Terms of Use

1. Definitions

• “Platform” means the Catalyst web application and all its modules, features and services.
• “Personal Data” means any data about an individual who is identifiable by or in relation to such data, as defined under the Digital Personal Data Protection Act, 2023 (“DPDP Act”).
• “Sensitive Personal Data or Information” (SPDI) has the meaning given under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and includes financial information such as bank account and payment details.
• “Data Fiduciary” means the Company, which determines the purpose and means of processing your Personal Data.
• “Data Principal” means you, the individual to whom the Personal Data relates.
• “Location Data” means geographic coordinates and derived place names collected as described in Section 8.

2. Eligibility and Account Provisioning

Access to the Platform is restricted to individuals authorised by the Company and holding a valid Company e-mail identity (e.g. an @catalyst.sh account). Accounts are provisioned and de-provisioned by the Company. Access rights are governed by role-based access control; the features and data available to you depend on the role and department permissions assigned by the Company. You may only use an account issued to you and must not use, or attempt to use, any other person’s account.

3. Acceptable Use

You must use the Platform solely for legitimate business purposes and in accordance with these Terms, your employment agreement, and all applicable Company policies and laws. You are responsible for the accuracy of the information you enter and for all activity that occurs under your account.

4. Prohibited Conduct

You must not:

• access, or attempt to access, data or functionality beyond the permissions granted to you, or circumvent any access control, authentication or security measure;
• share, export, copy, photograph or transmit Company or personal data outside the Platform except as required for your work and permitted by Company policy;
• share your credentials, leave your session unattended on an unlocked device, or allow another person to use your account;
• introduce malware, attempt to disrupt, overload, reverse-engineer, scrape or probe the Platform, or perform any unauthorised security testing;
• use the Platform to harass, defame or infringe the rights of any person, or for any unlawful purpose;
• tamper with, falsify or delete audit, sign-in, time or location records.

5. Account Security

The Platform authenticates you through your Company Google identity and issues a session limited to your device. You must keep your credentials confidential, use the Platform only on Company-approved or adequately secured devices, and promptly report any suspected compromise, unauthorised access or lost device to the Grievance Officer (Section 17). The Company may suspend or revoke access at any time to protect the security or integrity of the Platform.

6. Monitoring, Logging and Audit

To protect the security and integrity of the Platform and for legitimate business and compliance purposes, the Company records and retains logs of your use of the Platform. This includes, without limitation, sign-in activity (date and time, method, device/browser information and IP address), actions taken within the Platform, and administrative audit trails. These logs may be reviewed by authorised personnel (such as HR, management and administrators) in accordance with Company policy and applicable law. Your use of the Platform constitutes acknowledgement of such monitoring.

7. Attendance Check-in/out and Location Data

The Platform provides an attendance feature. When you choose to check in at the start of your workday and check out at the end, the Platform records the time and, where you permit it, your location at that moment, for the purpose of verifying place of work, attendance and workforce administration.

• What is collected: the date and time of your check-in and check-out, the browser/device you used, and — only if you allow location access — approximate geographic coordinates and a human-readable place name derived from them.
• Consent: location is captured only when you take the check-in/check-out action and your browser or device grants location permission. If you decline location access, your attendance is still recorded, without a location.
• Who can see it: you can see your own attendance, including any recorded location, on your attendance calendar. Authorised HR and management personnel (Owner/HR roles) can also view employees’ attendance and location for workforce-administration purposes. It is not shown to your colleagues generally.
• Third-party processing: to convert coordinates into a place name, the coordinates are sent to a third-party map/geocoding service (currently OpenStreetMap Nominatim). See Section 11.
• Retention: attendance and location data are retained as described in Section 10 and deleted when you leave the Company, subject to any legal retention obligations.
• Withdrawal: you may withhold or withdraw location permission at any time through your browser/device settings, and may contact the Grievance Officer (Section 17) with any objection or request relating to your attendance or Location Data. Withdrawal stops further location capture; it may affect attendance verification and related processes.

8. Personal Data and Privacy (DPDP Act, 2023)

The Company acts as the Data Fiduciary in respect of your Personal Data processed through the Platform. We process Personal Data — which may include your name, work e-mail, contact number, employment details, statutory identifiers (such as PAN, UAN, ESIC and bank account details), sign-in and device information, and Location Data — for employment, payroll, statutory compliance, security, and workforce-administration purposes, and on the lawful bases available under the DPDP Act (including for the performance of employment and, where applicable, consent).

Processing is limited to these stated purposes. As a Data Principal you have the rights available under the DPDP Act, including the right to access a summary of your Personal Data and its processing, to seek correction or completion of inaccurate or incomplete data, to seek erasure where no longer required for the purpose or by law, to nominate another individual to exercise your rights, and to a readily available grievance-redressal mechanism. To exercise these rights, contact the Grievance Officer (Section 17).

9. Data Security

The Company implements reasonable security practices and procedures to protect your Personal Data, consistent with the DPDP Act and the IT Act, 2000 and rules thereunder. These include encryption of sensitive identifiers at rest, restricted role-based access, network and account isolation, transport encryption, and regular encrypted backups. No system is completely secure; you are required to do your part by following Section 4 and Section 5.

10. Data Retention and Deletion

Personal Data is retained only for as long as necessary for the purposes described in these Terms or as required by applicable law (for example, statutory payroll and tax records). Certain operational logs are retained on a rolling, bounded basis — for example, a limited history of recent sign-ins and location check-ins per User. On cessation of your engagement, your account is de-provisioned and associated Personal Data is deleted or anonymised, save for records the Company is required or permitted to retain by law.

11. Third-Party Services

The Platform relies on third-party service providers acting as processors/sub-processors, including cloud infrastructure and hosting, Google (identity/authentication and file storage), and a map/geocoding provider (currently OpenStreetMap Nominatim) used to derive place names from coordinates. Your data may be processed by these providers only to the extent necessary to deliver the relevant functionality. The Company endeavours to engage providers that maintain appropriate security and privacy safeguards.

12. Confidentiality

Information accessible through the Platform — including project, client, financial and personal data of other individuals — is confidential and the property of the Company or its clients. You must not disclose, remove or use such information other than for authorised work purposes, both during and after your engagement, and in accordance with your confidentiality obligations to the Company.

13. Intellectual Property

The Platform, its software, design and content (excluding your Personal Data) are owned by the Company or its licensors and are protected by applicable intellectual-property laws. No rights are granted to you except the limited, revocable, non-transferable right to use the Platform for authorised business purposes.

14. Consequences of Misuse

Violation of these Terms may result in suspension or revocation of access, disciplinary action up to and including termination of employment or engagement, and civil or criminal liability under applicable law, including the IT Act, 2000. The Company reserves all rights and remedies available to it.

15. Availability and Changes to the Platform

The Platform is provided on an “as is” and “as available” basis for internal use. The Company may modify, suspend or discontinue any part of the Platform, and may perform maintenance, at its discretion and without liability to you.

16. Amendments to these Terms

The Company may update these Terms from time to time. Material changes will be notified through the Platform or by other reasonable means. Your continued use of the Platform after such changes take effect constitutes acceptance of the revised Terms.

17. Grievance Redressal and Contact

For any questions, requests or grievances relating to these Terms or to the processing of your Personal Data (including Location Data), you may contact the Company’s Grievance Officer:

Grievance Officer
Renu Sharma
CT Solutions Pvt Ltd
E-mail: renu.sharma@catalyst.sh
Registered office: Plot 14 Aeren, IT Park, Chandigarh

The Company will acknowledge and address grievances within the timelines required by applicable law.

18. Governing Law and Jurisdiction

These Terms are governed by the laws of India. Subject to any dispute-resolution mechanism in your employment agreement, the courts at Chandigarh, India shall have exclusive jurisdiction over any dispute arising out of or in connection with these Terms.

19. Acknowledgement

By accessing or using the Platform, you confirm that you have read, understood and agree to these Terms, including the monitoring described in Section 6 and the collection and use of Location Data described in Section 7.