Privacy policy
What we collect, why, where it is kept and how you control it. We do not sell personal data, show advertising or use your records to train AI models.
Who we are and our two roles
Openn Assets is run by The Openn Group, a sole proprietorship registered in India and owned by Amit Singh Rawat, in Bengaluru, Karnataka, India (“we”).
For the people who sign up and run a workspace, we decide how their account data is used. Under the GDPR we are the controller; under India’s Digital Personal Data Protection Act 2023 we are the data fiduciary.
For the employees and contractors a customer records in Openn Assets, the customer decides what is recorded and why. The customer is the controller (or data fiduciary) and we are its processor: we handle that data only to run the service, on the customer’s instructions, under our data processing terms. If you are an employee and want to see, correct or delete what your employer holds, ask your employer first; we will help them answer you.
What we collect
- Account details: your name, work email, a scrypt hash of your password (never the password itself), whether you use an authenticator app, and the workspaces and roles you belong to.
- Workspace records, entered or imported by the customer: employee names, work emails, employee IDs, departments, managers, locations and joining or leaving dates; assets, serial numbers, assignments, receipts, returns, warranties, licences and the files attached to them.
- Security records: your IP address and browser with each sign-in session, sign-in attempts used to stop password guessing, and the audit trail of changes made in a workspace.
- Email records: who each email went to, what kind it was and whether it was delivered.
- What you send us when you write to support or privacy.
We set one cookie, to keep you signed in. There are no analytics, advertising or tracking cookies, and no third-party scripts on our pages.
Why we use it
- To run the service you signed up for: storing records, sending the emails the service sends, and showing each person only what their role allows.
- To keep accounts and workspaces secure, find and stop abuse, and keep a reliable audit trail.
- To answer support requests and to bill paid plans.
- To meet legal duties, such as keeping invoices.
Our legal basis is the contract with the customer, our legitimate interest in running a secure service, and legal obligation. We do not use personal data for advertising, profiling or sale.
Openn Assets sends emails because of what someone does in a workspace: a handover receipt to accept, a request to return an item, a reminder, a sign-in code. They are sent on the customer’s behalf through our email delivery provider, ZeptoMail by Zoho, and contain only what the email needs.
Where data is kept
Our server, database, files and backups are on Google Cloud in the United States. Cloudflare sits in front of the site, so requests pass through its network on their way to us. The companies that handle data for us are listed on the sub-processors page.
Where personal data moves between countries, we rely on our providers’ data protection terms, including the European Commission’s standard contractual clauses where they apply.
How long we keep it
Account details are kept while the account is open. Workspace records are kept until the customer deletes them or closes the workspace. After a workspace is closed we keep it for 30 days so it can be exported, then delete it; backups that contain it expire on a rolling basis after that. Invoices are kept for as long as tax law requires.
The audit trail is part of a workspace and goes when the workspace goes. It cannot be edited while the workspace exists, which is what makes it trustworthy.
Export and deletion
Workspace admins can export assets, people, licences and history to CSV at any time, on every plan. A workspace owner can ask us to close and delete the workspace by writing to privacy@theopenngroup.com.
Your rights
Depending on where you live, you can ask to see the personal data we hold about you, correct it, have it deleted, take a copy with you, or object to or restrict how it is used. Under the DPDP Act you can also seek redress of a grievance and nominate someone to act for you. In the EU and UK you can complain to your data protection authority.
Write to privacy@theopenngroup.com from the address on your account. We may need to confirm it is you. We reply within the time the law sets, and sooner where we can.
Security
How we protect data is set out on the security page. If we learn of a breach that affects personal data, we tell affected customers without undue delay, and the authorities where the law requires.
Children
Openn Assets is a tool for organisations. It is not meant for anyone under 18, and we do not knowingly collect children’s data.
Changes and contact
When we change this policy we update the date at the top, and for meaningful changes we email workspace owners before they take effect.
Questions, requests and grievances: privacy@theopenngroup.com.