This is our current published policy. For contractual agreements (DPA, MSA), contact hello@cyfriq.com.

This policy explains how Cyfriq handles personal data collected through our website. We take a data-minimisation approach: we collect only what we need, keep it only as long as we need it, and never sell it. We are committed to processing personal data in a manner aligned with India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and, where it applies, the EU and UK General Data Protection Regulation (GDPR).

Scope of this policy

This policy covers personal data we collect through the Cyfriq website and related enquiry channels. Personal data that a customer processes inside the Cyfriq product is handled under a separate contract (our Master Services Agreement and Data Processing Agreement), where Cyfriq acts as a processor on the customer's instructions. See our Data Processing Agreement overview for that arrangement.

What we collect

Information you give us. When you request a demo, download a resource or subscribe to our newsletter, we collect the details you submit — typically your name, work email address, organisation, job role, and anything you choose to include in a message. We ask only for a business context and do not seek special-category or sensitive personal data through these forms.

Information collected automatically. When you browse the site we collect limited, privacy-respecting analytics — pages viewed, approximate region derived from your IP address, referring source, and general device and browser type. We do not build advertising profiles and do not track you across other websites.

Why we use your data

To respond to demo requests, sales enquiries and other messages you send us.
To send you the newsletter or resources you have asked for, and to let you unsubscribe at any time.
To understand aggregate website traffic so we can improve our content and structure.
To keep the site secure, prevent abuse, and comply with our legal obligations.

Lawful basis for processing

Under the DPDP Act, we process personal data on the basis of your consent and for the certain legitimate uses the Act permits, such as responding to a request you have made. Under the GDPR, we rely on your consent (for example, for the newsletter) and on our legitimate interests in responding to enquiries, securing the site and understanding aggregate traffic — balanced against your rights and freedoms.

How long we keep it

We retain enquiry and demo-request data for as long as needed to deal with your request and to maintain a record of our correspondence, after which it is deleted or anonymised. Newsletter data is kept until you unsubscribe. Analytics data is aggregated and retained for a limited period. Where the law requires us to keep certain records for longer, we do so and delete them once the retention period ends.

Sharing and sub-processors

We do not sell personal data, and we do not share it for anyone else's marketing. We use a small number of trusted service providers — for example, website hosting, email delivery and privacy-respecting analytics — who process data only on our instructions and under written contract. A current list of these sub-processors is available on request from hello@cyfriq.com. We may also disclose data where required by law or to protect our legal rights.

Where your data lives

Website personal data is hosted in an India region. Where any transfer outside India is necessary, we take steps to ensure the data continues to receive an appropriate level of protection consistent with applicable law.

Your rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you and obtain a summary of how it is processed.
Correct, complete or update inaccurate or incomplete data.
Request erasure of your data where it is no longer needed.
Withdraw consent at any time, without affecting processing already carried out.
Nominate another person to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.
Where the GDPR applies, object to certain processing, restrict processing, and request portability of data you provided.
Raise a grievance and have it addressed through our grievance-redressal mechanism.

To exercise any of these rights, email hello@cyfriq.com. We will verify your request and respond within the timeframes required by law.

Grievance officer

If you have a concern about how your personal data is handled, you may contact our grievance officer at hello@cyfriq.com. We honour data-subject and grievance rights and aim to resolve every complaint promptly. You also retain the right to approach the relevant data protection authority, including the Data Protection Board of India.

Children

Our website is intended for business audiences and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us so we can remove it.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The date at the top of this page shows when it was last revised. Material changes will be reflected here on this page.

Questions?

For any privacy question or to exercise your rights, contact us at hello@cyfriq.com.

Privacy policy.