Home Privacy Policy

Privacy Policy

Committed to ethical data governance, confidentiality, and transparency. Structured in adherence to India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

Effective Date: January 1, 2025 • Jurisdiction: Goa, India • Version: 2.1 (DPDP Compliant)

Our Data Protection Pledge

At VEDRYXONIX TECHNOLOGIES, registered and operating out of Goa, India, we treat client confidentiality and personal data as a fundamental trust. We strictly adhere to the principles of purpose limitation, data minimization, transparent consent, and robust technical security. We do not sell, lease, or monetize your personal or proprietary information.

Table of Contents

01. Entity Standing & Scope 02. Categories of Data Collected 03. Lawful Grounds & Processing 04. Client Code & Confidentiality 05. Retention & Purging Schedule 06. Sub-Processors & Integrations 07. Security Safeguards & Standards 08. Your Rights as a Data Principal 09. Children's Data Protection 10. Grievance Officer & Contact

01. Entity Standing & Scope of Policy

This Privacy Policy governs the practices of VEDRYXONIX TECHNOLOGIES ("VedryXonix", "the Agency", "we", "us", or "our"), having its registered operations in Bicholim, State of Goa, India. It details how we collect, store, handle, transfer, and protect personal data collected through:

  • Our official website (https://vedryxonix.com) and associated subdomains;
  • Our interactive digital consultation tools, including the Project Cost Estimator and Contact Portals;
  • Direct client engagements for Custom Website Engineering, Android & Cross-Platform App Development (Kotlin & Flutter), Managed Web Hosting, and Ongoing Application Maintenance.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act, 2023):

As a Data Fiduciary

We determine the purpose and means of processing personal data provided directly by website visitors, prospective clients requesting quotes, and newsletter subscribers.

As a Data Processor

When developing, migrating, or hosting our clients' custom web or mobile applications, we process end-user data strictly under the written instructions and contracts of our clients.

02. Categories of Personal Data Collected

In alignment with the principle of Data Minimization, we only collect personal data that is strictly necessary to fulfill your technical inquiries, project contracts, and service obligations:

A. Consultation & Inbound Inquiries

When you submit our contact form, request a formal quotation, or use our Project Cost Estimator, we collect your full name, corporate or personal email address, phone number, company/organization name, estimated budget and timeline, and any uploaded project specification briefs or architectural assets.

B. Operational & Billing Details

Upon entering a contractual agreement, we collect business registration details, billing addresses, relevant client tax/business identifiers for commercial invoicing where provided, and banking/transaction identifiers. We do not store credit card credentials, debit card numbers, or CVVs on our servers; all electronic transactions are processed by certified third-party payment gateways (e.g., Razorpay, Stripe).

C. Technical Telemetry & Device Metadata

When accessing our digital infrastructure, our servers and privacy-preserving analytics automatically log non-identifying technical metadata: truncated IP addresses, browser engine and version, operating system, referrer URL, and interaction metrics to protect our network from denial-of-service attempts.

03. Lawful Grounds & Specific Purposes for Processing

Under Section 4 and Section 6 of the DPDP Act 2023, personal data may only be processed for lawful purposes with affirmative consent or for legitimate business and statutory uses:

  • Informed Consent: Communicating with you regarding project estimates, client onboarding, technical consultations, and responding to direct inquiries.
  • Contractual Execution: Developing, compiling, testing, and deploying custom websites, Android APK/AAB packages, server configurations, and database schemas.
  • Infrastructure Security: Monitoring telemetry, preventing brute force attempts, maintaining 99.99% uptime SLA, and safeguarding hosting cluster stability.
  • Statutory Compliance: Maintaining accounting, transaction, and audit ledgers in conformity with applicable Indian commercial, tax, and statutory regulations.

04. Client Code, Intellectual Property & Confidentiality

As an engineering studio, we understand that client projects often involve proprietary business logic, unreleased inventions, trade secrets, and institutional databases:

Non-Disclosure & Trade Secrets

All client codebase repositories, custom API tokens, database credentials, server SSH keys, and design prototypes are governed by strict confidentiality protocols and standard Non-Disclosure Agreements (NDAs).

Repository Isolation

Client repositories are isolated in private, encrypted version-control environments. Access is restricted strictly to assigned engineers on a need-to-know basis.

05. Retention & Automated Purging Schedule

In accordance with Section 8(7) of the DPDP Act 2023, a Data Fiduciary must erase personal data as soon as the specified purpose is realized or consent is withdrawn:

Data Classification Standard Retention Duration Disposal Procedure
Unconverted Estimator / Contact Queries 180 days from receipt Secure digital purge from staging databases
Active Project Source & Staging Artifacts Duration of contract + 60-day handover period Transferred to client custody; staging nodes deleted
Statutory Invoices & Billing Records 8 years (Mandated by Indian Tax Laws) Encrypted financial archive access
Server Security Logs & Access Telemetry 90 days rolling window Automated log rotation and erasure

06. Sub-Processors & Infrastructure Partners

To maintain high availability, ultra-fast SSD hosting, and global edge delivery, we partner with trusted technological infrastructure providers:

Cloudflare Inc.

Edge caching, DDoS prevention, and cookie-free privacy analytics without personal fingerprinting.

Managed Cloud Node Clusters

Tier-3 and Tier-4 data centers with ISO 27001, SOC2 Type II certifications for application hosting.

Google Play Console & Firebase

Android app distribution, crash reporting, and real-time database synchronization for mobile clients.

Razorpay / Stripe

PCI-DSS Level 1 compliant payment gateways for domestic (UPI/Netbanking) and international payments.

07. Technical & Organizational Safeguards

Under Section 43A of the Information Technology Act, 2000 and Section 8(5) of the DPDP Act 2023, we enforce reasonable security standards across our software lifecycle:

  • Mandatory 256-bit TLS/SSL encryption for all data in transit across our web endpoints.
  • Strict role-based access control (RBAC) and mandatory Multi-Factor Authentication (MFA) on all production servers.
  • Automated daily server snapshot backups with off-site redundancy.
  • Continuous vulnerability scanning and sanitized database input parameters to prevent SQL injection and XSS exploits.

08. Your Statutory Rights as a Data Principal

Chapter III of the Digital Personal Data Protection Act, 2023 guarantees you, as a Data Principal, comprehensive rights regarding your personal data:

Right to Access

Obtain a summary of personal data being processed, processing activities carried out, and the identities of all entities with whom your data has been shared.

Right to Correction & Erasure

Request correction of inaccurate or misleading data, completion of incomplete records, and erasure of data no longer required for its original purpose.

Right to Grievance Redressal

Readily accessible grievance resolution from our designated officer, with responses provided within statutory timeframes.

Right to Nominate

Nominate any other individual who shall, in the event of death or incapacity, exercise your Data Principal rights under the Act.

To exercise any of these statutory rights, please send a written request to privacy@vedryxonix.com with the subject line "DPDP Data Principal Rights Request".

09. Protection of Children's Personal Data

In strict compliance with Section 9 of the DPDP Act 2023, VEDRYXONIX TECHNOLOGIES does not knowingly process the personal data of any individual under eighteen (18) years of age without verifiable parental or guardian consent. We do not engage in targeted advertising, behavioral tracking, or profiling directed toward minors.

10. Grievance Officer & Statutory Redressal Mechanism

In accordance with Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the DPDP Act, 2023, the details of our designated Grievance Officer are provided below:

Office of the Grievance Officer

Legal & Regulatory Compliance Department

Entity VEDRYXONIX TECHNOLOGIES
Location / Jurisdiction Bicholim, Goa, India – 403504
Official Email grievance@vedryxonix.com

Turnaround Commitment: Grievance communications are acknowledged within 48 hours of receipt and resolved within 30 days, as stipulated under Indian law.

Appellate Forum: If you remain aggrieved by the decision of our Grievance Officer, you have the right under the DPDP Act 2023 to appeal to the Data Protection Board of India.

This policy is governed by the laws of India. Any legal disputes arising hereunder shall be subject to the exclusive jurisdiction of the competent courts of Bicholim, Goa, India.