Privacy Policy.

Who we are

This website is operated by Cerebratum Technology Services Pvt. Ltd., a company incorporated in India with its office in Chennai, Tamil Nadu ("Cerebratum", "we", "us" or "our").

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for personal data collected through this website. Where other data protection laws apply to you, we act as the controller of that data.

This policy covers personal data collected through this website only. Personal data we process on behalf of clients during service engagements is governed by the relevant client contract.

What we collect

We collect only what we need for the purposes described below.

• Contact form: your name, work email address, company, role, phone number if you provide it, and the content of your message.
• Newsletter: your email address and, where provided, your name and subscription preferences.
• Cookies and analytics: device and browser type, approximate location derived from IP address, pages viewed, referring pages and interaction data, collected through cookies and similar technologies.
• Correspondence: any information you share with us in follow-up emails or calls.

Why we use it

• To respond to enquiries and arrange discovery calls you request.
• To send newsletters and insights you have subscribed to.
• To understand how the website is used and improve its content and performance.
• To keep the website secure and to detect and prevent abuse.
• To meet legal, tax and regulatory obligations.

Legal basis and consent

Under the DPDP Act, we process your personal data on the basis of your consent, given when you submit a form, subscribe to the newsletter or accept non-essential cookies, or for certain legitimate uses permitted by law.

You may withdraw consent at any time. Withdrawal does not affect processing carried out before it. Where GDPR or similar laws apply, we rely on consent, our legitimate interests in responding to business enquiries and running this website, or compliance with legal obligations, as relevant.

Sharing with service providers

We do not sell personal data. We share it only with service providers who process it on our behalf, under written terms that limit their use of the data to our instructions and require appropriate security. These Data Processors include providers of website hosting, email and form handling, newsletter delivery, analytics and customer relationship management.

We may also disclose personal data where required by law, court order or a competent authority, or to protect our rights, property or safety.

International transfers

Some of our service providers store or process data outside India. We transfer personal data only to countries that are not restricted by the Government of India under the DPDP Act.

Where you are located in a region with its own transfer rules, such as Europe, we use appropriate safeguards such as standard contractual clauses where required.

Retention

• Enquiry and correspondence data is kept for as long as needed to respond and to manage any resulting business relationship, and then for a limited period for record keeping.
• Newsletter data is kept until you unsubscribe, after which we keep only what is needed to honour the opt-out.
• Analytics data is retained in aggregated or pseudonymised form for the period set in our analytics configuration.
• Data may be kept longer where a law requires it.

Security

We use reasonable security safeguards, as required by the DPDP Act and the Information Technology Act, 2000 and its rules. These include encryption in transit, access controls based on least privilege, multi-factor authentication for administrative accounts and vetting of service providers.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as required by law.

Your rights

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correct, complete or update inaccurate or incomplete data.
• Have your personal data erased where it is no longer needed or you withdraw consent.
• Withdraw consent at any time.
• Nominate another person to exercise your rights in the event of death or incapacity.
• Have your grievances addressed by us, and if unresolved, approach the Data Protection Board of India.
• Where GDPR applies, object to or restrict processing, request portability and complain to your local supervisory authority.

Cookies

Essential cookies keep the website working and secure, and are set without consent. Analytics and other non-essential cookies are used only if you accept them.

You can change your cookie choices at any time through your browser settings or any cookie controls shown on the website. Blocking some cookies may affect how the website works.

Children

This website is intended for business users and is not directed at children. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a child has given us personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last revised. Material changes will be highlighted on the website.

Contact and grievances

To exercise your rights, withdraw consent or raise a concern, please write to us through the contact page on this website, mentioning "Privacy" in your message. We will respond within the time required by applicable law.

Cerebratum Technology Services Pvt. Ltd., Chennai, Tamil Nadu, India.