Who we are
This website is operated by Cybzilla Systems Private Limited ("Cybzilla", "we", "us"), a company incorporated in India. For the personal data described in this policy, Cybzilla is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the controller under the EU and UK General Data Protection Regulation (GDPR).
- Registered name: CYBZILLA SYSTEMS PRIVATE LIMITED
- Corporate Identity Number (CIN): U72900PN2019PTC186053
- Registered office: Sr. No. 21, Flat 401, Sankalp Dreams, Gurukrupa, Keshavnagar, Mundhwa, Pune, Maharashtra 411036, India
- Email: info@cybzilla.com
What this policy covers
This policy covers visitors to www.cybzilla.com and people who contact us through the website or by email. It does not cover personal data we process on behalf of clients while delivering services. That processing is governed by the client agreement and, where required, a data processing agreement, under which Cybzilla acts as a Data Processor.
Personal data we collect
Data you give us. When you use the contact form we receive your name, work email, company (optional), the service you are interested in, and your message. When you email us we receive your email address and whatever you choose to include.
Data collected automatically. Our hosting and security provider processes your IP address, browser user agent, and the pages you request in order to deliver the site, block abusive traffic, and limit how often the contact form can be submitted from one address. We use Cloudflare Web Analytics, which measures page views and performance in aggregate without cookies and without building a profile of you.
We do not ask for, and ask you not to send us through the website, sensitive personal data such as passwords, financial account details, health information, biometric data, or government identity numbers.
Why we use it and our legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Reply to your inquiry and discuss possible services | Contact form and email content | Data you provided voluntarily for that purpose (DPDP Act, section 7(a)); steps before entering a contract and our legitimate interest in answering business inquiries (GDPR Article 6(1)(b) and (f)) |
| Keep the website secure, prevent spam and abuse | IP address, request data | Our legitimate interest in protecting the site (GDPR Article 6(1)(f)); compliance with law, including CERT-In directions under section 70B of the Information Technology Act, 2000 (DPDP Act, section 7) |
| Understand how the website performs | Aggregated, cookieless analytics | Our legitimate interest in improving the site (GDPR Article 6(1)(f)); no personal profile is created |
| Meet legal, tax, and regulatory obligations and defend legal claims | Records of our communications | Compliance with law and legal claims (DPDP Act, section 7; GDPR Article 6(1)(c) and (f)) |
We do not use your data for automated decision-making that has legal or similarly significant effects on you. We do not send marketing emails unless you ask to receive them, and you can opt out at any time.
International transfers
Cybzilla is based in India. Our service providers operate global infrastructure, so your data may be processed in other countries. Transfers out of India are made in line with section 16 of the DPDP Act and are not made to any country the Government of India has restricted. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on an adequacy decision or on safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for a copy of the relevant safeguards.
How long we keep it
- Inquiries and related email: up to 24 months after our last communication, unless the inquiry leads to an engagement, in which case we keep it for the length of the engagement and the period afterwards that law requires (for example, eight years for accounting records under the Companies Act, 2013).
- Security and request logs: for the short period our providers retain them, or longer where a law such as the CERT-In directions requires.
- Analytics: aggregated figures that do not identify you.
When data is no longer needed we delete it or make it anonymous.
How we protect it
We follow reasonable security practices and procedures, as required by section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and as expected by the DPDP Act. These include encryption in transit with HTTPS and HSTS, strict access control, least-privilege access to inquiries, and security monitoring by our hosting provider.
If a personal data breach occurs, we will notify the Data Protection Board of India and affected individuals as the DPDP Act and its rules require, report cybersecurity incidents to CERT-In within the required time, and notify the relevant supervisory authority and individuals under the GDPR where it applies.
Your rights
Depending on where you live, you have the following rights over your personal data.
Under the DPDP Act (India): to get a summary of the personal data we process and who we have shared it with; to have it corrected, completed, updated, or erased; to withdraw consent where we rely on it, as easily as you gave it; to have your grievances redressed; and to nominate another person to exercise these rights if you die or become incapacitated.
Under the GDPR (EU, EEA, and UK): to access, correct, or erase your data; to restrict or object to its processing, including processing based on legitimate interests; to data portability; to withdraw consent at any time; and to complain to your local data protection authority.
Under US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA): to know what personal information we collect, use, and disclose; to delete or correct it; and not to be discriminated against for exercising these rights. We do not sell or share personal information as those laws define it, and we do not use or disclose sensitive personal information.
To exercise any right, email info@cybzilla.com. We may ask for information to confirm your identity. We reply within one month, or within the shorter period required by the law that applies to you. You can also use an authorised agent where the law allows it.
Children
This website is meant for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.
Grievance Officer and complaints
Questions, requests, and complaints about your personal data can be sent to our Grievance Officer, who will acknowledge them promptly and resolve them within the time required by law, and in any event within 90 days.
- Grievance Officer: Nitesh Yadav
- Email: info@cybzilla.com
- Post: Grievance Officer, Cybzilla Systems Private Limited, Sr. No. 21, Flat 401, Sankalp Dreams, Gurukrupa, Keshavnagar, Mundhwa, Pune, Maharashtra 411036, India
If you are not satisfied with our response, you can complain to the Data Protection Board of India once the DPDP Act's grievance provisions apply to you, or to the data protection authority where you live or work if you are in the EU, EEA, or UK.
Changes to this policy
We will update this policy when our practices or the law change. The date at the top shows when it last changed. If a change materially affects how we use personal data you have already given us, we will tell you before it takes effect.