Privacy Policy

This policy explains how CopperLoop Technologies LLP (“CopperLoop”, “we”, “us”), a limited liability partnership registered in India, handles personal data in the Sutra platform (the “Platform”).

It applies to everyone who signs in to the Platform: CopperLoop’s own administrators, and the staff of the organizations that use the Platform to monitor their buildings (each a “client organization”). The Platform has no public sign-up; every account is created by CopperLoop at the request of a client organization.

Under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”), your client organization decides who receives an account, which sites are monitored and how the results are used. For that information your organization is the Data Fiduciary, and CopperLoop processes it on its behalf as a Data Processor, under the service agreement between us.

CopperLoop is the Data Fiduciary for the records it keeps to operate and secure the Platform — sign-in activity and the audit log — and for the accounts of its own administrators. Requests about your account are often answered fastest by your organization’s administrator; we will tell you if a request needs to go to them.

• Account information. Your full name, user ID, email address, optional phone number, role, and the projects or buildings you have access to. Your password is never stored; only an irreversible, salted hash of it is kept.
• Sign-in and security information. The date and time of sign-ins, the IP address and browser or device type used, failed sign-in attempts and any resulting temporary lockout, and requests to reset a password (including the IP address they came from).
• Activity records. An audit log of significant actions — for example creating an organization or user, registering a meter or issuing an access key — recording who performed the action, when, and from which IP address and device.
• Meter data. Energy and water readings collected from the meters installed at monitored sites, with their timestamps. These describe buildings, not individuals.
• Reports and documents. Reports generated in the Platform and certificates uploaded to it.

• To create and manage accounts and to control what each person can see.
• To send service emails, such as invitations to set a password and password-reset links.
• To collect, calculate and report energy and water consumption, including — where your organization has enabled it — to a certifying authority.
• To keep the Platform secure: to detect and prevent unauthorized access, and to investigate incidents.
• To meet our legal obligations.

We do not use personal data for marketing.

The Platform contains no advertising or analytics trackers and loads no third-party scripts. We do not sell personal data, build profiles of individuals, or make automated decisions that have legal or similarly significant effects on anyone. The Platform is a workplace tool and is not intended for anyone under 18.

The Platform sets a single cookie, which keeps you signed in. It cannot be read by scripts running in the page and is not sent with requests from other websites that could change your data. Because it is strictly necessary for the service to work, it is set without a separate consent prompt. We use no other cookies.

• Certifying authorities. Where a project is being certified, its consumption figures are made available to the certifying authority through access that is limited to that project. Every access is recorded. Personal data about your staff is not included.
• Meter manufacturers. We retrieve readings from the manufacturers’ systems. We do not share your personal data with them.
• Service providers. The companies that host the Platform, store its files and deliver its email, listed below. They process data only on our instructions and under contractual obligations of confidentiality and security.
• Where the law requires it. When we are required to by law, or by a lawful order of a court or government authority.

We do not share personal data with anyone else.

Personal data is stored in India. The Platform and its database run on servers provided by Hostinger in Mumbai, India. Reports and uploaded certificates are stored with Amazon Web Services in Mumbai, India. Email is delivered through Microsoft 365.

If a service provider processes personal data outside India, we do so only as permitted under the DPDP Act. We will notify client organizations before moving where the Platform’s data is stored to another country.

Each client organization’s data is kept separate, and the separation is enforced by the database itself as well as by the Platform. Within an organization, people see only the projects and buildings they have been granted. All connections are encrypted, passwords are stored only as irreversible hashes, credentials for meter manufacturers are stored encrypted, and accounts are temporarily locked after repeated failed sign-in attempts. The audit log cannot be altered or deleted through the Platform.

We keep personal data only for as long as it is needed for the purposes described in this policy, unless the law requires us to keep it longer.

• Account information — deleted within 90 days after an account is closed, or sooner if you or your client organization ask us to.
• Sign-in and audit records — kept for at least one year for security purposes, and for up to three years where they are needed to evidence certification submissions or to resolve a dispute.
• Meter data — kept for as long as the client organization’s agreement is in force, and deleted on request after it ends. Meter data describes buildings, not individuals.
• Generated reports — 365 days, after which the file is deleted and the report can be generated again.

To ask for data to be deleted, contact our Grievance Officer at copperlooptech@gmail.com, or ask your organization’s administrator.

If personal data is lost, disclosed or accessed without authorization, we will inform the affected client organization within 72 hours of becoming aware of it, describing what happened, what data is affected and what we are doing about it. We will also notify the Data Protection Board of India and affected individuals as the DPDP Act requires.

We will give client organizations 30 days’ notice before adding or replacing a service provider that would process their personal data, so that they can raise any objection before the change takes effect.

Under the DPDP Act you may:

• obtain a summary of the personal data we hold about you and how it is processed;
• ask for inaccurate or incomplete data to be corrected or completed;
• ask for your data to be erased where we are not required to keep it;
• withdraw consent where processing is based on your consent;
• nominate another person to exercise these rights on your behalf in the event of your death or incapacity; and
• have a grievance about our handling of your data addressed.

Where we process your data on behalf of your organization, we will pass your request to your organization and help it respond.

Questions, requests and complaints about personal data can be sent to our Grievance Officer at copperlooptech@gmail.com. We will respond within 30 days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

This policy is governed by the laws of India, and the courts in India have jurisdiction over any dispute arising from it.

When this policy changes, we update the date at the top of this page. We will notify client organizations at least 30 days before any change that materially affects how personal data is used — such as a new purpose, a new service provider or a new storage location — takes effect.

For anything about this policy, write to copperlooptech@gmail.com.