Privacy statement

Version 2026-10-30. The portal records which version each person accepted, and when.

Overview

SpeakUpSafe is a speak-up and case-management service: companies use it to receive concerns from their people, by web, voice or a QR code, and to handle each case to the end. We want everyone who speaks up to trust it, so we explain plainly what happens to personal data, beyond what the law asks.

We use personal data only for the purpose it was collected for, or one close to it. This statement has two parts, because we play two roles:

Part A: this website, the sign-up form and our own contact with you. Here SpeakUpSafe decides why and how data is used (the data fiduciary under India's DPDP Act 2023, the controller under GDPR).
Part B: the portals we run for companies. There each company decides, and SpeakUpSafe processes data only for it and on its instructions (the data processor).

Part A. 1. What part A covers

Part A covers personal data SpeakUpSafe handles for itself, including about the people at our customers and partners we deal with. It covers:

speakupsafe.com and its pages, and any site of ours that links to this statement;
online sessions and demos we run;
meetings, events and messages in which we talk to you about SpeakUpSafe.

It does not cover another company's website or service, even if we link to it. A company's portal is covered by part B and by that company's own notice.

Part A. 2. How we collect personal data

We collect it in three ways: you give it to us, it comes from someone else, or our site records it as it works.

When you give it to us

The contact and plan request form: your name, work email, phone if you add it, company, its size, the plan you ask about and your message.
Signing your company up: your name, role, work email, phone, company name, country and size, and whether you want to hear about plans.
Find my portal: the work email you type, to send you your company's link.
Emails, calls and meetings with us: what you choose to tell us.

When it comes from someone else

If you sign up with Google or Microsoft, they send us your name and email address and whether the address is confirmed.
If a colleague introduces you to us, they may give us your name and work email.

We do not buy lists of people, and we do not use advertising networks or data brokers. We do not combine your data with data bought from others.

What the site records by itself

Our servers see your network address, browser and the page asked for, to deliver the page and to stop attacks. For sign-up we keep a scrambled form of the network address, to stop repeated automated sign-ups, and the time you agreed to the terms.

The site uses only the cookies it needs to work: sign-in, language, theme and, in the demo, which sample company you are looking at. There are no advertising, tracking or analytics cookies, so there is nothing to turn on or off. Blocking these cookies in your browser may stop sign-in from working.

Part A. 3. Children

The website is not meant for anyone under 18 (a child under the DPDP Act). We do not knowingly collect a child's data without a parent's verifiable consent, and we delete it if we find we have.

Part A. 4. Why we are allowed to use it

We use your data because you agreed (for example to hear about plans), because we need it to do what you asked (for example to set up your portal or answer your message), because of a legitimate use the law allows that does not outweigh your rights, or because the law requires it. Sometimes we need it to make, use or defend a legal claim. Which one applies depends on the situation.

Part A. 5. Do-not-track signals

We do not track you across websites, so a browser's do-not-track or Global Privacy Control signal changes nothing here: we already behave as if it were on.

Part A. 6. How we use it

to run the website and the service you asked for;
to answer your messages and support requests;
to set up and check a company's sign-up, and to tell you about it;
to tell you about plans and changes, only if you agreed, and to ask what you think of the service;
to keep the site and the portals secure, including by reading their security logs;
to understand, as totals, how the site is used and to improve it;
to run our business: billing, accounts and audits;
to look after our relationship with customers and partners;
to meet legal, tax and record-keeping duties;
to protect ourselves and others in a dispute, to follow a court order, and to enforce our Terms of use and this statement.

We do not use your data for anything that does not fit these purposes. Data in the portals is handled under part B, not here.

Part A. 7. Artificial intelligence

Saathi, the helper on our pages, answers from a fixed set of answers we wrote; what you type is not kept. Optional AI help on the website (from the supplier listed in the Trust centre) is off unless we turn it on, keeps nothing, and is never used for decisions about you. We never use reports or case data to train any AI model.

Part A. 9. How we keep it safe

We use organisational, physical and technical safeguards against loss, misuse, access without permission, change and destruction: encryption in transit and at rest, two-step sign-in for our staff, a log that can't be changed, encrypted backups and access only for the people who need it. The Security and Trust pages give more detail.

Part A. 10. How long we keep it

We keep data only as long as its purpose needs, and longer only where the law requires: for example while your company is a customer, to meet tax and legal duties, to settle disputes and to enforce agreements. We delete enquiries we no longer need, and review what we keep at least once a year. Sign-in details are kept for 90 days.

Part A. 11. Where it is kept, and transfers

SpeakUpSafe is run from India, and its data is stored in India (Mumbai). Our network protection and email suppliers work worldwide, so some data passes through other countries.

When data from the European Economic Area, Switzerland or the United Kingdom comes to India, we protect it with the European Commission's standard contractual clauses (or the UK and Swiss versions), as India has no adequacy decision. Where the law of a country in the Middle East, such as the UAE or Saudi Arabia, sets rules for data leaving it, we follow them.

SpeakUpSafe is not a US company, so the EU-US Data Privacy Framework does not apply to us.

Part A. 12. Complaints

Write first to our Grievance Officer, SpeakUpSafe, at [email protected]. We acknowledge every complaint and answer within the time the DPDP Rules set.

If our answer doesn't settle it, you can complain to the Data Protection Board of India (DPDP Act s.18), which takes complaints online. In the European Union or the UK you can also complain to the data protection authority where you live or work.

Part A. 13. Your rights

You can see, correct or delete the data we hold about you, and stop our emails.

Changing your details

Write to [email protected] with the subject "Update my details" to change your name, contact details, job title or email choices.

Stopping our emails

Use the unsubscribe link in any email about plans, or write to [email protected]. We will still send emails you need for the service, such as sign-in codes and replies to your requests.

Your rights in detail

Depending on where you live, and with some exceptions the law allows, you can:

get a summary of the data we hold about you and how we use it, where it came from, who we share it with and how long we keep it (DPDP Act s.11; GDPR art.15);
have it corrected, completed, updated or erased (DPDP Act s.12; GDPR arts.16 and 17);
object to its use, or ask us to limit it (GDPR arts.18 and 21);
get a copy in a usable format, or have it sent to another organisation where that is possible (GDPR art.20);
withdraw your consent at any time, as easily as you gave it; this does not undo what was lawfully done before;
name another person to use your rights if you die or cannot act (DPDP Act s.14);
complain to us and then to the authority, as Part A section 12 says.

To use any of these, write to [email protected] with the subject "Personal data request" and tell us what you want.

Checking it is you, and answering

We may ask for a little more information to make sure the request comes from you, or from someone allowed to act for you, before we share or change anything.

We answer within the time the law sets (one month under GDPR, and the period in the DPDP Rules). If we need longer, we tell you why.

We may refuse a request where the law requires us to keep the data, where we cannot confirm who you are, where it would take disproportionate effort, or where the law lets us keep it. We always tell you why.

Part A. 14. Other services and social media

Links, sign-in buttons and other services on our site, such as Google and Microsoft sign-in, are run by those companies under their own privacy policies. If you post about SpeakUpSafe on a social network, for example LinkedIn, that post is public and the network's policy applies. We are not responsible for how other services handle data, so please read their policies.

Part A. 15. Changes to this statement

We may change this statement. The new version applies once it is posted here; the date at the end shows the latest one. When a change matters for people using a portal, the portal asks them to read and accept the new version.

Part A. 16. Contact

Questions or complaints: Grievance Officer, SpeakUpSafe, [email protected]. If we don't settle it, you can go to the authorities named in Part A section 12.

For the sign-up form SpeakUpSafe decides how the data is used. We keep your name, role, work email, phone, company name, country and size to set up the portal, to check the sign-up is real, and to contact you about it. If you tick the box, we may also tell you about plans; write to us at any time to stop. We keep a scrambled form of the network address you signed up from, to stop repeated automated sign-ups, and when you agreed to the terms.

Ask us at any time to see, correct or delete what we keep about you.

Part B. 1. The portals

Part B covers the portals SpeakUpSafe runs for companies: the employee portal (where people raise and follow concerns), the case team portal, company settings, calls, kiosks and Saathi inside them. It does not cover sites or services that have their own notice. This website is covered by part A.

Your company decides why and how your data is used in its portal (it is the data fiduciary or controller). SpeakUpSafe processes the data only for your company, under its contract and instructions. Each company shows its own privacy notice before first use, naming its contact for privacy questions and complaints.

Part B. 2. How the portals collect personal data

Data reaches a portal when your company sets it up, when you use it to report, follow up or handle a case, by phone or a kiosk, and automatically as the portal works.

What each part of the portal keeps

Employee portal: your work email and name, to sign you in; your reports, messages, files and voice notes, encrypted with a key for your company. An anonymous report is kept without your name or account; you follow it with a key and, if you add one, a PIN.
Reports without an account and from a kiosk: no network address is kept with the report.
Case team portal: the names, roles and actions of the people handling cases, in a log that can't be changed, and the case's notes, tasks, interviews and letters.
Company settings: the company's details, branding, channels, categories and rules, and the list of its people.
Calls: nothing is recorded. A reporter's voice can be changed and their camera blurred. A transcript is made only when everyone in the call says yes, in each person's own browser, and only the text is kept with the notes.
Declarations, surveys and protection check-ins: the answers given, for the purpose your company states.
Sign-in details: time to the hour, device type, browser, time zone and country, for 90 days. Employee sign-in times are kept out of the company's log so they can't be matched to anonymous reports.

What the portal records by itself

The portals use only the cookies they need: sign-in, language and theme. Network addresses are used to protect sign-in and are not kept with anonymous reports.

What your company gives us

Your company may give the portal its people's names, work emails, departments and roles, by upload, by its directory or by single sign-on, only to let them sign in and to route cases.

Part B. 3. Why the portal may use it

Your company decides the legal ground for using data in its portal, often a legal duty (for example the POSH Act 2013, the Companies Act 2013 s.177, SEBI's rules or the EU Whistleblowing Directive) or a legitimate use. Questions about it go to your company.

Part B. 4. How SpeakUpSafe uses it

to run the portal for your company, as it instructs;
to keep the portal secure and find misuse;
to send the notices the portal sends, such as sign-in codes and "you have a reply" (never the report's content);
to help your company when its admin starts a support session, which is logged step by step;
to meet legal duties and settle disputes.

Part B. 6. How it is kept safe

Each company's reports, messages and files are encrypted with that company's own key. Staff use two-step sign-in, every action on a case is in a log that can't be changed, and our own staff cannot read cases.

Part B. 7. How long it is kept

Your company sets how long closed cases are kept (1 to 10 years), after which they are anonymised or deleted, unless they are under a legal hold. Staff accounts close when the company removes the person; their actions stay in the case log for the case's period.

Part B. 8. Where it is kept

Everything in the portals is stored in India (Mumbai). Transfers follow Part A section 11.

Part B. 9. Your rights

Ask your company to see, correct or erase your information, or to explain how it was used (DPDP Act s.11 to 13; GDPR arts.15 to 22). If you write to us instead, we pass your request to your company and help it answer. Some rights can be limited while an investigation is open.

You can withdraw your consent at any time: stop using the portal and ask your company's compliance team to close your account. A report already made stays with its case while it is handled, because the law requires the case to be completed.

Part B. 10. Changes

When this part changes in a way that matters, the portal shows the new version and asks you to accept it.

Part B. 11. Contact

First your company's privacy contact, named in its notice. For SpeakUpSafe: Grievance Officer, SpeakUpSafe, [email protected].

Last updated 30 October 2026. This document is under legal review.