1. Purpose and Scope
2. Global Regulatory Alignment
Where localized legal requirements differ, the Company applies the higher standard of protection:
- India (DPDPA): Governs processing of digital personal data within India, emphasizing unambiguous consent or specific “legitimate uses.”
- European Union (GDPR): Governs processing of EU residents’ data, requiring a valid legal basis (e.g., legitimate interest, contractual necessity) and applying strict rules on cross-border data flows.
- United States (CCPA/CPRA, etc.): Governs processing of US residents’ data, providing specific rights regarding the “sale” or “sharing” of personal information and opt-out mechanisms.
Xinthe Technologies (P) Ptd., is committed to protecting the privacy and security of personal data.
3. Core Data Protection Principles
- Lawfulness, Fairness, and Transparency: Data must be processed legally and transparently, supported by comprehensive privacy notices.
- Purpose & Data Minimization: Collection is strictly limited to what is adequate, relevant, and necessary for the specified, lawful purpose.
- Data Accuracy & Integrity: Reasonable steps are taken to ensure data is accurate, complete, and updated.
- Storage Limitation: Personal data is deleted or anonymized once the business or legal purpose for its collection is fulfilled.
- Purpose: This Policy outlines how the Company collects, processes, stores, transfers, and safeguards digital personal data. It establishes a harmonized framework combining India’s Digital Personal Data Protection Act (DPDPA), 2023, the EU General Data Protection Regulation (GDPR), and relevant US State Privacy Laws (e.g., CCPA/CPRA).
- Scope: This Policy applies globally to all Company entities, offices, employees, contractors, consultants, and third-party vendors. It covers personal data processed by the Company both as a data controller/fiduciary and as a processor.
4. Roles: Data Fiduciary/Controller vs. Data Processor
- As a Data Fiduciary / Controller (e.g., Corporate HR, B2B Marketing): The Company is directly responsible for issuing privacy notices, managing consent/legal bases, and honoring global data principal/subject rights.
- As a Data Processor (e.g., Offshore IT Outsourcing, SaaS Development, Cloud Support): The Company processes data strictly under the documented instructions of global clients. We maintain standard contractual clauses (SCCs) or data processing agreements (DPAs) to ensure seamless, legally compliant cross-border data transfers.
5. Employee Data Monitoring (New Section)
To safeguard intellectual property, secure client environments, and ensure operational productivity, the Company conducts proportionate employee monitoring.
- Authorized Monitoring Activities: The Company may monitor and log activities on all corporate-owned assets, networks, and communication channels. This includes:
- Workplace Infrastructure: Corporate email accounts, internal chat tools (e.g., Slack, Teams), and file-sharing platforms.
- Device & Security Logs: Keystroke logging (where contractually mandated by high-security clients), application usage tracking, active hours, and internet browsing histories on Company laptops.
- Physical Security: Access control logs (biometrics/badge swipes) and CCTV surveillance in public office zones.
- Transparency & Notice: Employees are notified of active monitoring systems upon onboarding. Monitoring is restricted to business purposes; employees should have no expectation of privacy when using Company networks or corporate-issued equipment.
- Data Minimization in Monitoring: The Company does not actively monitor personal communications or private data unless it intersects with a corporate security investigation or potential data breach. Access to monitoring logs is restricted to authorized HR and Security personnel under strict confidentiality protocols.
6. Global Data Subject & Principal Rights
The Company provides unified channels to respect individual data rights globally:
- Right to Know and Access: Request confirmation of data processing and obtain a portable copy of personal data.
- Right to Correction and Erasure: Rectify inaccuracies or request permanent deletion (“right to be forgotten”), subject to regulatory retention laws.
- Right to Opt-Out / Restrict Processing:
o US/EU: Opt-out of data profiling, automated decision-making, or the sharing of data for targeted advertising.
o India: Conveniently withdraw consent at any time via an accessible portal or contact point. - Non-Discrimination: The Company will never deny employment, services, or degrade quality to individuals exercising their privacy rights.
7. Security Safeguards & Cross-Border Transfers
- Technical Security: Implements end-to-end encryption (AES-256 for data at rest, TLS 1.3 for data in transit), Multi-Factor Authentication (MFA), role-based access control, and continuous security logging.
- Cross-Border Transfers:
o Data transferred from the EU/US to India is protected via approved Standard Contractual Clauses (SCCs) and rigorous Data Transfer Assessments (TIAs).
o Data transfers within India adhere to the localized geographic restrictions and “blacklists” specified by the Government of India.
8. Incident and Breach Management
- Containment & Evaluation: Upon detection of a security incident, the Incident Response Team will immediately isolate affected systems.
- Regulatory Reporting Notifications:
o India: Notify the Data Protection Board of India (DPBI) and affected individuals in line with statutory rules.
o EU (GDPR): Notify the relevant Supervisory Authority within 72 hours of becoming aware of the breach if it poses a risk to individuals.
o US: Notify state Attorneys General and impacted residents according to individual state-mandated timelines.
9. Governance & Grievance Redressal
- Global Data Protection Officer (DPO) / Grievance Officer:
o Name/Designation: Sastry Pullela, Director
o Email Address: sastry@xinthe.com - Response Timelines: The DPO will acknowledge inquiries within 48 hours. Valid requests will be resolved within 30 days (GDPR/DPDPA) or 45 days (CCPA/CPRA), unless extensions are legally permissible and communicated to the requestor.
10. Policy Compliance and Enforcement
- Reviews: This policy is updated annually or immediately upon major legislative changes in our operating regions.
- Enforcement: Violations of this policy by internal staff will trigger disciplinary protocols, up to immediate termination and statutory legal action.
