GOLAK – JMS privacy notice

This notice is for the shop that uses GOLAK – JMS, and for the people whose details it keeps: customers, karigars, suppliers and staff. Published by Infodig Solutions Private Limited (+91 98143 84189 · info@golakjms.com · activate.golakjms.com).

For the shop: under India's Digital Personal Data Protection Act, 2023, the shop decides what personal data it collects and why, so the shop is the data fiduciary. GOLAK – JMS is a tool the shop runs on its own PC. Confirm your own notice to customers with your lawyer or CA.

Where the data is

• On the shop's main PC, in the shop's data folder (%LOCALAPPDATA%\GOLAK-JMS), and in the backups the shop makes (encrypted with the shop's own backup password).
• Tablets and screens connected to the main PC show data but keep none of it.
• Nothing is sent to the publisher or to anyone on the internet. GOLAK – JMS works without internet. WhatsApp messages are opened on the shop's own phone or PC, only when someone at the counter chooses to send one. Activating a licence is done by the owner on the publisher's activation website, usually from his phone: what that website keeps is below.

What is kept

• Customers: name, phone, address if given, PAN or Form 97 when the law asks for it, an ID and its photo when the shop takes one (KYC), sizes and preferences if the customer gives them, and everything bought, sold, pledged, ordered or paid. Greetings and offers are sent only with the customer's recorded consent.
• Staff: name, role, a PIN (kept only as a one-way hash), what they entered and when. Also each request to the owner (who asked, for what, when), each approval given while the owner was away from the PC, and which of the owner's messages each person opened in WhatsApp. The owner's messages carry the shop's day, never a customer's phone or ID.
• Karigars and suppliers: name, phone, and the metal and money between them and the shop.

Why, and for how long

• To run the shop's business and to keep the records the law requires: accounts and GST records (6 years or more), records of cash transactions and identity documents under the money-laundering rules (5 years after the business relationship ends), girvi records under the state's money-lenders law. Confirm the periods with your CA.
• GOLAK – JMS's journal cannot be edited or deleted, because accounting records must not be changed after the event. A customer's request to see or correct their details is recorded and answered from the customer's card; details the law does not require can be removed (for example an ID photo, once its keeping period has passed).

What the publisher receives

• When the shop activates a licence: the request code, which identifies the PC (a one-way code made from the PC's identity), the shop's name, the owner's mobile number if he writes it, and the IP address (the internet address) the activation came from. No customer or staff data.
• Only if the shop chooses to send it when asking for help: the diagnostics file, which holds each error's kind, its place in the program and how often it happened, and the program's checks. It holds no raw log, and it never holds the shop's database.
• Only if the shop's owner makes it and sends it himself: the feedback file, which the program's own privacy notice describes.

What the activation website keeps, why and for how long

For these details the publisher, not the shop, decides what is kept and why.

• The shop's name, the request code, the licence key made, the pack and the time: to show the same key again on the same PC, to add the standby PC once, and to renew the licence. Kept for as long as the publisher keeps the shop's licence records. They are copied into the publisher's licence register.
• The owner's mobile number, only if he writes it (the key is given without it): to remind him before the licence runs out, and to call him about the licence. Kept with the licence records and copied into the publisher's register. The owner may ask the publisher to remove it; reminders then stop.
• The IP address, after a wrong pack code: to stop anyone guessing codes (after repeated wrong pack codes from one address, that address waits an hour). Kept for an hour, and deleted at the next activation after that.
• The IP address, with each activation: to look into a pack used where it should not be. Kept with that activation on the website. It is not copied into the publisher's register.
• The IP address, in the website's own log of the pages asked for, with the time: to find faults and attacks. Kept for as long as the server's log settings keep it.
• Renewing a licence keeps the same, without the mobile number.

The distributor list on golakjms.com

For these details the publisher decides what is kept and why.

• Each distributor's name, business name, town, mobile number, the districts and areas he covers and, if he agrees, a photo of his face: shown on golakjms.com/distributors so that a shop can check that the man who comes to install GOLAK is ours. Kept while he is a distributor. When he stops, he is taken off the list the same day, and his name, town and the date he stopped are shown under "No longer GOLAK distributors" so that shops are not misled, unless the publisher hides them. A distributor may ask the publisher to correct his details.
• The admin's log: each change to the list, each sign-in and each refused sign-in, with the time and the internet address it came from, to find a misuse of the admin. Kept on the server.

Security

The shop's backups are encrypted. Staff sign in with their own PIN; the owner's PIN is needed for sensitive changes; every change is recorded with who made it. The shop is responsible for the PC itself: a Windows password, up-to-date Windows and antivirus, and keeping backups away from the shop.