How we handle your data.

1. Who we are & Registered Corporate Office

Cehpoint ("we", "our", "us") is an Indian AI, software, and cybersecurity engineering firm. Registered Corporate Office: Sandipan Pathsala Para, Fullara Temple Road, Labpur, Birbhum, West Bengal 731303, India (GSTIN: 19ETGPB5153Q1Z5). For this policy, Cehpoint acts as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Data Controller under the EU/UK General Data Protection Regulation ("GDPR"). When we process data on behalf of an enterprise client, we act as a Data Processor under a binding Data Processing Addendum (DPA).

2. Data we collect

You give us directly — name, email, phone, company, role, country, project description, budget range, attachments — when you fill our quotation, contact, careers, partner, or tender forms.

Collected automatically — IP address, device and browser fingerprint, referring URL, language preference, theme preference, anonymised analytics events. We do not use third-party advertising cookies.

From third parties — when you sign in via an OAuth provider on one of our portals (e.g. Projects Portal, Outreach), we receive the profile fields you authorise that provider to share.

Sensitive personal data — we do not collect government-issued IDs, biometrics, financial account numbers, or health data through the marketing site. If a project requires such data, it is collected only inside the dedicated client portal with a signed Data Processing Addendum.

3. Why we process it (lawful basis)

• Performance of a contract — to respond to your inquiry, prepare a proposal, deliver the project you engaged us for, and invoice you.
• Legitimate interest — to keep the website secure, prevent fraud, run aggregate analytics that don't identify you, and improve our services.
• Consent — for any marketing communications you opt into; you can withdraw consent at any time without affecting prior lawful processing.
• Legal obligation — to comply with Indian tax, GST, statutory audit, and lawful information requests from competent authorities.

4. Sharing & processors

We share personal data only with vetted processors who help us run the business. Each is bound by data processing agreements and processes data only on our instructions:

• Hosting & Cloud Infra — Oracle Cloud Infrastructure (OCI), Hetzner (Germany), and Cloudflare.
• Email & transactional messaging — Google Workspace, transactional relay.
• Payments — PayU, Stripe (tokenized, PCI-DSS compliant).
• Helpdesk & CRM — internally hosted; access restricted by role.

We do not sell personal data. We do not share it for cross-context behavioural advertising. We do not perform automated decision-making with legal effect on you.

5. International transfers & GDPR / CCPA Compliance

Our primary data is stored in India. When data moves across borders, we rely on the European Commission's Standard Contractual Clauses (SCCs) and statutory adequacy safeguards. For California residents under the CCPA/CPRA: We do NOT sell or share your personal information. You have the right to know, delete, correct, and non-discrimination. Exercise rights at grievance@cehpoint.co.in.

6. Retention

We keep inquiry data for up to 24 months after the last interaction, after which it is securely deleted unless a longer period is required for tax, statutory audit, or active litigation. Financial and invoicing ledgers are retained for up to 8 years under the Central Goods and Services Tax Act (CGST).

7. Your rights as a Data Principal & 22 Indian Languages Notice

Under the DPDP Act 2023 and GDPR you have the right to access, correct, erase, nominate a representative, and withdraw consent. In compliance with DPDP Section 5(3), you can view our statutory notice in English and all 22 Scheduled Indian Languages and submit automated requests on our Interactive Data Principal Rights (DPR) Portal.

8. Cookies & local storage

We use first-party cookies strictly to maintain sessions and remember preferences. We do not deploy third-party advertising cookies or cross-site tracking pixels.

9. Grievance Officer & DPO Directory

In accordance with Rule 3(2) of the IT Rules 2021 and the DPDP Act 2023, contact our Grievance Officer / DPO: Jit Banerjee (Director / DPO), Cehpoint, Sandipan Pathsala Para, Fullara Temple Road, Labpur, Birbhum, West Bengal 731303, India. Email: grievance@cehpoint.co.in. Statutory acknowledgment SLA: within 24 hours. Resolution SLA: within 15–30 days.

10. Security & CERT-In 6-Hour Incident Notification

We apply enterprise-grade controls — TLS 1.3 in transit, AES-256 at rest, hashed credentials, role-based access, signed audit logs, and 180-day log preservation. In accordance with Section 70B of the IT Act and CERT-In Directions 2022, cybersecurity incidents are reported to CERT-In within 6 hours (incident@cert-in.org.in / certin-reporting@cehpoint.co.in) and to the Data Protection Board of India.

11. Changes to this policy

We review this policy regularly and whenever the law materially changes. Material changes will be prominently notified across our portals.

12. Contact

General support: support@cehpoint.co.in · Statutory privacy & grievances: grievance@cehpoint.co.in · Phone: +91-90911-56095.