Privacy Policy & Notice

1. Overview & Data Fiduciary Identity

This Privacy Policy governs the collection, processing, and handling of digital personal data by PrivacyOS, an enterprise software product developed, owned, and operated by Vexalix Technology Private Limited, a private limited company incorporated under the laws of India, having its corporate headquarters at:

2. Dual Capacity Role: Data Fiduciary vs. Data Processor

Under the DPDP Act 2023 and GDPR, PrivacyOS operates in two distinct legal capacities:

3. Personal Data We Collect

We limit our collection to what is necessary, adequate, and relevant for specified business purposes:

• Identity & Contact Data: Full Name, professional work email, phone number, job title, company name, corporate website.
• Commercial Inquiry Data: Industry sector, organization employee count, compliance areas of interest (Consent, DSR, DPIA, Breach, SOC 2, VAPT), and inquiry messages.
• Technical & Log Telemetry: IP address, browser type and version, operating system, timestamp, session identifiers, and aggregated product usage statistics.
• Client Account Credentials: Business email, hashed passwords, enterprise SSO metadata, and multi-factor authentication (MFA) tokens.

4. Purposes of Processing & Legal Basis

5. Multilingual Notice Accessibility (DPDPA Section 5(3))

Pursuant to Section 5(3) of the DPDP Act 2023, Data Principals in India have the right to access this privacy notice and all consent requests in English or any of the 22 scheduled Indian languages specified in the Eighth Schedule to the Constitution of India (including Hindi, Bengali, Tamil, Telugu, Marathi, Gujarati, Kannada, Malayalam, Punjabi, etc.).

To request this policy or any associated consent notice in your preferred scheduled language, please contact our Grievance Officer at dpo@privacyosglobal.com.

6. Your Data Principal Rights

As a Data Principal under the DPDP Act and GDPR, you possess the following enforceable rights:

7. Data Storage, Location & Retention

All personal data managed by PrivacyOS is hosted in Tier-4, ISO 27001, and SOC 2 Type II certified Indian cloud data center regions (AWS Mumbai / ap-south-1 and Microsoft Azure Central India, Pune).

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected or to satisfy statutory legal, accounting, and reporting obligations under Indian law. Upon expiration of the retention schedule or upon a verified erasure request, data is permanently overwritten or cryptographically destroyed.

8. Sub-processors & Third-Party Disclosures

PrivacyOS never sells, rents, or monetizes personal data. We engage vetted third-party service providers (sub-processors) under strict Section 8(2) Data Processing Agreements for infrastructure, transactional email, and authentication:

• Cloud Infrastructure: Amazon Web Services India Pvt. Ltd. (Hosting, Databases, KMS Encryption)
• Corporate Collaboration: Microsoft 365 / Azure Active Directory (Enterprise SSO, Identity Management)
• Transactional Communications: Resend / Postmark (System alerts and verification emails)

9. Security Safeguards (DPDPA Section 8(5))

In accordance with Section 8(5) of the DPDP Act 2023, PrivacyOS implements comprehensive technical and organizational safeguards:

• End-to-end data encryption in transit using TLS 1.3 and at rest using AES-256 with AWS KMS keys.
• Role-Based Access Control (RBAC), mandatory Multi-Factor Authentication (MFA), and zero-trust network segmentation.
• Periodic Vulnerability Assessment and Penetration Testing (VAPT) performed by CERT-In empaneled security auditors.
• Real-time automated audit trails recording all data access and administrative modifications.

10. Grievance Redressal & Data Protection Board (DPB) Escalation

If you have concerns, inquiries, or complaints regarding the processing of your personal data, you may lodge a formal grievance with our designated Grievance Officer:

If you are not satisfied with the resolution provided by our Grievance Officer, you have the statutory right under Section 13(4) of the DPDP Act 2023 to file a complaint before the Data Protection Board of India (DPBI).