Privacy Statement: Commitment to Data Protection

1Cybrexus Commitment to Data Protection

At Cybrexus Technology Services Pvt. Ltd. (operating as "Cybrexus Technology", "we", "us", or "our"), data privacy, digital integrity, and organizational security are core operational tenets. We process personal and confidential records entrusted to us responsibly, securely, and in strict compliance with applicable statutory laws.

This Privacy Statement outlines how we collect, store, process, and protect digital personal data when you interact with our secure document vault, credentials registry, and administrative portal.

2Scope & Statutory Roles

Under the Digital Personal Data Protection Act, 2023 (DPDP Act):

• Data Fiduciary: Cybrexus Technology acts as the Data Fiduciary determining the purpose and means of processing digital personal data for account creation, role-based document access, and system notifications.
• Data Principal: You (the registered user, administrator, staff member, viewer, or visitor) are the Data Principal whose personal data is processed.

3Categories of Personal Data Collected

In adherence to the principle of Data Minimization under Section 6 of the DPDP Act, we collect only the personal information strictly necessary to provide portal authentication and secure digital asset management:

4Lawful Grounds & Purposes of Processing

Personal data is processed strictly under valid lawful grounds recognized under Section 4 and Section 6 of the DPDP Act, 2023:

• Explicit Consent: Provided by users during self-registration and account management.
• Performance of Legitimate Contractual Obligations: Providing digital repository storage, multi-user document workflows, and administrative verifications.
• System Alerts & Critical Notifications: Dispatched via verified transactional email pipelines (Brevo REST API / SMTP) for account activation, security OTPs, and registration approvals.
• Statutory Cybersecurity Compliance: Preventing unauthorized access, tampering, or malicious intrusion under the Information Technology Act, 2000.

5Protection of Users & Minors (Section 9 DPDP Act)

Cybrexus Technology strictly upholds:

• Zero Third-Party Advertising: No advertising trackers (such as Google AdSense or Meta Pixels) are embedded in this application.
• Zero Commercial Data Selling: We never sell, lease, or monetize user profiles, contact lists, or uploaded repository contents.

6Security Architecture & CERT-In Audit Logs

We employ multi-layer security defenses to safeguard data from loss, unauthorized disclosure, or destruction:

• Encrypted Transport: Enforced TLS 1.3 encryption across all client-server communications.
• Strict Role-Based Access Control (RBAC): Separation of administrative privileges, document privacy flags, and permission matrices.
• Immutable Forensic Logging: In accordance with CERT-In directives and IT Security Rules, system events and administrative changes are recorded in tamper-evident audit logs.

7Data Sharing & Third-Party Processors

We do not share your personal data with third parties except with trusted, infrastructure-level Service Providers (Data Processors) operating under strict data processing agreements:

• Transactional Email Gateway: Brevo (Sendinblue) REST API v3 and authenticated SMTP relays for dispatching operational notifications, verification OTPs, and approval notices.
• Statutory Law Enforcement: Strictly when compelled under court order, regulatory mandate, or emergency legal obligation under Indian law.

8Data Principal Rights under DPDP Act, 2023

As a Data Principal under Chapter III of the DPDP Act, 2023, you possess enforceable rights:

• Right to Access (Section 11): Request a summary of your personal data processed and identities of processing entities.
• Right to Correction & Updating (Section 12): Rectify inaccurate, outdated, or incomplete profile credentials.
• Right to Erasure (Section 12(3)): Request permanent purging of your account and private repository files.
• Right to Withdraw Consent (Section 6(4)): Withdraw consent at any time as easily as giving it, including managing or revoking cookie permissions.
• Right of Grievance Redressal (Section 13): Access an expeditious dispute resolution mechanism through our designated Grievance Officer.

9Cookie Governance & Consent Manager

Our platform utilizes a standardized, affirmative consent manager. Non-essential cookies (such as UI theme memory or telemetry benchmarks) require affirmative consent and can be toggled off at any time using our floating Cookie Settings widget.

For a comprehensive breakdown of technical cookie names, expiration terms, and domain scopes, review our dedicated Cookie Classification Policy.

10Designated Data Protection & Grievance Officer

Pursuant to Section 8(9) and Section 13 of the DPDP Act, 2023, Cybrexus Technology has appointed a designated Grievance Officer to address questions, exercise of rights, or security concerns: