Legal
Privacy Policy
CyberVijay Technologies (OPC) Private Limited respects your privacy. This policy explains what personal data we collect through this website and our business dealings, why we collect it, who we share it with, how long we keep it and how you can exercise your rights. We keep it deliberately specific: our business is assurance, and we hold ourselves to the same evidence standard we ask of our clients.
1. Who we are
CyberVijay Technologies (OPC) Private Limited (“CyberVijay”, “we”, “us”) is an enterprise cybersecurity, governance, privacy, AI governance and business continuity practice. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for personal data collected through this website and our own business operations. Where we process personal data on behalf of a client under a written contract, we act as a Data Processor and that client is the Data Fiduciary; our processing is then governed by the contract and our client’s instructions.
- Legal entity
- CyberVijay Technologies (OPC) Private Limited
- CIN
- U62090TZ2026OPC040119
- Registered office
- 28 Lakshmi Nagar, Ettimadai, Coimbatore, Tamil Nadu 641112, India
- Branch office
- 43, 1st Main, MSR Layout, Ramamurthy Nagar, Bengaluru, Karnataka 560016, India
- Telephone
- +91 87480 62262 (24/7 SOC line)
We are incorporated in India and our website is operated from India.
2. Scope of this policy
This policy applies to personal data we process when you:
- visit or browse cybervijay.com;
- submit the enquiry form, email us, or call our 24/7 SOC line;
- request a platform demonstration, proposal or assessment;
- enter into or perform a contract with us, or work for a supplier or client we deal with;
- subscribe to updates or correspond with us about our services.
It does not apply to personal data processed inside a client’s environment under a client contract, to third-party websites we link to, or to the personal data of our own personnel, which is covered by internal policies. Where a client engagement involves personal data, the terms of the relevant Master Services Agreement, Statement of Work and data-processing terms prevail over this policy.
3. What we collect
3.1 Information you give us
Our enquiry form collects only what is needed to respond:
| Field | Required | Why we need it |
|---|---|---|
| Full name | Yes | To address and identify you in correspondence |
| Company | No | To understand your organisational context |
| Work email | Yes | To reply to your enquiry |
| Phone | No | To call you if email is not practical, or for urgent security matters |
| Area of interest | Yes | To route the enquiry to the right practice lead |
| Message | Yes | To understand what you need and scope a response |
| Bot-check token | Yes | To confirm a human sent the form and block automated abuse |
We also receive whatever you choose to include in an email, attachment, call or meeting. Please do not send us sensitive personal data (for example health data, financial account details, identity documents or production credentials) through the website form.
The form does not store submissions on the website. It sends them by email to our enquiry inbox through our hosting platform’s managed function, so your message reaches a person rather than a database.
3.2 Information collected automatically
When you visit the site, our hosting and analytics providers may record:
- IP address (truncated or anonymised where the service allows it);
- browser type and version, operating system, device type and screen size;
- pages viewed, referring page, links clicked and time on page;
- approximate location derived from IP address (city or region level);
- security and diagnostic logs, including timestamps, request paths and error codes.
Analytics is loaded only after you accept it. Our security logs are kept separately and are used to protect the site, not to profile visitors.
3.3 Information from third parties
We may receive your name, role and business contact details from your colleagues, from a mutual contact, from a public professional profile, or from an event organiser where you have agreed to share them. We may also receive references and due-diligence information about suppliers. We do not buy contact lists or scrape personal data.
4. How we use personal data
- To answer you. Respond to enquiries, arrange calls, prepare proposals and provide the information you ask for.
- To deliver services. Perform contracts, manage engagements, produce reports and evidence, and support audits and certifications.
- To run our business. Maintain business records, invoice, manage suppliers, and keep our finance and compliance records accurate.
- To keep the site secure. Detect and prevent fraud, spam, abuse and attacks; investigate incidents; maintain availability.
- To improve the site. Understand which content is used, in aggregate, so we can make it clearer. We do not use analytics to make automated decisions about you.
- To meet legal duties. Comply with applicable law, regulatory requests, tax and corporate obligations, and enforce our rights.
- To send updates. Only where you have asked for them or where the law permits; every message includes an unsubscribe route.
We do not sell personal data, we do not rent or trade contact lists, and we do not use your enquiry to train third-party AI models. We do not make decisions with legal or similarly significant effects about you by automated means alone.
5. Legal bases for processing
Under the DPDP Act, we process personal data on the basis of your consent or one of the legitimate uses the Act recognises — for example where you have voluntarily provided data for a specified purpose without indicating that you object, where processing is necessary to perform a contract you are part of, or to comply with a legal obligation. Consent is free, specific, informed, unconditional and unambiguous, and can be withdrawn at any time.
Where the EU or UK GDPR applies to you, we rely on:
- Consent — for analytics cookies and marketing updates;
- Legitimate interests — to respond to business enquiries, secure the site and improve our services, balanced against your rights;
- Contract — to perform an engagement or supplier agreement;
- Legal obligation — to keep statutory records and respond to lawful requests.
We do not rely on consent where we process data to establish, exercise or defend legal claims, or where the law requires us to keep records. You can object to processing based on legitimate interests at any time using the contact details in section 14.
8. International transfers
We are based in India and primarily process data there. Some service providers — including Microsoft, Google and GoDaddy — may process data in other countries. Where personal data is transferred outside India, we do so in line with the DPDP Act and any restrictions the Indian Government notifies, and we use contractual safeguards with our processors. Where the GDPR applies, transfers outside the EEA or UK rely on an adequacy decision or the European Commission’s Standard Contractual Clauses together with the UK Addendum where relevant.
Client engagement data is processed in the locations agreed in the applicable Statement of Work, and we will not change those locations without the client’s written agreement.
9. How long we keep data
- Website enquiries that do not become engagements — up to 24 months from the last contact, then deleted;
- Analytics data — up to 14 months, in aggregate;
- Security and server logs — up to 12 months, unless needed for an investigation;
- Client engagement records — for the term of the engagement plus the period required by contract and professional practice, typically 7 years, then deleted or anonymised;
- Financial and statutory records — for the period required by Indian company, tax and audit law;
- Marketing consents and unsubscribe records — kept while the consent is live and for a short period afterwards to honour your choice.
Retention periods are reviewed periodically. When data is no longer needed we delete it securely or irreversibly anonymise it.
10. How we protect data
As a security practice, we apply controls we would recommend to a client:
- encryption in transit using TLS 1.2 or higher, with HSTS enforced on this site;
- encryption at rest for systems that store personal data;
- least-privilege access, multi-factor authentication and role-based permissions;
- logging and monitoring of administrative access and changes;
- secure development practices, dependency scanning and pre-release review;
- confidentiality undertakings and data-protection training for our people;
- documented incident response with defined escalation and notification paths.
No method of transmission or storage is entirely secure. If a personal data breach occurs, we assess it promptly and notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act, and our clients and regulators where their contracts or the law require it. If you believe you have found a vulnerability in this site, please report it to engage@cybervijay.com with the subject line “Security disclosure”; we welcome coordinated disclosure and will not pursue action against good-faith research.
11. Your rights
As a Data Principal under the DPDP Act, you have the right to:
- Access — obtain a summary of the personal data we process about you and the identity of those we share it with;
- Correction and completion — ask us to correct inaccurate or misleading data, or complete incomplete data;
- Erasure — ask us to erase data that is no longer needed for its purpose, subject to legal retention duties;
- Withdraw consent — at any time, as easily as you gave it; withdrawal does not affect processing already carried out;
- Nominate — name another individual to exercise your rights in the event of death or incapacity;
- Grievance redressal — complain to us first, and then to the Data Protection Board of India if you are not satisfied.
Where the GDPR applies, you also have the right to:
- object to processing based on legitimate interests, and to direct marketing at any time;
- request restriction of processing and data portability;
- not be subject to decisions based solely on automated processing that produce legal or similarly significant effects;
- lodge a complaint with your local supervisory authority.
To exercise any right, use the CyberX Find data rights portal, or email engage@cybervijay.com with the subject line “Data rights request”. We may need to verify your identity before acting. We respond within 30 days, or sooner where the law requires; if we need longer we will tell you why. There is no charge unless a request is manifestly unfounded or excessive. If we cannot fulfil a request, we will explain the legal basis for refusal.
12. Children
This website and our services are directed at organisations and business professionals. We do not knowingly collect personal data of children under 18, and we do not process children’s data for tracking, behavioural monitoring or targeted advertising. If you believe a child has provided us personal data, contact us and we will delete it.
13. Third-party links and changes
Our site may link to third-party sites, standards bodies or research. We are not responsible for their privacy practices; please read their policies. We may update this policy to reflect changes in our services, technology or the law. The version and date at the top of this page always show the current version. Where a change materially affects how we use your data, we will highlight it on the site or, where we hold your contact details and the law requires it, tell you directly.
14. How to contact us and raise a grievance
Questions, requests and complaints about privacy go to our privacy contact. We aim to acknowledge every grievance within 7 days and resolve it within 30 days.
Privacy contact and Grievance Officer
CyberVijay Technologies (OPC) Private Limited
28 Lakshmi Nagar, Ettimadai, Coimbatore, Tamil Nadu 641112, India
Email: engage@cybervijay.com
Telephone: +91 87480 62262
If you are not satisfied with our response, you may escalate to the Data Protection Board of India under the DPDP Act, or to your local supervisory authority where the GDPR applies. This policy is governed by the laws of India, and the courts at Coimbatore, Tamil Nadu have jurisdiction, without affecting any rights you have under mandatory data-protection law where you live.
This policy should be read with our Terms & Conditions and Cookie Policy. It is reviewed at least annually and whenever our processing changes.