Legal Preamble

This Privacy Policy ("Policy") is published in accordance with the provisions of Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("IT Rules") under the Information Technology Act, 2000 ("IT Act"), and in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Definitions & Interpretation

2. Information Collection & Lawful Basis

2.1. Categories of Data Collected

A. Personal Data Provided Voluntarily

• Contact Information: Full legal name, business email, corporate address, telephone/mobile numbers
• Corporate Information: Company registration details, GSTIN, PAN, corporate identity documents
• Professional Data: Designation, department, professional qualifications
• Project Requirements: Technical specifications, business objectives, compliance requirements
• Communication Records: Emails, meeting minutes, call recordings (with consent)

B. Data Collected Automatically

• Technical Information: IP addresses, device identifiers, browser type, operating system
• Usage Data: Website navigation patterns, service usage metrics, audit logs
• Cookies & Similar Technologies: Session cookies, authentication tokens, analytics cookies

C. Sensitive Personal Data (If Required)

2.2. Lawful Basis for Processing

Under Section 4 of the DPDP Act, 2023, we process Personal Data only for lawful purposes, including:

• Performance of contract with the Data Principal
• Compliance with legal obligations under Indian laws
• Legitimate business interests, subject to Data Principal's rights
• Consent obtained through explicit affirmative action

3. Data Processing & Storage Framework

3.1. Purpose Limitation

We adhere to the principle of purpose limitation under Section 5 of the DPDP Act. Personal Data is processed only for specific, explicit, and legitimate purposes disclosed at the time of collection.

3.2. Data Localization & Cross-Border Transfer

In compliance with applicable Indian regulations:

• Primary storage of Personal Data occurs within Indian territory
• Cross-border transfers follow adequacy framework under Section 16 of DPDP Act
• Standard Contractual Clauses executed for international data transfers
• Data localization requirements for sensitive categories strictly observed

3.3. Retention & Deletion Schedule

• Client project data: Retained for 7 years post-project completion as per Indian accounting laws
• Marketing data: Retained until consent withdrawal or 2 years of inactivity
• Employee data: Retained for 7 years post-employment termination
• System logs: Retained for 180 days as per CERT-In directions

4. Data Security & Compliance Measures

4.1. Security Standards Implemented

• IS/ISO/IEC 27001:2022 certified Information Security Management System
• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Regular VAPT (Vulnerability Assessment and Penetration Testing) as per CERT-In guidelines
• Role-Based Access Control (RBAC) with MFA implementation
• Security Incident and Event Management (SIEM) system

4.2. Breach Notification Protocol

In the event of a data breach involving Personal Data, we follow the mandatory breach notification requirements under Section 8(6) of DPDP Act:

• Immediate internal assessment within 24 hours
• Notification to Data Protection Board of India within 72 hours of confirmation
• Communication to affected Data Principals in accordance with severity
• Detailed documentation maintained for regulatory review

5. Data Principal Rights & Grievance Redressal

5.1. Rights Under DPDP Act, 2023

As a Data Principal, you have the following rights under Chapter III of the DPDP Act:

• Right to access information about personal data processing (Section 11)
• Right to correction and erasure of inaccurate/incomplete data (Section 12)
• Right to grievance redressal (Section 13)
• Right to nominate a representative (Section 14)
• Right to withdraw consent (Section 6)

6. Third-Party Disclosures & Processing

6.1. Categories of Third Parties

• Data Processors: Cloud service providers, payment gateways, analytics providers
• Legal & Regulatory Bodies: As required under Indian law or judicial process
• Business Transfers: In case of merger, acquisition, or asset sale

6.2. Due Diligence Framework

All third-party processors undergo comprehensive due diligence including:

• Security compliance verification (ISO 27001/SOC 2)
• Data processing agreements with DPDP Act compliance clauses
• Regular security assessments and audits
• Data protection impact assessments for high-risk processing

7. Policy Updates & Governing Law

7.1. Amendment Procedure

This Policy may be updated periodically to reflect:

• Changes in applicable laws (IT Act, DPDP Act, IT Rules)
• Modifications in business practices
• Technological advancements

Material changes will be notified 30 days in advance via email and website notification.

7.2. Governing Law & Jurisdiction