Global Privacy Notice & Data Collection Policies

At AvyuktaPro Serv LLP ("AvyuktaPro", "we", "our", or "us"), our mission is to defend corporate infrastructure against modern cyber adversaries through rigorous offensive security, threat intelligence, and digital forensic resilience. As an enterprise cybersecurity provider, we hold data privacy and confidentiality to the highest standards.

This Global Privacy Notice describes our practices concerning the collection, processing, transfer, and storage of personal information across our public websites, client consultations, managed security operations (SOC/MDR), vulnerability assessment engagements, and digital forensic investigations. It is crafted in full alignment with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the Information Technology Act, 2000 (including the SPDI Rules, 2011), the CERT-In Cyber Security Directions, and international data protection standards including the EU/UK GDPR and ISO/IEC 27701.

1. Scope and Our Operational Roles

To understand how your information is handled, it is critical to distinguish between the two distinct capacities in which AvyuktaPro processes data:

A. AvyuktaPro as a Data Fiduciary / Controller

We act as a Data Fiduciary (Data Controller) regarding personal information collected directly through our website (avyuktaproserv.com), corporate communication portals, sales consultations, threat briefings, and recruitment pipelines. In this capacity, we determine the purposes and means of processing your contact and inquiry data.

B. AvyuktaPro as a Data Processor / Service Provider

When delivering managed security services (MDR), SOC & SIEM log correlation, Endpoint Detection and Response (EDR), Zero Trust Network Architecture, and incident response containment to corporate clients, we act as a Data Processor (Service Provider). In these enterprise deployments, we process technical security data strictly under the instructions of our enterprise clients pursuant to executed Master Services Agreements (MSAs), Statements of Work (SOWs), and Data Processing Agreements (DPAs).

2. Security Data, Event Logs & Defensive Data Minimization

Our defensive operations rely on technical system data and security event records to stop ransomware, detect suspicious network activity, and neutralize cyber attacks early. Like global leaders in enterprise threat defense, we maintain strict architectural separation between technical security data and private user content.

Security Data & System Logs We Analyze	What We Do NOT Collect (Excluded from Processing)
System & Process Activity Data: Cryptographic file hashes (SHA-256), process execution records, parent-child process relationships, and command-line execution parameters.	No Document Body Content: We do NOT read, copy, or index the internal text of Word documents, spreadsheets, PDFs, or private client files.
Network Traffic & Connection Logs: Source and destination IP addresses, port numbers, protocol headers, DNS domain lookup requests, and packet volume metrics.	No Private Communications: We do NOT monitor or record email message bodies, instant chat transcripts, audio/video streams, or VoIP communications.
Security Event Records: Operating system event logs, authentication failure codes, firewall connection records, and endpoint security alert flags.	No Keystroke Logging: We do NOT deploy keyboard loggers, user screen recording, or employee surveillance trackers.
Threat Indicators & Signatures: Known attack patterns, exploit signatures, malicious script commands, and indicators of compromise mapped to standard cybersecurity frameworks (such as MITRE ATT&CK).	No Personal Web Browsing Content: We do NOT record user search history, personal browser session cookies, or banking/personal web traffic.

Collaborative Threat Analysis: Technical security data collected during threat investigations is stripped of client-identifiable details and pseudonymized. We analyze these threat patterns to build defensive detection rules that help protect our entire client community against emerging cyber attacks, without ever disclosing confidential client information.

3. Information We Collect

We collect information across the following professional categories:

• Direct Business Communications: Full name, professional corporate email address, telephone/mobile number, company designation, department, and enterprise legal entity name provided via consultation inquiry forms, risk assessment requests, or direct correspondence.
• Digital Forensic Artifacts (DFIR): In active emergency breach investigations, clients may securely transfer compromised host memory captures, disk images, or encrypted triage packages under strict Non-Disclosure Agreements and chain-of-custody protocols compliant with Section 65B of the Indian Evidence Act and ISO/IEC 27037 standards.
• Technical Infrastructure Metadata: Server access logs, client IP addresses, browser user-agent strings, referring URLs, and TLS handshake metrics captured automatically to protect our public perimeter against Distributed Denial of Service (DDoS) attacks and automated vulnerability probing.

4. How We Use Information & Lawful Grounds

Every processing activity conducted by AvyuktaPro is anchored in lawful grounds under Section 6 of the DPDP Act 2023 and Article 6 of the GDPR:

• Explicit Consent: Granted freely by individuals when requesting corporate cybersecurity consultations, downloading technical whitepapers, or engaging via our contact portal.
• Performance of Contract: Delivering defensive architectures, incident containment, digital forensic investigations, cloud posture audits, and penetration testing mandated by enterprise service contracts.
• Legitimate Cybersecurity Defense: Processing defensive system logs, detecting threat actor infrastructure, mitigating cyber incidents, and ensuring continuous network resilience under Section 43A of the IT Act.
• Statutory Compliance: Complying with mandatory cyber incident reporting directives issued by the Indian Computer Emergency Response Team (CERT-In), directives from regulatory authorities (such as the Reserve Bank of India for BFSI audits), and valid judicial subpoenas.

5. Zero Sale & Commercialization Commitment

Information is shared exclusively with vetted technical sub-processors (such as SOC 2 Type II certified cloud hosting providers and certified HSM key custodians) strictly necessary for delivering our services, or with government law enforcement agencies upon receipt of lawful, non-appealable statutory orders.

6. Data Retention and Destruction

We retain personal data and security records only for the minimum period required to fulfill the legitimate purposes outlined in this notice:

• Client Inquiry Data: Retained for a maximum of 24 months after the resolution of commercial discussions, unless an active enterprise engagement is formalized.
• Active Security & Event Logs: Stored for 180 days in hot/warm SIEM storage for real-time threat hunting, followed by archival in compliance with CERT-In mandatory log-retention directions (or as specifically negotiated in client-specific SLA addenda).
• Forensic Investigation Artifacts: Cryptographically erased or returned to the client upon formal closure of the breach investigation and expiry of evidentiary hold mandates.

Upon expiry of the retention window, data is permanently eradicated using DoD 5220.22-M / NIST SP 800-88 cryptographic sanitization standards.

7. Sovereign Safeguards & Security Standards

Our defense posture reflects enterprise-grade sovereign engineering:

• Cryptographic Protection: AES-256-GCM encryption for all data at rest and TLS 1.3 with forward secrecy for all data in transit.
• Zero Trust Architecture: Strict micro-segmentation, mandatory Hardware Multi-Factor Authentication (FIDO2/WebAuthn), and least-privilege role-based access control (RBAC).
• In-Country Sovereign Residency: Client data is hosted in Tier-IV sovereign data centers within India, with optional regional residency configurations for international enterprise clients.
• Continuous Vulnerability Management: Regular red teaming, dynamic penetration testing, and automated SAST/DAST pipeline audits across our operational platforms.

8. Data Principal Rights & Choices

Under the Digital Personal Data Protection Act 2023 and international privacy legislations, you possess enforceable rights over your personal data:

• Right to Access: Request a comprehensive summary of personal data held, along with the processing activities performed and identities of any sub-processors involved.
• Right to Correction & Erasure: Request the rectification of inaccurate records, completion of missing information, or the permanent deletion of personal data no longer necessary for statutory or contractual requirements.
• Right to Grievance Redressal: Submit inquiries or complaints regarding the processing of your data directly to our Grievance Representative, with formal review within 7 business days.
• Right to Nominate: Nominate an individual to exercise your privacy rights in the event of death or incapacity.
• Right to Withdraw Consent: Revoke consent previously granted for optional communications at any time with immediate effect.

9. Privacy & Grievance Redressal

In compliance with the DPDP Act 2023 and the Information Technology Rules, any inquiries or grievances regarding data privacy may be directed to our designated representative: