Privacy Policy

1. Who is responsible for your data

For website visitors and prospects, Trace Global is the data fiduciary under the Digital Personal Data Protection Act, 2023 (India) and the business under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), where those laws apply.

For personal data contained in customer bills, account records and platform exports, the customer decides why and how the data is processed and Trace Global acts as a data processor or service provider under the Data Processing Addendum available at /legal/dpa.

2. Data we collect

Data you give us: name, work email, phone number, job title, company, site and account counts, and anything you write in a form, support request or call.

Data from customer accounts: utility bills, meter and account numbers, service addresses, usage and demand data, utility EDI 810 files, portal sign-in metadata, and AP invoice images. These records usually identify businesses and sites. They may include the name of an individual billing contact or, for sole proprietors, the account holder.

Data collected automatically: IP address, device and browser type, pages viewed and referring page, collected through the cookies described in our Cookie Policy.

3. Why we use data and our legal basis

We use data to deliver the audit and recovery service, file refund claims under your letter of authorization, run the platform, secure our systems, answer requests, send service notices, and meet legal obligations.

Under the DPDP Act we rely on your consent or on the legitimate uses the Act permits, including performing a contract and complying with law. Where you are in the European Economic Area or United Kingdom, we rely on contract performance and legitimate interests.

We do not sell personal data. We do not use customer bill data to train generative models, ours or anyone else's.

4. Who we share data with

We share data with the utilities and regulators that receive claims you have authorized us to file, and with the subprocessors listed at /legal/subprocessors, which host, secure and support the platform under written contracts.

We may disclose data to professional advisers, to a buyer in a merger or asset sale on the same terms as this policy, and to authorities where the law requires it.

5. Where data is stored and transferred

Customer bill data is stored in Amazon Web Services regions in the United States (us-east-1 and us-west-2). Trace Global staff in India access that data remotely through audited, role-based access. Transfers out of India comply with the DPDP Act and any restrictions notified by the Government of India.

Where personal data of EEA or UK residents is transferred, we use standard contractual clauses or an equivalent lawful transfer mechanism.

6. Retention

We keep customer bill and claim records for the term of the agreement plus the period needed to complete open claims and meet audit and tax obligations, normally up to seven years, then delete or anonymize them. Customers can request earlier deletion of data that is not needed for an open claim.

Website and marketing records are kept for up to 24 months after our last contact with you.

7. Your rights

Under the DPDP Act you may request access to a summary of your personal data, correction, completion and erasure, withdraw consent, nominate another person to exercise rights on your behalf, and lodge a grievance with us and then with the Data Protection Board of India.

California residents may request to know, access, correct, delete and port their personal information, and may opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising. We do not discriminate against anyone for exercising these rights.

To exercise a right, email privacy@traceglobal.si. We verify your identity and respond within 30 days, or sooner where the law sets a shorter period.

8. Security

We encrypt data with AES-256 at rest and TLS 1.3 in transit, give utility portals read-only access, limit staff access by role, log administrative actions and test controls under our SOC 2 Type II and ISO 27001 aligned programs. Report a suspected incident to security@traceglobal.si.

9. Children

The service is for businesses. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, write to privacy@traceglobal.si and we will delete it.

10. Changes and contact

We post changes to this policy on this page with a new updated date and notify customers of material changes by email. Questions and grievances go to our privacy contact at privacy@traceglobal.si or by post to the registered office above.