Platform privacy policy

This policy covers the Tuskerly platform that associations use to run their membership. It is provided by XES Event Management ("we", "us"), Kerala, India. Contact: hello@tuskerly.com. The policy for this website is on the website privacy page.

Two different roles

• Member data held for an association. We process this as the association's processor, on its instructions. The association decides why it is used and is responsible for it, and its own privacy notice applies. If you are a member and want to use your rights, please contact your association.
• Our own data. What we hold about people who sign in to administer an association, about our own staff who operate the platform, and about prospective clients. We decide how that is used, and this policy applies to it.

What we collect for ourselves

• Account and sign-in data for office-bearers and operator staff: username, name, email, phone, a password hash, authenticator and passkey registrations, sign-in history, devices and IP addresses.
• Security and audit records of actions taken in the platform, which we keep to protect the service and as the association's record.
• Enquiries you send us and the details you give in them.
• Technical data needed to run and secure the service: logs, error reports, and cookies that are strictly necessary for signing in.

Why we use it

• To provide, secure and support the service, and to keep accounts safe.
• To meet legal duties, including incident reporting to CERT-In and record keeping.
• To answer your enquiries and, with your consent, to tell you about the service.

Who we share it with

Only the service providers that help us run the platform (hosting, database, file storage, email, and WhatsApp for one-time verification codes), and authorities where the law requires. The providers we use are on the sub-processors page, and the terms we work under are in the data processing agreement. We do not sell personal data.

One-time codes

To confirm a phone number or email address, the platform sends a one-time code by WhatsApp or email. For a WhatsApp code only the phone number and the code are sent to Meta. Nothing else about the person is shared.

How long we keep it

Account data for as long as the account exists and for 12 months afterwards. Security logs for at least 180 days. Audit records for as long as the association uses the service, and afterwards for the retention period agreed with the association. Enquiries for 2 years.

Your rights and complaints

Under India's Digital Personal Data Protection Act, 2023, you may ask us for a copy of the personal data we hold about you, to correct it, or to erase it where we have no reason to keep it, and you may withdraw consent at any time. Write to our grievance officer, KK Menon, at hello@tuskerly.com and we will respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Security

We encrypt data in transit and sensitive data at rest, keep each association's data separate, require a second factor for administrators and operator staff, and record access. No system is perfectly secure, and we will tell affected parties and the authorities when the law requires.

Changes

If we change this policy, the new version will appear here with a new date.