Privacy Policy

Effective date: 13 May 2026 · Applies to all EPCdoc users worldwide

1. Who We Are

Twor India Private Limited ("EPCdoc", "we", "us", "our") is the Data Controller and operator of the EPCdoc platform, a cloud-based Software-as-a-Service (SaaS) platform for engineering, procurement, and construction project management. Our registered office is at VIOS Towers, 4th Floor, Off Eastern Express Highway, Sewri-Chembur Road, New Cuffe Parade, Mumbai 400037, Maharashtra, India.

Our Data Protection Officer (DPO) can be contacted at: dpo@tworai.com

2. Scope

This Privacy Policy applies to all personal data collected, processed, stored, or transmitted through the EPCdoc platform, website (app.epcdoc.com and epcdoc.com), mobile applications, APIs, and any related services (collectively, the "Service").

This Policy covers:

• Account holders, administrators, and end users of the EPCdoc platform
• Visitors to our marketing website
• Contacts who communicate with our sales or support teams
• Vendor portal users and external project stakeholders

3. Personal Data We Collect

3.1 Data You Provide Directly

• Account registration: name, email address, mobile number, organisation name
• Profile information: job title, department, employee ID
• Payment information: processed by Razorpay/Stripe — we do not store card details
• Communications: support tickets, contact form submissions, email correspondence
• Project data: documents, drawings, reports, and related project information you upload

3.2 Data Collected Automatically

• Usage data: pages visited, features used, session duration, click patterns
• Device information: browser type, operating system, screen resolution
• IP address and approximate geolocation (country/city level only)
• Cookies and similar tracking technologies (see Cookie Policy)
• API request logs, error logs, and performance metrics

3.3 Data We Do Not Collect

• We do not collect sensitive personal data (racial or ethnic origin, religious beliefs, health data, biometric data) unless explicitly required and consented to
• We do not collect precise real-time location data
• We do not sell, rent, or trade personal data to third parties for marketing
• We do not use personal data for advertising profiling

4. Legal Basis for Processing

5. How We Use Personal Data

• To create and manage your EPCdoc account and workspace
• To provide, maintain, and improve the EPCdoc platform and services
• To process transactions and send billing-related communications
• To send service notifications, security alerts, and support messages
• To respond to enquiries, support tickets, and feedback
• To enforce our Terms of Service and prevent fraudulent or illegal activity
• To comply with applicable laws, regulations, and legal processes
• To generate anonymised, aggregated usage statistics (no individual identification)

6. Data Sharing and Third-Party Processors

We do not sell personal data. We share data only with the following categories of processors under appropriate data processing agreements:

We require all processors to maintain appropriate technical and organisational security measures and to process data only on our documented instructions.

7. International Data Transfers

EPCdoc is operated from India. When personal data is transferred outside India or the European Economic Area (EEA), we ensure appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to third countries
• Adequacy decisions where applicable
• Binding Corporate Rules where relevant
• Contractual protections aligned with DPDP Act 2023 cross-border transfer provisions

Enterprise customers requiring data residency in specific jurisdictions (India, EU, UAE, UK) may request a preferred data residency configuration through their account settings or by contacting cs@tworai.com.

8. Data Retention

• Active accounts: data retained for the duration of the subscription
• After subscription cancellation: 90 days for data export, then securely deleted
• Billing records: 7 years (legal/tax compliance requirement)
• Security and audit logs: 2 years
• Marketing consent records: 3 years from last interaction
• Legal hold: data subject to a legal hold is retained until the hold is lifted

9. Your Rights

9.1 Rights Under GDPR (EU/UK Users)

• Right of access (Art. 15) — obtain a copy of your personal data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — 'right to be forgotten' subject to legal retention requirements
• Right to restriction (Art. 18) — restrict processing in certain circumstances
• Right to data portability (Art. 20) — receive data in machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent
• Right to lodge a complaint with your supervisory authority

9.2 Rights Under DPDP Act 2023 (India)

• Right to access information about your personal data being processed
• Right to correction and erasure of personal data
• Right to grievance redressal — we will respond within 72 hours
• Right to nominate a person to exercise rights on your behalf
• Right to withdraw consent where processing is consent-based

9.3 Rights Under CCPA/CPRA (California Users)

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information
• Right to opt-out of sale of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights
• Right to correct inaccurate personal information
• Right to limit use of sensitive personal information

9.4 Exercising Your Rights

To exercise any of the above rights, contact our DPO at dpo@tworai.com. We will respond within 30 days (GDPR) or 72 hours (DPDP Act). We may need to verify your identity before processing requests.

10. Security

We implement appropriate technical and organisational measures including:

• AES-256 encryption at rest for all stored data
• TLS 1.2/1.3 encryption in transit
• Multi-factor authentication (MFA) for all accounts
• Per-tenant data isolation — each workspace is schema-separated
• Role-based access control (RBAC) with 134 configurable permission levels
• Regular security audits and penetration testing
• Automated threat detection and incident response procedures
• Employee security training and access controls

11. Children's Privacy

EPCdoc is a professional business platform not intended for use by persons under 18 years of age. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will delete it promptly.

12. Changes to This Policy

We will notify you of material changes to this Privacy Policy via email and a prominent notice on the platform at least 30 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

13. Contact and Complaints

Data Protection Officer: dpo@tworai.com

General enquiries: legal@tworai.com

Postal address: VIOS Towers, 4th Floor, Off Eastern Express Highway, Sewri-Chembur Road, New Cuffe Parade, Mumbai 400037, Maharashtra, India

EU/UK users may also lodge a complaint with their local supervisory authority (e.g., ICO in the UK, or relevant EU Data Protection Authority).

India users may lodge a complaint with the Data Protection Board of India once established under the DPDP Act 2023.