Privacy Policy

1 Overview & Scope

This policy applies to individuals and enterprise representatives who:

• Visit our website at symanticspace.com or associated digital subdomains.
• Submit requests for proposals (RFPs), project inquiries, technology assessments, or advisory consultations.
• Engage SymanticSpace for custom software development, cloud computing, enterprise solutions, AI automation, data analytics, or corporate technology training.
• Apply for employment, consulting partnerships, or engineering positions with our team.

2 Information We Collect

We collect information solely to provide reliable technology consulting, satisfy contractual agreements, and improve our services:

A. Information Provided Voluntarily

• Contact & Identification Data: Full name, professional email address, telephone number, job title, and organization name.
• Project & Technical Discovery Details: Architecture specifications, technology stack requirements, scope descriptions, system integration points, and timelines shared during discovery calls or RFP submissions.
• Commercial & Billing Data: Corporate billing address, tax identification (e.g., GSTIN/VAT/EIN), invoicing contact persons, and authorized signatory records.
• Recruitment Information: Resumes, CVs, portfolio links, GitHub/LinkedIn profiles, and professional credentials submitted for employment opportunities.

B. Technical & Diagnostic Telemetry

When you navigate our website, our servers automatically log technical metadata necessary to secure and optimize our web presence:

• Internet Protocol (IP) address and approximate geographic region.
• Browser type, version, engine, and operating system.
• Referral sources, visit timestamps, pages viewed, time spent per page, and navigation paths.
• Performance metrics, network error logs, and session responsiveness indicators.

3 How We Use Information & Legal Bases

We process data strictly under lawful bases recognized by applicable data protection regulations, including the Digital Personal Data Protection Act (DPDP Act) 2023 and the EU General Data Protection Regulation (GDPR):

4 Client Data, NDA Primacy & Intellectual Property

As a dedicated software and IT consulting company, SymanticSpace recognizes that client systems contain highly valuable intellectual property and business-critical operations.

• Ownership of Source Code: All custom source code, documentation, schemas, and configurations built for our clients become the client's sole intellectual property as specified in the agreed Statement of Work (SOW).
• Synthetic & Masked Data Protocols: Our engineering teams mandate the use of masked, anonymized, or synthetic data fixtures for local software development and QA testing. Live production customer records are never cloned to local engineering workstations.
• Principle of Least Privilege: Access to client staging servers, cloud subscriptions, code repositories, or production consoles is strictly restricted to assigned engineers and revoked immediately upon milestone completion or contract termination.

5 Technical & Organizational Security

We maintain comprehensive defense-in-depth security measures to protect data against unauthorized alteration, disclosure, exfiltration, or destruction:

• Transport & Storage Encryption: Data in transit is secured using Transport Layer Security (TLS 1.3/1.2). Persistent data, secure vaults, and database backups are encrypted using Advanced Encryption Standard (AES-256).
• Access Controls & MFA: Multi-Factor Authentication (MFA) is strictly enforced across all internal workstations, code management systems (GitHub/GitLab), and cloud environments (AWS, Azure, Google Cloud).
• Automated Code Quality & Vulnerability Scanning: Continuous integration pipelines incorporate automated Static Application Security Testing (SAST) and software dependency scanning to eliminate known CVE vulnerabilities.
• Personnel Screening & Confidentiality: All engineers, analysts, and project managers undergo background verifications and sign binding confidentiality covenants prior to accessing any client environment.

6 Processors & Infrastructure Partners

We never sell, rent, or trade personal data or client proprietary information. We only share information with reputable sub-processors essential to our corporate operations and software delivery:

• Enterprise Cloud Infrastructure: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform for hosting environments, staging instances, and compute workloads.
• Engineering & Collaboration Platforms: GitHub, GitLab, Jira, Confluence, and Slack for project management, issue tracking, and version control.
• Productivity & Communications: Google Workspace and Microsoft 365 for encrypted business email and document collaboration.
• Legal & Regulatory Authorities: Only when legally compelled by a binding court order, regulatory warrant, or applicable statute.

Every third-party sub-processor is thoroughly vetted and bound by Data Processing Agreements ensuring equivalent security, confidentiality, and data protection guarantees.

7 Cookies & Tracking Technologies

Our website uses cookies and similar browser storage mechanisms to ensure reliable navigation and evaluate site usage:

• Strictly Necessary Cookies: Required for site navigation, security token validation, and form submission security. These cannot be switched off.
• Performance & Analytics Cookies: Aggregate, anonymized data regarding site traffic, popular content, and error diagnostics to help us refine user experience.
• Preference Cookies: Storing functional preferences such as language or display settings.

You can manage or disable cookies at any time through your web browser preferences. Please note that disabling essential cookies may impact certain interactive features on our site.

8 Data Retention & Secure Sanitization

We retain data only for as long as necessary to fulfill the purposes outlined in this policy or required by contractual, legal, accounting, and regulatory obligations:

• Consultation Inquiries: Retained for up to 24 months to support ongoing technology discussions, after which inactive lead records are purged.
• Client Project Artifacts: Governed by the client contract; operational access credentials are deleted immediately upon project handover and formal sign-off.
• Statutory Invoices & Tax Records: Retained for 7 years in accordance with Indian tax laws and statutory auditing mandates.
• Cryptographic Erasure: When data reaches the end of its retention window or upon client request, it is cryptographically overwritten or securely destroyed in compliance with industry sanitization standards (NIST SP 800-88).

9 Your Data Protection Rights

Depending on your jurisdiction (such as under the DPDP Act 2023 in India, GDPR in the European Economic Area / UK, or CCPA/CPRA in California), you possess specific rights regarding your personal information:

• Right to Access: Request a summary of the personal data we hold about you and details on how it is processed.
• Right to Correction & Rectification: Request correction of inaccurate, incomplete, or out-of-date records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where retention is no longer justified.
• Right to Restrict or Object: Restrict processing or object to processing carried out under legitimate interest grounds.
• Right to Data Portability: Receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent: Revoke consent previously given (e.g., opting out of marketing communications) without affecting prior lawful processing.
• Right to Nominate: Under the DPDP Act, nominate another individual to exercise data rights in the event of death or incapacity.

To exercise any of these rights, please email our Data Protection team at hr@symanticspace.com. We will verify your identity and respond within 30 days without undue delay.

10 Cross-Border Data Transfers

SymanticSpace provides technology consulting to organizations across global markets. As a result, data may be transferred, stored, and processed in India, the United States, Europe, or other jurisdictions where our secure cloud sub-processors maintain facilities.

When transferring personal data across international borders, we ensure adequate protections are in place through Standard Contractual Clauses (SCCs) approved by the European Commission, mutual contractual covenants, and compliance with statutory transfer regulations under India's DPDP Act.

11 Updates to this Policy

We may update this Privacy Policy periodically to reflect changes in our consulting practices, service enhancements, security standards, or evolving legal frameworks. When updates occur, we will update the "Effective Date" and version number at the top of this document. We encourage you to review this page periodically to stay informed about our data protection standards.

12 Grievance Officer & Contact Information

In compliance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, SymanticSpace has appointed a designated Grievance Officer / Data Protection Officer to address any privacy inquiries, data subject requests, or security concerns.