Privacy
policy

Introduction

This Policy explains how we collect, use, disclose, transfer and secure personal information. Relevant laws include India’s Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

By accessing our Services, you agree to this Policy.

Definitions

Information we collect

We collect Personal Data through direct interactions, automated technologies and third-party integrations.

a. Information you provide

• Name, company, designation, email address and contact number.
• Sign-in credentials and authentication details.
• Support requests, feedback or communications.
• Billing or contractual data (for customers).

b. Information collected automatically

• Device identifiers, IP address, browser type, operating system.
• Access logs, timestamps, geolocation (approximate).
• Usage metrics, API calls, session length and error diagnostics.

c. Information from third parties

• Data provided by client organisations using CyberCyko Workforce.
• Data from marketing partners or supported authentication sources.

We collect only data necessary for the purposes stated below.

Purpose and legal basis of processing

Data retention

We retain Personal Data only for as long as required for lawful purposes or as mandated by regulation.

Disclosure and sharing of information

We may share Personal Data only under strict contractual and legal safeguards:

• Service providers: Amazon Web Services (hosting and cloud infrastructure), Microsoft 365 (email), Razorpay (checkout payments) and security providers, each bound by contractual confidentiality and data protection terms.
• Business partners and resellers: To deliver joint solutions with proper consent.
• Legal authorities: If required by law, court order or government regulation.
• Corporate transactions: During merger, acquisition or asset transfer with prior notice.

We never sell Personal Data to any third party.

Cross-border transfers

Data may be processed or stored on servers located outside India. CyberCyko ensures adequate safeguards including:

• Contractual clauses ensuring equivalent data protection.
• Encryption of data in transit and at rest.
• Access restriction to authorised personnel only.

Data security

CyberCyko implements Reasonable Security Practices and Procedures. CyberCyko is certified under ISO/IEC 27001:2022, and its SOC 2 Type II audit is in progress. Our measures include:

• Multi-layered network, application and data security controls.
• Role-based access and MFA.
• Continuous monitoring and periodic vulnerability assessments.
• Regular employee privacy and security training.
• Incident-response and breach-notification mechanisms.

Data breach notification

In the unlikely event of a data breach that impacts your Personal Data, CyberCyko will:

1. 1.Investigate and contain the breach immediately.
2. 2.Notify affected users and the Data Protection Board of India (if required) within statutory timelines.
3. 3.Provide guidance on remedial actions.

Your rights

As a Data Principal, you have the right to:

• Access your Personal Data held by us.
• Correct or update inaccurate data.
• Erase data no longer necessary for processing.
• Withdraw consent for data processed based on consent.
• Request information about data-sharing and processing.

Requests can be sent to contact@cybercyko.com

Cookies and local storage

Our website does not set cookies and does not run analytics or advertising trackers. It keeps a small amount of information in your browser’s session storage, which your browser clears when you close the tab:

• During sign-up, a draft of the sign-up form, so a reload does not lose your progress. It is cleared when you finish or when you close the tab.

The contact form sends what you type to us by email. When you choose to pay, the payment window is provided by Razorpay and is covered by Razorpay’s own privacy policy.

If we add analytics in future, we will update this Policy before we do.

Third-party links and integrations

Our Services may contain links or integrations to external websites or identity providers you choose to connect. CyberCyko is not responsible for the privacy practices of such third parties. Please review their respective policies.

Children’s privacy

Our Services are intended for persons aged 18 and above. We do not knowingly collect data from minors. If such information is inadvertently received, we will delete it promptly.

Updates to this policy

CyberCyko may modify or update this Policy from time to time. Material changes will be communicated via:

• An updated “Last updated” date on this page.
• Email notice (if you maintain an active account).

Continued use of the Services after such updates constitutes acceptance of the revised Policy.

Governing law and jurisdiction

This Policy shall be governed by and construed in accordance with the laws of the Republic of India. Any disputes shall be subject to the exclusive jurisdiction of the courts at Hyderabad, Telangana, India.

Contact and grievance redressal

In accordance with Rule 5(9) of the SPDI Rules and Section 13 of the DPDP Act 2023, a Grievance Officer has been appointed to address concerns related to personal data processing.

Grievance Officer

We will acknowledge your grievance within 48 hours and endeavour to resolve it within 30 days of receipt, in accordance with applicable law.