations;
- for legitimate and reasonable business purposes connected with product security, fraud prevention, service administration, quality improvement, and enterprise service delivery, subject to applicable law.
Where Aistra processes personal data strictly on behalf of an enterprise customer, that customer remain solely responsible for ensuring an appropriate legal basis and notices to its own end users, employees, agents, or customers, as applicable.
7. ROLE OF AISTRA AS PROCESSOR / SERVICE PROVIDER
In many UC deployments, Aistra acts as a processor / service provider on behalf of the enterprise customer.
In such cases:
- the customer determines the nature, purpose, and extent of data submitted into UC;
- Aistra processes such data solely in accordance with customer instructions, applicable contracts, and law;
- the customer remains responsible for providing applicable notices, obtaining consents where required, and handling data subject / data principal requests relating to customer-controlled data, unless otherwise agreed.
In such cases, Aistra does not independently determine the purposes or essential means of processing customer-controlled personal data.
8. AI-SPECIFIC DISCLOSURES
Where UC includes AI-enabled functionality:
- AI-generated outputs may be probabilistic and should be reviewed by appropriate personnel before being relied upon for material customer, operational, legal, or commercial decisions.
- Aistra does not recommend using AI-generated outputs as the sole basis for high-impact decisions affecting individuals.
- Inputs and outputs may be logged for security, troubleshooting, abuse prevention, service optimisation, and model or workflow quality monitoring, subject to contractual restrictions and configuration.
- Unless expressly agreed in writing, customer data processed within UC is not used to train general-purpose public AI models.
AI-generated outputs may be probabilistic, incomplete, or dependent on input quality and should be independently reviewed before being relied upon for customer-impacting, legal, financial, operational, or compliance-related decisions.
To the extent permitted by law, Aistra disclaims liability arising from sole reliance on automated outputs without appropriate human review or validation.
9. COOKIES, TRACKING, AND SIMILAR TECHNOLOGIES
Where UC is delivered through web interfaces, dashboards, portals, or embedded customer interaction surfaces, cookies or similar technologies may be used for:
- authentication and session management
- security
- performance monitoring
- analytics
- preference retention
- troubleshooting
Where required, cookie-related disclosures should also be read together with Aistra’s website cookie notice or equivalent disclosures.
Where required by applicable law, non-essential cookies or similar technologies will be used only with appropriate notice and consent mechanisms.
10. DISCLOSURE OF PERSONAL DATA
Any disclosure of personal data is subject to appropriate contractual, confidentiality, security and access control safeguards.
We may disclose personal data to:
- our affiliates and group entities;
- infrastructure, cloud hosting, and platform service providers;
- analytics, monitoring, observability, and support vendors;
- implementation, professional services, or subcontracted service providers;
- communication service providers (e.g., email, messaging, ticketing, CRM integrations), where applicable;
- legal, regulatory, audit, or governmental authorities where required by law;
- professional advisers, auditors, insurers, or transaction counterparties, subject to confidentiality obligations.
Austra does not sell personal data.
11. CROSS-BORDER TRANSFERS
Depending on service architecture, hosting arrangements, customer configuration, or support operations, personal data processed through UC may be stored in or accessed from jurisdictions outside India.
Where cross-border transfers occur, Aistra will implement appropriate contractual, organisational, technical, and security safeguards including legally recognised transfer mechanisms where applicable.
12. DATA RETENTION
We retain personal data only for as long as necessary for:
- the purposes described in this Privacy Notice;
- the duration of the customer relationship or subscription;
- security, audit, and compliance requirements;
- backup, disaster recovery, and service continuity needs;
- dispute resolution and enforcement of legal rights;
- applicable legal or regulatory retention obligations.
Retention periods may vary depending on:
- deployment model,
- customer configuration,
- contractual requirements,
- legal obligations, and
- the nature of the relevant data.
Your data is held for the duration of your program plus 2 years. Certificates are kept for 5 years
Where personal data is no longer required, it will be securely deleted, anonymised, archived, returned, or otherwise disposed of in accordance with applicable law and contractual obligation.
13. DATA SECURITY
Aistra maintains reasonable technical, organisational, and administrative safeguards designed to protect personal data against unauthorised access, misuse, alteration, disclosure, loss, or destruction.
Such measures may include:
- access controls
- encryption in transit and/or at rest, where applicable
- logging and monitoring
- role-based access restrictions
- secure development and deployment controls
- vulnerability management
- vendor oversight
- incident response processes
No system can be guaranteed to be completely secure. Users and customers should also implement appropriate internal controls and secure configuration practices.
Customers remain responsible for implementing appropriate internal governance, access management, and secure configuration practices within their use of UC.
14. YOUR RIGHTS / DATA PRINCIPAL RIGHTS
Subject to applicable law and Aistra’s role in the relevant processing activity, individuals may have rights to:
- request access to personal data
- request correction or updating of inaccurate or incomplete personal data
- request erasure, where applicable
- withdraw consent, where processing is based on consent
- request grievance redressal
- nominate another person to exercise rights in accordance with applicable Indian law (where applicable)
Where Aistra processes personal data solely on behalf of an enterprise customer, requests relating to customer-controlled data should ordinarily be directed to the relevant customer first.
15. CHILDREN’S DATA
Aistra UC is intended for business and enterprise use and is not directed to children.
Aistra does not knowingly design UC to collect personal data from children unless explicitly configured by a customer for a lawful and disclosed use case, supported by appropriate legal basis and safeguards. Customers remain solely responsible for ensuring lawful processing, consent management, and compliance obligations where their own use cases involve minors.
16. THIRD-PARTY INTEGRATIONS
UC may integrate with third-party systems, applications, APIs, messaging channels, CRMs, commerce platforms, or enterprise tools at the direction of the customer.
Aistra is not responsible for the independent privacy practices of third-party systems that are separately operated by customers or third parties. Customers should review and manage such integrations appropriately.
17. CHANGES TO THIS PRIVACY NOTICE
We may update this Privacy Notice from time to time to reflect:
- product changes
- legal or regulatory developments
- security or operational updates
- new integrations or processing activities
The updated version will be posted with a revised “Last Updated” date.
18. CONTACT / GRIEVANCE REDRESSAL
For questions, concerns, or requests relating to this Privacy Notice or Aistra’s handling of personal data, please contact:
Grievance Officer: Tushar Borse
Email: compliance@unconstrained.work
After contacting the Grievance Officer you will receive a response within 30 days.
The Grievance Officer named above is the designated contact for grievances and for requests to exercise your rights under applicable Indian data protection law, including the Digital Personal Data Protection Act, 2023.
If you are not satisfied with the response to your grievance, you may complain to the Data Protection Board of India.
19. RELATIONSHIP WITH MASTER PRIVACY POLICY
This Privacy Notice is a product-specific addendum for Aistra UC and must be read together with the Aistra Master Privacy Policy.
If a matter is not specifically addressed here, the Aistra Master Privacy Policy shall apply.