Privacy Policy

This page contains the complete Privacy Policy of CyArt Tech: Part A applies to clients, users and visitors, and Part B applies to job applicants, employees and interns.

01Introduction & Scope

This Privacy Policy ("Policy") governs the collection, processing, storage, and disclosure of personal data by CyArt Tech ("CyArt", "we", "us", or "our"). This Policy applies to all users, clients, visitors, and stakeholders who interact with our platforms, services, and digital infrastructure.

1.1Applicability

This Policy applies to all CyArt products, services, websites, applications, and communications, including but not limited to CyVul Track, CyShield, CyAnalyse, CyKnock, and all associated web properties.

1.1.1Territorial Scope

This Policy applies to the processing of personal data within all jurisdictions where CyArt operates, including but not limited to India, the European Economic Area (EEA), the United Kingdom, and the United States. We comply with applicable data protection laws in each jurisdiction.

1.1.2Data Subjects

This Policy covers all categories of data subjects, including website visitors, trial users, paying customers, enterprise clients, government agencies, job applicants, contractors, and any individual whose personal data is processed through our services.

1.2Definitions

For the purposes of this Policy, the following definitions apply:

1.2.1Personal Data

"Personal Data" means any information relating to an identified or identifiable natural person, including but not limited to name, email address, IP address, device identifiers, location data, behavioral data, and any data that can directly or indirectly identify an individual.

1.2.2Processing

"Processing" means any operation performed on Personal Data, whether by automated or manual means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction.

1.2.3Data Controller & Processor

CyArt acts as a Data Controller when determining the purposes and means of processing. When processing data on behalf of enterprise or government clients, CyArt acts as a Data Processor under the terms of applicable Data Processing Agreements (DPAs).

02Data Collection

CyArt collects personal data through multiple channels and mechanisms, each governed by specific lawful bases and purposes as outlined below.

2.1Data Collected Automatically

When you access our platforms, certain data is collected automatically through technological means.

2.1.1Technical Data

We collect IP addresses, browser type and version, operating system, device identifiers, screen resolution, timezone settings, and referring URLs. This data is collected via server logs and analytics instrumentation.

2.1.2Usage Data

We collect session duration, page views, navigation paths, click events, scroll depth, feature interactions, error logs, and performance metrics. This data is anonymized and aggregated for analytics purposes.

2.1.3Cookie & Tracking Data

We use essential, functional, and analytics cookies. Essential cookies are required for platform operation. Functional cookies enhance user experience. Analytics cookies help us understand usage patterns. Third-party tracking is limited to anonymized analytics services only.

2.2Data Provided by Users

We collect data that you voluntarily provide through forms, registrations, and direct communications.

2.2.1Account Registration

Name, email address, organization name, job title, phone number, and authentication credentials. Passwords are hashed using bcrypt with a minimum cost factor of 12 and are never stored in plaintext.

2.2.2Service Engagement

Meeting preferences, communication records, project requirements, security assessment scope, contractual data, billing information, and service feedback. Financial data is processed through PCI DSS Level 1 certified payment processors.

2.2.3Career Applications

Resume/CV data, educational history, employment history, portfolio links, and assessment responses. Applicant data is retained for 24 months post-application unless deletion is requested.

2.3Data from Third Parties

In certain circumstances, we receive personal data from third-party sources.

2.3.1Business Partners

Referral information, co-marketing data, and joint venture participant data, processed under legitimate interest or contractual necessity.

2.3.2Public Sources

Publicly available professional data from business directories, professional networks, and public registries, used for sales outreach under legitimate interest with opt-out rights.

03Lawful Basis for Processing

CyArt processes personal data under one or more of the following lawful bases as defined under the General Data Protection Regulation (GDPR), the Digital Personal Data Protection Act (DPDPA), and equivalent legislation.

3.1Consent

Where processing is based on consent, it is obtained through clear, affirmative action. Consent is granular, freely given, and can be withdrawn at any time without affecting the lawfulness of prior processing. Consent records are maintained with timestamps and version history.

3.1.1Withdrawal of Consent

You may withdraw consent at any time by contacting [email protected], using the unsubscribe mechanism in communications, or through your account settings. Withdrawal is processed within 72 hours.

3.2Contractual Necessity

Processing necessary for the performance of a contract, including service delivery, account management, billing, support, and fulfillment of service-level agreements (SLAs).

3.3Legitimate Interest

Processing conducted under legitimate interest is subject to a Legitimate Interest Assessment (LIA). Our legitimate interests include platform security, fraud prevention, service improvement, and direct marketing to existing clients.

3.3.1Balancing Test

Each LIA includes a balancing test weighing our interests against the rights and freedoms of data subjects. Where the balance favors the data subject, processing does not proceed without explicit consent.

3.4Legal Obligation

Processing required to comply with applicable laws, regulations, court orders, or government directives, including tax reporting, anti-money laundering requirements, and lawful interception obligations.

04Data Storage & Security

CyArt implements comprehensive technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction.

4.1Encryption Standards

All personal data is encrypted using industry-standard cryptographic protocols.

4.1.1Data at Rest

AES-256-GCM encryption for all stored personal data. Encryption keys are managed through Hardware Security Modules (HSMs) with automated key rotation on a 90-day cycle.

4.1.2Data in Transit

TLS 1.3 for all communications. Certificate pinning is enforced on mobile applications. HSTS headers with a minimum max-age of 31536000 seconds are deployed across all web properties.

4.1.3Key Management

Encryption keys are stored in dedicated HSMs with FIPS 140-2 Level 3 certification. Key access is restricted to authorized personnel with role-based access controls and multi-factor authentication.

4.2Access Controls

Access to personal data is governed by the principle of least privilege.

4.2.1Authentication

Multi-factor authentication (MFA) is mandatory for all personnel accessing personal data. MFA methods include hardware security keys (FIDO2/WebAuthn), time-based one-time passwords (TOTP), and biometric verification.

4.2.2Authorization

Role-based access control (RBAC) with attribute-based extensions. Access reviews are conducted quarterly by the Data Protection Officer. All access events are logged and monitored in real-time.

4.3Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law.

4.3.1Retention Periods

Active account data: duration of account plus 30 days. Contractual data: duration of contract plus 7 years (statutory requirement). Analytics data: 26 months in anonymized form. Server logs: 90 days. Backup data: 180 days with cryptographic deletion thereafter.

4.3.2Data Deletion

Upon expiration of retention periods, data is deleted using cryptographic erasure methods conforming to NIST SP 800-88 Rev. 1 guidelines. Deletion certificates are available upon request for enterprise and government clients.

05Data Subject Rights

CyArt recognizes and upholds the rights of data subjects as defined under applicable data protection legislation. All requests are processed within 30 calendar days.

5.1Right of Access (GDPR Art. 15)

You have the right to obtain confirmation of whether your personal data is being processed and, if so, access to the data along with supplementary information including the purposes, categories of data, recipients, retention periods, and the source of data.

5.2Right to Rectification (GDPR Art. 16)

You have the right to have inaccurate personal data corrected without undue delay, and to have incomplete personal data completed, including by providing a supplementary statement.

5.3Right to Erasure (GDPR Art. 17)

You have the right to request the deletion of your personal data where the data is no longer necessary for the purpose it was collected, you withdraw consent, you object to processing, the data was unlawfully processed, or deletion is required by law.

5.3.1Exceptions

The right to erasure does not apply where processing is necessary for exercising the right of freedom of expression, compliance with legal obligations, public interest in public health, archiving in the public interest, or the establishment, exercise, or defense of legal claims.

5.4Right to Data Portability (GDPR Art. 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON or CSV), and to transmit that data to another controller without hindrance.

5.5Right to Object (GDPR Art. 21)

You have the right to object to processing based on legitimate interest or direct marketing. Upon objection, processing ceases unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

5.6Exercising Your Rights

To exercise any of the above rights, submit a request to [email protected] with the subject line "Data Subject Request". Identity verification will be required. Requests are acknowledged within 48 hours and fulfilled within 30 calendar days. Complex requests may be extended by an additional 60 days with notification.

06International Data Transfers

Where personal data is transferred outside the jurisdiction of collection, CyArt ensures adequate safeguards are in place.

6.1Transfer Mechanisms

Cross-border data transfers are conducted under Standard Contractual Clauses (SCCs) as approved by the European Commission, Binding Corporate Rules (BCRs), or adequacy decisions. Additional safeguards include supplementary technical measures such as encryption and pseudonymization.

6.1.1Government Clients

For government clients, CyArt guarantees 100% data residency within the client's national jurisdiction. No cross-border transfers occur under any circumstances for government-classified data. Air-gapped deployment options eliminate any internet-based transfer risk.

6.2Sub-Processors

CyArt maintains a list of approved sub-processors. Any addition or change to sub-processors is communicated to affected clients 30 days in advance. Sub-processors are bound by Data Processing Agreements with equivalent privacy and security obligations.

07Incident Response & Breach Notification

CyArt maintains a comprehensive data breach incident response plan aligned with NIST Cybersecurity Framework and ISO 27035.

7.1Notification Timeline

In the event of a personal data breach, CyArt will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (GDPR Art. 33). Affected data subjects will be notified without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

7.1.1Breach Notification Content

Notifications include the nature of the breach, categories and approximate number of affected data subjects, likely consequences, measures taken or proposed to address the breach, and contact details of the Data Protection Officer.

7.2Post-Incident Review

All incidents are followed by a root cause analysis, remediation plan, and process improvement review. Findings are documented and retained for a minimum of 5 years. Aggregated incident statistics are included in annual transparency reports.

08Contact & Governance

For any questions, concerns, or requests regarding this Privacy Policy or CyArt's data processing practices, contact our Data Protection Officer.

8.1Data Protection Officer

Email: [email protected]. All communications are treated as confidential. Response time: 48 hours for standard inquiries, 24 hours for urgent matters.

8.2Supervisory Authority

You have the right to lodge a complaint with your local supervisory authority. For EEA residents, a list of supervisory authorities is available at the European Data Protection Board (EDPB) website.

8.3Policy Updates

This Policy is reviewed and updated at least annually or when significant changes occur to our processing activities. Material changes are communicated via email and platform notification 30 days prior to taking effect. Continued use of CyArt services after the effective date constitutes acceptance of the updated Policy.

01Scope

This Careers Privacy Policy explains how CyArt Tech ("CyArt", "we", "us", or "our") handles personal data of job applicants, interns, and employees. Our general Privacy Policy continues to apply to your use of our website and services.

02Information We Collect

We collect only the information needed to run our hiring process and manage your employment or internship.

2.1Application Data

Resume/CV data, educational history, employment history, portfolio links, and assessment responses.

2.2Work & Performance Records

Assigned tasks and submissions, deadlines, review feedback, meeting attendance, and any formal warnings issued under our Careers Terms & Conditions.

2.3Leave Records

Leave requests and supporting documents, including medical certificates for sick leave and examination schedules, timetables, or university correspondence for examination leave.

2.4Commitment Records

The commitment confirmation you choose: a notarised affidavit, a letter from your university or college, or the payment and refund details needed to process a refundable security deposit.

03How We Use Your Information

We use this information for the following purposes:

3.1Hiring

To review applications, evaluate assessment responses, contact candidates, and onboard selected applicants.

3.2Managing Your Engagement

To assign tasks, provide mentorship, review work, approve leave, and apply our performance, warning, and termination policies.

3.3Legal & Administrative Needs

To process deposits and refunds where applicable, keep required records, and comply with applicable law.

04Who Can Access Your Information

Your information is shared with the people and providers who need it for the purposes above.

4.1Within CyArt

HR, hiring teams, Team Leads, and Managers can access information relevant to their role. Medical certificates and other leave documents are limited to the team reviewing them. If a matter is escalated, they may be shared with the authorized authority handling it.

4.2Service Providers

Job applications are submitted through Tally (tally.so), a third-party form provider, when you use the apply link on our Careers page. Tally processes your responses on our behalf.

4.3Legal Disclosure

We may disclose information where required by applicable law, court order, or government authority.

05Retention

We keep personal data only for as long as necessary for the purposes it was collected, or as required by applicable law.

5.1Applicants

Applicant data is retained for 24 months post-application unless deletion is requested.

5.2Interns & Employees

Work, performance, and leave records are retained for the duration of your engagement and afterwards as long as needed to meet legal and administrative obligations. Contractual data is retained for the duration of the contract plus 7 years.

06Security

Careers data is protected by the technical and organizational measures described in our general Privacy Policy, including encryption and role-based access controls.

07Your Rights

You may request access to your personal data, ask us to correct or delete it, object to certain processing, or withdraw consent where processing is based on consent.

7.1Making a Request

Email [email protected] with the subject line "Data Subject Request". Identity verification will be required. Requests are acknowledged within 48 hours and fulfilled within 30 calendar days.

7.2Limits

We may need to keep certain records where required to comply with legal obligations or to establish, exercise, or defend legal claims.

08Contact & Updates

For privacy questions, contact [email protected]. For questions about an application or position, contact [email protected]. We may update this Policy from time to time, and the latest version will always be available on this page.

For any queries regarding this Privacy Policy, contact [email protected].