TriaDek Privacy Policy

2. Information We Collect

We collect only the minimum personal and operational data necessary to deliver secure enterprise ticketing services:

• Account & Profile Data: Full name, corporate email address, username, job role (Global Admin, Support Admin, Support Agent, Client Admin, Client Reporter, End User), organizational department, and one-way cryptographically salted password hashes.
• Ticket & Incident Records: Ticket summaries, incident details, priority classification (Urgent, High, Medium, Low), SLA target timers, resolution notes, Root Cause Analysis (RCA) records, assignee identifiers, and file attachments (screenshots, logs, documentation, error traces).
• Device & Telemetry Data: IP address, device hardware model, operating system type and version, browser user-agent, application release build, crash logs, and localized error reports for diagnostics.
• Authentication & Session Tokens: Secure HTTP-only session cookies, JSON Web Tokens (JWT), SAML 2.0 / OIDC identity federation tokens, and UI state preferences.

In compliance with Apple App Store Review Guidelines (including Guideline 5.1.1 on Data Collection and Storage) and Google Play Data Safety policies, the TriaDek native mobile application operates under the following transparent mobile-specific standards:

4. Legal Bases for Processing

Under the European Union GDPR, UK GDPR, and India DPDP Act, our legal grounds for processing personal data include:

• Contractual Performance (Art. 6(1)(b) GDPR): Routing tickets, maintaining SLA clocks, notifying assignees, and fulfilling master service agreements.
• Legitimate Interests (Art. 6(1)(f) GDPR): Protecting cloud infrastructure, preventing DDoS and brute-force attacks, auditing compliance, and ensuring business resilience.
• Legal Compliance (Art. 6(1)(c) GDPR): Fulfilling statutory accounting, tax, corporate recordkeeping, and lawful authority obligations.
• Consent (Art. 6(1)(a) GDPR): Delivering mobile push notifications and optional diagnostic telemetry.

5. How We Use Your Data

All collected data is utilized strictly for business and operational functionality:

• Processing, routing, triaging, and resolving technical support tickets.
• Sending real-time notification alerts (email and mobile push via FCM) regarding ticket updates, assignments, and critical SLA breaches.
• Enforcing strict Role-Based Access Control (RBAC) across organizational divisions.
• Generating operational reports, resolution velocity heatmaps, and SLA performance summaries for customer tenant administrators.
• Investigating security anomalies, preventing unauthorized system intrusions, and maintaining non-repudiation audit trails.

6. Multi-Tenant Isolation & Sub-processors

TriaDek operates on an enterprise-grade multi-tenant architecture. Every tenant organization is strictly isolated at the database, query, cache, and attachment storage tiers. No customer organization can view, modify, or query another tenant’s ticket data or directory.

We engage vetted sub-processors bound by formal Data Processing Agreements (DPAs):

7. No Sale or Monetization of Personal Data

8. Security & Encryption Controls

We enforce defense-in-depth safeguards across all layers of our software and cloud environment:

• Encryption in Transit: All HTTP and WebSocket connections are encrypted using TLS 1.3 with modern cipher suites and HTTP Strict Transport Security (HSTS).
• Encryption at Rest: Database volumes, operational backups, and uploaded attachments are secured using AES-256 encryption.
• Credential Hashing: Passwords are cryptographically salted and hashed using bcrypt/argon2 algorithms with high cost factors.
• Administrative Safeguards: Mandatory Multi-Factor Authentication (MFA) for administrative staff, automated session timeouts, and least-privilege role boundaries.

We retain customer data for the duration of the active enterprise subscription agreement. Upon account termination or written request from the customer organization:

• Customer tickets, work notes, and file attachments are securely purged within 30 calendar days, subject to statutory legal holding mandates.
• App Store & Google Play Account Deletion Requirement: In accordance with Apple App Store Guideline 5.1.1(v) and Google Play policy, mobile users have the right to request complete deletion of their account and personal data:

  How to request deletion:

  1. In-App: Navigate to Mobile App → Profile / Settings → Account Security → Request Account Deletion.

  2. Direct Privacy Request: Email our Data Protection Office at privacy@katirtek.com with your registered email and organization name.

  Upon verification, all personal profile attributes, mobile push tokens, and active credentials will be permanently erased within 30 days.

10. Cross-Border Data Transfers

Where data is transferred internationally, KatirTek ensures compliance through Standard Contractual Clauses (SCCs) approved by the European Commission, UK International Data Transfer Agreements (IDTAs), and equivalent cross-border data transfer mechanisms under applicable privacy legislation.

11. User & Data Subject Rights

Depending on your jurisdiction (GDPR, CCPA/CPRA, DPDP Act 2023), you possess the following statutory rights:

• Right of Access & Portability: Request a copy of your personal data in structured JSON or CSV format.
• Right to Rectification: Correct inaccurate or out-of-date personal information.
• Right to Erasure (“Right to be Forgotten”): Permanently delete your user profile and access credentials.
• Right to Restrict or Object: Restrict non-essential data processing.
• Non-Discrimination: We never deny service or degrade feature quality when you exercise your privacy rights.

12. Children’s Privacy

TriaDek is an enterprise B2B workflow system strictly designed for authorized business personnel and corporate IT departments. We do not solicit or knowingly collect personal information from individuals under 18 years of age. If we identify unauthorized minor data collection, we immediately execute secure data destruction.

13. Corporate Information & Data Protection Officer (DPO)

To exercise any privacy rights, request data exports, submit inquiries, or lodge a data protection concern, please contact our Data Protection Office: