Privacy Policy
Enterprise Data Governance, Privacy Safeguards & Global Regulatory Compliance
Helix Technologies ("Helix", "we", "our", or "us") builds mission-critical operating infrastructure for modern enterprises. We treat your proprietary commercial operations, field telemetry, and corporate records with enterprise-grade confidentiality. We do not monetize, broker, or sell personal or business data under any circumstances. Data stored or transmitted through the Helix Operating System remains the exclusive intellectual and operational property of your organization.
01. Scope & Organizational Roles
This Privacy Policy applies to personal information and enterprise data collected through our website (helixco.app), the Helix OS Desktop platform, the Helix Field Mobile applications (iOS and Android), our APIs, and associated support channels (collectively, the "Services").
In delivering the Services, Helix operates under two distinct legal capacities:
- Data Controller: For direct visitors to our website, enterprise sales leads, account administrator registrations, billing records, and technical support inquiries.
- Data Processor / Service Provider: For all corporate operational records, CRM contacts, employee rosters, attendance records, expense receipts, and field sales logs uploaded, created, or synchronized by customer organizations within the Helix platform ("Customer Data"). Customer organizations maintain full legal ownership and control of Customer Data.
02. Information We Collect
Depending on your engagement model, role within an enterprise account, and active modules (such as Field Sales, ERP, or Attendance), we collect the following categories of data:
A. Information Provided Directly
Contact details (full name, corporate email address, business telephone number), organization profile, job title, commercial billing coordinates, and communications submitted through consultation forms or direct support tickets.
B. Operational Enterprise Data (Customer Data)
ERP ledger lines, vendor purchase orders, inventory counts, client accounts, transaction records, uploaded invoices, expense receipts, and employee profiles provisioned by your corporate administrator.
C. Field Telemetry & Workforce Location Data
When utilizing the Helix Mobile Field App for verified attendance check-ins, route optimization, or client visit auditing, our application collects precise geospatial coordinates (GPS/Wi-Fi/Cell triangulation) strictly during active work shifts as mandated by the customer organization's administrative rules. Location tracking is transparently indicated on the device, requires explicit operating system permissions, and is never gathered when off-shift.
D. Automated System & Telemetry Records
Internet Protocol (IP) addresses, cryptographic session tokens, browser specifications, mobile device model, OS kernel version, crash dumps, latency metrics, and audit logs capturing system interactions for tamper prevention.
03. Lawful Bases for Processing
We process personal and organizational data under established international regulatory frameworks, including the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Indian Digital Personal Data Protection (DPDP) Act:
- Performance of Contract: To provision the Helix OS runtime, synchronize offline field datasets, process subscription billing, and enforce Service Level Agreements (SLAs).
- Legitimate Interests: To detect distributed denial-of-service (DDoS) attempts, isolate multi-tenant vulnerabilities, monitor platform health, and prevent unauthorized account access.
- Legal Compliance: To satisfy corporate accounting standards, tax obligations, regulatory reporting, and lawful governmental subpoenas.
- Explicit Consent: For specific mobile hardware access permissions (e.g., camera for receipt scanning, GPS for field visit verification) and optional customer success communications.
04. How We Utilize Enterprise Information
We use the collected information exclusively to provide, maintain, and enhance the Helix platform:
- Facilitating zero-latency real-time synchronization between desktop operations dashboards and field mobile personnel.
- Compiling immutable audit trails of financial entries, inventory movements, and customer order states.
- Delivering automated alerting for low-stock thresholds, pending approval hierarchies, and team attendance discrepancies.
- Diagnosing software bugs, reproducing customer-reported issues, and testing performance hotfixes.
- Issuing critical operational notices regarding maintenance windows, security updates, and billing invoices.
05. Subprocessors & Data Sharing Architecture
Helix does not sell, rent, trade, or monetize personal data. We restrict data sharing strictly to vetted third-party technical subprocessors required to maintain production uptime, high availability, and secure communication:
| Subprocessor Type | Role / Purpose | Data Safeguard |
|---|---|---|
| Cloud Infrastructure | High-availability server hosting, isolated multi-tenant databases, and encrypted block storage | ISO 27001, SOC 2 Type II, AES-256 |
| Transactional Email & SMS | Dispatch of two-factor authentication codes, system notifications, and invitation links | TLS 1.3, Zero-Retention Logging |
| Payment Gateway | Secure processing of enterprise SaaS subscription fees and recurring billing | PCI-DSS Level 1 Compliant |
| Telemetry & Crash Analytics | Error diagnostics, API bottleneck tracing, and client-side crash telemetry | Pseudonymized / PII Scrubbed |
Every third-party subprocessor is bound by rigorous Data Processing Addendums (DPAs) obligating compliance with equivalent security standards and prohibiting data processing outside our explicit instructions.
06. Security Architecture & Safeguards
We engineer defense-in-depth security into every layer of the Helix tech stack:
All data in transit is encrypted using modern TLS 1.3 protocol suites. All persistent data, database snapshots, and object storage are secured at rest using AES-256 bit encryption.
Granular role-based access control (RBAC), multi-factor authentication (MFA) enforcement, and logical tenant isolation preventing cross-tenant data exposure.
07. Data Retention & Disposal Schedules
Helix retains Customer Data only for the active duration of the customer subscription agreement, plus an archival grace period of 60 days following contract termination to accommodate client export requests.
Upon expiration of the grace period or receipt of a validated tenant deletion request from an authorized organizational administrator, all production tenant records, relational tables, and document attachments are purged with cryptographic erasure. Redundant backup snapshots cycle out and overwrite automatically within standard 30-day snapshot rotations.
08. Data Subject Rights & Regional Protections
Depending on your location, you hold statutory rights regarding your personal data under the EU/UK GDPR, California CCPA/CPRA, and India DPDP Act:
- Right of Access & Portability: The right to request copies of personal data processed by Helix in a structured, machine-readable format (JSON/CSV).
- Right to Rectification: The right to correct inaccurate, obsolete, or incomplete records.
- Right to Erasure ("Right to be Forgotten"): The right to request permanent deletion of your personal data when no longer required for legal or contractual purposes.
- Right to Restrict or Object: The right to limit or oppose specific processing activities, including automated profiling.
- Right to Non-Discrimination: We will never deny services, alter pricing, or degrade performance if you exercise statutory privacy rights.
09. Policy Updates & Amendments
Helix reviews and updates this Privacy Policy periodically to reflect technological enhancements, operational changes, and evolving legal standards. Material modifications will be announced via in-platform administrative alerts or direct email notification to primary organization contacts at least thirty (30) days prior to taking effect. The date at the top of this document indicates its most recent revision.
10. Contact & Grievance Redressal
For privacy inquiries, data subject access requests, compliance audits, or grievance redressal, contact our designated privacy and engineering coordinators:
Inquiries regarding corporate governance, enterprise DPAs, and compliance certifications.
Direct contact for technical security evaluations, vulnerability disclosures, and architecture audits.