Data Policy

1. Purpose and responsible collection

Collect only information needed for customer service, property enquiries, lead follow-up, site visits, onboarding, transactions, earnings and administration. Personnel must explain relevant collection purposes and avoid adding unnecessary sensitive information to remarks or feedback comments.

Do not upload information belonging to another person without appropriate authority. Customer identity and property documents should only be collected for a relevant business requirement.

Calling-data uploads must come from an authorised source and follow applicable consent and calling requirements. Telecallers may use only assigned contacts for company work. Qualified contacts enter the sales lead pipeline with their remarks and calling history; Admin and Super Admin manage assignments.

Inventory uploads must use the dedicated seller/owner name and phone columns for private contacts. Do not place owner contacts in property addresses, builder names, specifications or other fields visible to employees and brokers. Brokers have no seller-contact access. Employees may unlock five new property contacts per week, resetting every Monday at midnight in India time; additional access requires Admin or Super Admin approval. Unlock dates and allowance week-start dates are recorded, and access continues until revoked. Weekly resets or resubmitted requests cannot undo an administrator's rejection or revocation. Staff must not share disclosed contacts beyond their authorised work.

2. Where data is stored

Structured application data is stored in the company's PostgreSQL database. Uploaded photos, brochures and documents are stored as files on the company's production server; the database holds their associated metadata. Persistent file storage is kept outside individual application releases.

Database and file backups may contain copies of these records. Backups support recovery and are not intended as public access to customer information.

Full employee Aadhaar numbers are encrypted before database storage using a separately managed encryption key. Only the last four digits are displayed. Encryption keys must be secured and backed up separately from the database, and must not be placed in source code or ordinary database backups.

3. Authorised access and confidentiality

Access is controlled through user accounts, assigned roles and permissions. Employees must keep sign-in credentials private, use records only for assigned work, and report suspected unauthorised access through the company contact provided to them.

Propways does not sell personal data or provide it to third parties for their own marketing or independent commercial use. Service infrastructure providers may process it to operate the system, and applicable legal requirements may require disclosure. For more information, read the Privacy Policy.

4. Public information and sharing

Listed project details, brochures and designated public contact information are intended for public sharing, including by WhatsApp link. Do not place private customer information in public project descriptions or brochures. Copies already downloaded or forwarded by recipients cannot be recalled through the service.

Customer and employee records, uploaded visit photos, GPS information, internal remarks and submitted feedback are not public project information. A visit feedback link reveals limited visit context and allows one review within seven days of the visit. Link possession is not independent verification of customer identity.

5. Accuracy, corrections and integrity

Authorised personnel should enter accurate data and request corrections when an error is found. Some records are locked after onboarding, review or feedback to protect their integrity. Where self-service correction is unavailable, contact the company for review rather than creating misleading replacement records.

System activity and review records support accountability. Customers and employees may request access or correction using the company contact details provided directly to them, subject to identity checks and applicable restrictions.

6. Retention and deletion

Data is retained for the relevant customer relationship, operational need, transaction, accounting, legal or dispute purpose. This policy does not specify a fixed retention period for all records, and the current application does not automatically delete all records after a set time.

Requests to delete data are reviewed by the company using the contact details it provides to employees and customers. Deletion may be limited where records must be retained for a legitimate obligation or an unresolved matter. Retained backup copies may remain until those backups are replaced or removed; deletion from active storage does not necessarily remove every backup immediately.

A feedback invitation expires after seven days, but that expiry does not delete a submitted review or its visit record. A signed file link expiring also does not delete its underlying file.

7. Security and incidents

Access-controlled accounts, HTTPS, private file storage and time-limited signed file links help protect data. Staff should promptly report lost devices, exposed links or credentials, incorrect access and suspected incidents using the company's provided contact channel.

Data should not be copied to personal systems or sent outside approved work channels without company authorisation. Security controls reduce risk but cannot eliminate it completely.

8. Questions and updates

The company provides its contact details directly to employees and customers for data requests and questions. Use those details to identify the record concerned and the action requested; avoid sending identity documents until a secure verification method has been agreed.

This policy may be updated as data handling or service requirements change. The date above identifies the latest revision.