Privacy Policy

Tecsxpert Technologies Private Limited ("tecsxpert", "we", "us", or "our") operates the tecsxpert GRC platform and associated websites. This Privacy Policy explains how we collect, use, store, and share personal data when you use our services, and the rights you have over your data.

This policy applies to visitors of tecsxpert.com, users of the tecsxpert GRC platform (app.tecsxpert.com), and individuals whose data is processed as part of our managed GRC services. It complies with the Digital Personal Data Protection Act 2023 (DPDP Act), the General Data Protection Regulation (GDPR), and other applicable privacy laws.

1. Who We Are

Data Controller: Tecsxpert Technologies Private Limited, registered in India (CIN: [pending]).
Registered Address: Mumbai, Maharashtra, India.
EU Representative: [EU representative details — to be appointed].
Data Protection Officer / Privacy Contact: privacy@tecsxpert.com

2. What Data We Collect

2.1 Data you provide directly

• Account information: Name, work email, company name, job title, country.
• Contact form submissions: Name, email, message content, and any information you choose to include.
• Application / onboarding data: Entity type, business documents, tax identification numbers, and other details required for platform access.
• Payment information: Processed via our payment provider. tecsxpert does not store card details.

2.2 Data we collect automatically

• Usage data: Pages visited, features used, session duration, click patterns.
• Technical data: IP address, browser type, operating system, device identifiers.
• Cookies: See Section 7 (Cookies) for details.

2.3 Customer data processed on your behalf

If you are a tecsxpert customer, we process data that you upload to or generate within the platform (risk data, compliance evidence, vendor information, etc.) as a Data Processor on your behalf. This is governed by our Data Processing Agreement (DPA), available on request at privacy@tecsxpert.com.

3. Why We Use Your Data (Legal Bases)

4. How We Share Your Data

We do not sell your personal data. We may share data with:

• Sub-processors: Cloud infrastructure (Supabase/AWS), email delivery, analytics, and payment processing. Our current sub-processor list is available on request.
• Legal authorities: Where required by law, court order, or to protect the rights of tecsxpert or others.
• Business transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred to the successor entity.

5. International Data Transfers

Your data may be processed in India, the EU (Frankfurt), or the US. Where we transfer data outside the EU/EEA, we use Standard Contractual Clauses (SCCs) or other approved safeguards. Where we transfer data outside India, we comply with the cross-border data transfer requirements under the DPDP Act 2023. Contact privacy@tecsxpert.com to request our transfer impact assessment.

6. Data Retention

We retain personal data for as long as your account is active and for a period thereafter as required by law or legitimate business purposes (typically 7 years for financial records, 3 years for marketing data after last interaction). Platform data is deleted within 30 days of account termination, subject to any legal hold obligations.

7. Cookies

We use the following categories of cookies:

• Strictly necessary: Authentication, session management. No consent required.
• Analytics: Usage analytics to improve the platform. Requires consent.
• Preferences: UI preferences and language settings. Requires consent.

You can manage cookie preferences via the cookie consent banner or your browser settings.

8. Your Rights

Depending on your jurisdiction, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal obligations).
• Portability: Receive your data in a structured, machine-readable format (GDPR).
• Objection / Withdrawal of consent: Object to processing or withdraw consent at any time.
• Grievance (DPDP Act): File a grievance with our Data Protection Officer.

To exercise any right, contact privacy@tecsxpert.com. We will respond within 30 days (GDPR) or within the timeframe specified under the DPDP Act.

9. Data Security

We use industry-standard security measures including encryption at rest (AES-256) and in transit (TLS 1.3), role-based access controls, and regular security assessments. Despite these measures, no method of transmission over the internet is 100% secure. In the event of a data breach affecting your rights, we will notify you and applicable regulators within the legally required timeframes.

10. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact privacy@tecsxpert.com immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to registered users by email. Continued use of our services after the effective date constitutes acceptance of the updated policy.

12. Contact & Complaints

Data Protection Officer: privacy@tecsxpert.com
General enquiries: contactus@tecsxpert.com
Phone: +91 88844 00227

If you are in the EU and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority (e.g., the CNIL in France, BfDI in Germany). If you are in India, you may raise a complaint with the Data Protection Board of India once it is established under the DPDP Act 2023.