Privacy Notice

1. Who is responsible

CyberMetric Labs LLP ("CyberMetric Labs", "we") operates this website and decides why and how personal data collected through it is used. Under the DPDPA we are the Data Fiduciary; under the GDPR we are the controller.

Contact: reachout@cybermetriclabs.com.

2. What we collect

This website has no account or sign-up. It has a booking and meeting request form, which prepares an email to us; nothing is sent from the page itself. We receive personal data only if you choose to send it to us, and a small amount of technical data arrives automatically.

• Data you send us: your name, work email address, organisation, role, mobile number (with country code) and message. You enter these in the booking or meeting request form, which prepares an email, or you write them yourself when you email reachout@cybermetriclabs.com. If you use the booking steps, this also includes your preferred time and topic.
• Technical data: your IP address, browser type and request time may be recorded in the server logs of our hosting provider, Hostinger.
• On your device: one small setting recording your privacy choice, described in the Cookie Policy. We use no analytics, advertising or tracking cookies, and load no third-party scripts or fonts.

3. Why we use it, and our legal basis

• To reply to your enquiry by email or phone, and to arrange demonstrations. Basis: you voluntarily gave us the data for this purpose (DPDPA, section 7(a)); consent or steps taken at your request (GDPR Art. 6(1)(a)/(b)).
• To keep the website secure and working. Basis: legitimate uses and reasonable security safeguards (DPDPA, sections 7 and 8(5)); legitimate interests (GDPR Art. 6(1)(f)).
• To meet legal obligations. Basis: DPDPA, section 7(c)/(e); GDPR Art. 6(1)(c).
• We do not sell your data and do not use it for automated decisions or profiling.

4. Who we share it with

Only with service providers that help us run the website, our email and our customer relationship management (CRM) system (hosting, email, CRM), under written terms that require them to protect it, and with authorities where the law requires. Current providers include Hostinger (website hosting) and Microsoft (email).

5. Transfers outside India

Our providers store this data in India: our website is hosted on Hostinger servers in India (Asia), and our Microsoft email data is stored in India. Any transfer of personal data outside India is made only where the DPDPA and its Rules permit.

6. How long we keep it

Enquiry emails are kept only for as long as needed for the purpose you gave them for, within the retention period permitted under the DPDPA, and are then deleted, unless you become a customer (when the customer terms apply) or the law requires longer. Server logs are held as part of Hostinger's backups, which Hostinger keeps for 150 days. Hostinger does not specify any other retention period for them.

7. Your rights

Under the DPDPA (sections 6, 11 to 14) you can:

• ask for a summary of the personal data we hold and how it is used, and who it has been shared with;
• ask us to correct, complete, update or erase it;
• withdraw consent at any time. This is as easy as giving it; withdrawal does not affect what we did before, and we will stop processing and erase the data unless the law requires us to keep it;
• nominate another person to exercise these rights if you die or become incapacitated;
• use our grievance redressal first, and then complain to the Data Protection Board of India.

8. If the GDPR applies to you

You also have the right to access, rectification, erasure, restriction, portability, and to object to processing, and to complain to your local supervisory authority.

9. How to use your rights, and Grievance Officer

Email reachout@cybermetriclabs.com with the subject "Data request" and tell us what you want. We may need to confirm it is you. We aim to reply within 30 days and always within the time the law sets.

Grievance Officer (IT Act SPDI Rules, rule 5(9); DPDPA, section 13): Pankaj Bhargava, Business Head, reachout@cybermetriclabs.com.

10. Children

This website is meant for business users and is not directed at children. If you believe a child under 18 has sent us personal data, tell us and we will delete it (DPDPA, section 9).

11. Security

We apply reasonable security safeguards, including encrypted connections (HTTPS) and access limits. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires.

12. Changes

We will post any change here with a new date. Material changes will be highlighted on the home page for a reasonable period.